[Python-checkins] cpython (merge 3.2 -> 3.3): Issue #16248: Disable code execution from the user's home directory by tkinter

[antoine.pitrou]

http://hg.python.org/cpython/rev/10d04bdb05ab
changeset:   80779:10d04bdb05ab
branch:      3.3
parent:      80775:3b67247f0bbb
parent:      80778:d8300842a0e9
user:        Antoine Pitrou <solipsis at pitrou.net>
date:        Sun Dec 09 14:46:46 2012 +0100
summary:
  Issue #16248: Disable code execution from the user's home directory by tkinter when the -E flag is passed to Python.
Patch by Zachary Ware.

files:
  Lib/tkinter/__init__.py |  4 +++-
  Misc/NEWS               |  3 +++
  2 files changed, 6 insertions(+), 1 deletions(-)


diff --git a/Lib/tkinter/__init__.py b/Lib/tkinter/__init__.py
--- a/Lib/tkinter/__init__.py
+++ b/Lib/tkinter/__init__.py
@@ -1756,7 +1756,9 @@
         self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
         if useTk:
             self._loadtk()
-        self.readprofile(baseName, className)
+        if not sys.flags.ignore_environment:
+            # Issue #16248: Honor the -E flag to avoid code injection.
+            self.readprofile(baseName, className)
     def loadtk(self):
         if not self._tkloaded:
             self.tk.loadtk()
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -108,6 +108,9 @@
 Library
 -------
 
+- Issue #16248: Disable code execution from the user's home directory by
+  tkinter when the -E flag is passed to Python.  Patch by Zachary Ware.
+
 - Issue #16628: Fix a memory leak in ctypes.resize().
 
 - Issue #13614: Fix setup.py register failure with invalid rst in description.

-- 
Repository URL: http://hg.python.org/cpython