[Python-checkins] cpython (2.7): Issue #16248: Disable code execution from the user's home directory by tkinter
antoine.pitrou
python-checkins at python.org
Sun Dec 9 14:51:26 CET 2012
http://hg.python.org/cpython/rev/822b472eff13
changeset: 80781:822b472eff13
branch: 2.7
parent: 80767:80f0c7d5deda
user: Antoine Pitrou <solipsis at pitrou.net>
date: Sun Dec 09 14:46:18 2012 +0100
summary:
Issue #16248: Disable code execution from the user's home directory by tkinter when the -E flag is passed to Python.
Patch by Zachary Ware.
files:
Lib/lib-tk/Tkinter.py | 4 +++-
Misc/NEWS | 3 +++
2 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/Lib/lib-tk/Tkinter.py b/Lib/lib-tk/Tkinter.py
--- a/Lib/lib-tk/Tkinter.py
+++ b/Lib/lib-tk/Tkinter.py
@@ -1709,7 +1709,9 @@
self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
if useTk:
self._loadtk()
- self.readprofile(baseName, className)
+ if not sys.flags.ignore_environment:
+ # Issue #16248: Honor the -E flag to avoid code injection.
+ self.readprofile(baseName, className)
def loadtk(self):
if not self._tkloaded:
self.tk.loadtk()
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -160,6 +160,9 @@
Library
-------
+- Issue #16248: Disable code execution from the user's home directory by
+ tkinter when the -E flag is passed to Python. Patch by Zachary Ware.
+
- Issue #16628: Fix a memory leak in ctypes.resize().
- Issue #13614: Fix setup.py register failure with invalid rst in description.
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list