← Back to branch summary

~ubuntu-branches/ubuntu/saucy/python-django/saucy-updates

« back to all changes in this revision

Viewing changes to .pc/CVE-2014-0472-regression.patch/tests/regressiontests/urlpatterns_reverse/urls.py

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2014-04-22 23:12:52 UTC
  • Revision ID: package-import@ubuntu.com-20140422231252-8cu8s89mk8mik8ac
Tags: 1.5.4-1ubuntu1.2
https://launchpad.net/bugs/1311433
* SECURITY REGRESSION: security fix regression when a view is a partial
  (LP: #1311433)
  - debian/patches/CVE-2014-0472-regression.patch: create the lookup_str
    from the original function whenever a partial is provided as an
    argument to a url pattern in django/core/urlresolvers.py,
    added tests to tests/regressiontests/urlpatterns_reverse/urls.py,
    tests/regressiontests/urlpatterns_reverse/views.py.
  - CVE-2014-0472

Show diffs side-by-side

added added

removed removed

Lines of Context:
.pc/CVE-2014-0472-regression.patch/tests/regressiontests/urlpatterns_reverse/urls.py
 
1
from __future__ import absolute_import
 
2
 
 
3
from django.conf.urls import patterns, url, include
 
4
 
 
5
from .views import empty_view, absolute_kwargs_view
 
6
 
 
7
 
 
8
other_patterns = patterns('',
 
9
    url(r'non_path_include/$', empty_view, name='non_path_include'),
 
10
    url(r'nested_path/$', 'regressiontests.urlpatterns_reverse.views.nested_view'),
 
11
)
 
12
 
 
13
urlpatterns = patterns('',
 
14
    url(r'^places/(\d+)/$', empty_view, name='places'),
 
15
    url(r'^places?/$', empty_view, name="places?"),
 
16
    url(r'^places+/$', empty_view, name="places+"),
 
17
    url(r'^places*/$', empty_view, name="places*"),
 
18
    url(r'^(?:places/)?$', empty_view, name="places2?"),
 
19
    url(r'^(?:places/)+$', empty_view, name="places2+"),
 
20
    url(r'^(?:places/)*$', empty_view, name="places2*"),
 
21
    url(r'^places/(\d+|[a-z_]+)/', empty_view, name="places3"),
 
22
    url(r'^places/(?P<id>\d+)/$', empty_view, name="places4"),
 
23
    url(r'^people/(?P<name>\w+)/$', empty_view, name="people"),
 
24
    url(r'^people/(?:name/)', empty_view, name="people2"),
 
25
    url(r'^people/(?:name/(\w+)/)?', empty_view, name="people2a"),
 
26
    url(r'^people/(?P<name>\w+)-(?P=name)/$', empty_view, name="people_backref"),
 
27
    url(r'^optional/(?P<name>.*)/(?:.+/)?', empty_view, name="optional"),
 
28
    url(r'^hardcoded/$', empty_view, name="hardcoded"),
 
29
    url(r'^hardcoded/doc\.pdf$', empty_view, name="hardcoded2"),
 
30
    url(r'^people/(?P<state>\w\w)/(?P<name>\w+)/$', empty_view, name="people3"),
 
31
    url(r'^people/(?P<state>\w\w)/(?P<name>\d)/$', empty_view, name="people4"),
 
32
    url(r'^people/((?P<state>\w\w)/test)?/(\w+)/$', empty_view, name="people6"),
 
33
    url(r'^character_set/[abcdef0-9]/$', empty_view, name="range"),
 
34
    url(r'^character_set/[\w]/$', empty_view, name="range2"),
 
35
    url(r'^price/\$(\d+)/$', empty_view, name="price"),
 
36
    url(r'^price/[$](\d+)/$', empty_view, name="price2"),
 
37
    url(r'^price/[\$](\d+)/$', empty_view, name="price3"),
 
38
    url(r'^product/(?P<product>\w+)\+\(\$(?P<price>\d+(\.\d+)?)\)/$',
 
39
            empty_view, name="product"),
 
40
    url(r'^headlines/(?P<year>\d+)\.(?P<month>\d+)\.(?P<day>\d+)/$', empty_view,
 
41
            name="headlines"),
 
42
    url(r'^windows_path/(?P<drive_name>[A-Z]):\\(?P<path>.+)/$', empty_view,
 
43
            name="windows"),
 
44
    url(r'^special_chars/(.+)/$', empty_view, name="special"),
 
45
    url(r'^(?P<name>.+)/\d+/$', empty_view, name="mixed"),
 
46
    url(r'^repeats/a{1,2}/$', empty_view, name="repeats"),
 
47
    url(r'^repeats/a{2,4}/$', empty_view, name="repeats2"),
 
48
    url(r'^repeats/a{2}/$', empty_view, name="repeats3"),
 
49
    url(r'^(?i)CaseInsensitive/(\w+)', empty_view, name="insensitive"),
 
50
    url(r'^test/1/?', empty_view, name="test"),
 
51
    url(r'^(?i)test/2/?$', empty_view, name="test2"),
 
52
    url(r'^outer/(?P<outer>\d+)/',
 
53
            include('regressiontests.urlpatterns_reverse.included_urls')),
 
54
    url('', include('regressiontests.urlpatterns_reverse.extra_urls')),
 
55
 
 
56
    # This is non-reversible, but we shouldn't blow up when parsing it.
 
57
    url(r'^(?:foo|bar)(\w+)/$', empty_view, name="disjunction"),
 
58
 
 
59
    # Regression views for #9038. See tests for more details
 
60
    url(r'arg_view/$', 'kwargs_view'),
 
61
    url(r'arg_view/(?P<arg1>\d+)/$', 'kwargs_view'),
 
62
    url(r'absolute_arg_view/(?P<arg1>\d+)/$', absolute_kwargs_view),
 
63
    url(r'absolute_arg_view/$', absolute_kwargs_view),
 
64
 
 
65
    # Tests for #13154. Mixed syntax to test both ways of defining URLs.
 
66
    url(r'defaults_view1/(?P<arg1>\d+)/', 'defaults_view', {'arg2': 1}, name='defaults'),
 
67
    (r'defaults_view2/(?P<arg1>\d+)/', 'defaults_view', {'arg2': 2}, 'defaults'),
 
68
 
 
69
    url('^includes/', include(other_patterns)),
 
70
)