diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2012-12-09 13:46:18 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2012-12-09 13:46:18 (GMT) |
| commit | 7dddec4e9d8aa01f9c25d7824f67510eab931855 (patch) | |
| tree | 87658e28c3cb492ac441e4fdcb18053e9e919e4d | |
| parent | 367efc254ddd6b1e40c36d702bc727b9c26dcdcb (diff) | |
| download | cpython-7dddec4e9d8aa01f9c25d7824f67510eab931855.zip cpython-7dddec4e9d8aa01f9c25d7824f67510eab931855.tar.gz cpython-7dddec4e9d8aa01f9c25d7824f67510eab931855.tar.bz2 | |
Issue #16248: Disable code execution from the user's home directory by tkinter when the -E flag is passed to Python.
Patch by Zachary Ware.
| -rw-r--r-- | Lib/lib-tk/Tkinter.py | 4 | ||||
| -rw-r--r-- | Misc/NEWS | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/Lib/lib-tk/Tkinter.py b/Lib/lib-tk/Tkinter.py index 795cc45..cec31fd 100644 --- a/Lib/lib-tk/Tkinter.py +++ b/Lib/lib-tk/Tkinter.py @@ -1709,7 +1709,9 @@ class Tk(Misc, Wm): self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use) if useTk: self._loadtk() - self.readprofile(baseName, className) + if not sys.flags.ignore_environment: + # Issue #16248: Honor the -E flag to avoid code injection. + self.readprofile(baseName, className) def loadtk(self): if not self._tkloaded: self.tk.loadtk() @@ -160,6 +160,9 @@ Core and Builtins Library ------- +- Issue #16248: Disable code execution from the user's home directory by + tkinter when the -E flag is passed to Python. Patch by Zachary Ware. + - Issue #16628: Fix a memory leak in ctypes.resize(). - Issue #13614: Fix setup.py register failure with invalid rst in description. |