From: Steve Dower <steve.dower@python.org>
Date: Tue, 19 Aug 2025 20:28:28 +0000 (+0100)
Subject: gh-120037: Disable user site packages when a ._pth file is used (GH-137428)
X-Git-Tag: v3.15.0a1~638
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7d06a0af1720e1962b324d8abf5865121ca492bc;p=thirdparty%2FPython%2Fcpython.git

gh-120037: Disable user site packages when a ._pth file is used (GH-137428)
---

diff --git a/Doc/c-api/init_config.rst b/Doc/c-api/init_config.rst
index 24be9ead3874..4f0199838e15 100644
--- a/Doc/c-api/init_config.rst
+++ b/Doc/c-api/init_config.rst
@@ -2258,6 +2258,7 @@ If a ``._pth`` file is present:
 * Set :c:member:`~PyConfig.isolated` to ``1``.
 * Set :c:member:`~PyConfig.use_environment` to ``0``.
 * Set :c:member:`~PyConfig.site_import` to ``0``.
+* Set :c:member:`~PyConfig.user_site_directory` to ``0`` (since 3.15).
 * Set :c:member:`~PyConfig.safe_path` to ``1``.
 
 If :c:member:`~PyConfig.home` is not set and a ``pyvenv.cfg`` file is present in
@@ -2278,6 +2279,12 @@ The ``__PYVENV_LAUNCHER__`` environment variable is used to set
    therefore affected by :option:`-S`.
 
 
+.. versionchanged:: 3.15
+
+   :c:member:`~PyConfig.user_site_directory` is now set to ``0`` when a
+   ``._pth`` file is present.
+
+
 Py_GetArgcArgv()
 ================
 
diff --git a/Lib/test/test_site.py b/Lib/test/test_site.py
index 39c451fbbbba..32fcf3162e8e 100644
--- a/Lib/test/test_site.py
+++ b/Lib/test/test_site.py
@@ -804,6 +804,15 @@ class _pthFileTests(unittest.TestCase):
             )], env=env)
         self.assertTrue(rc, "sys.path is incorrect")
 
+    @support.requires_subprocess()
+    def test_underpth_no_user_site(self):
+        pth_lines = [test.support.STDLIB_DIR, 'import site']
+        exe_file = self._create_underpth_exe(pth_lines)
+        p = subprocess.run([exe_file, '-X', 'utf8', '-c',
+                            'import sys; '
+                            'sys.exit(not sys.flags.no_user_site)'])
+        self.assertEqual(p.returncode, 0, "sys.flags.no_user_site was 0")
+
 
 class CommandLineTests(unittest.TestCase):
     def exists(self, path):
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-08-05-20-24-12.gh-issue-120037.MB7MmI.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-08-05-20-24-12.gh-issue-120037.MB7MmI.rst
new file mode 100644
index 000000000000..15b8b8f3648a
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-08-05-20-24-12.gh-issue-120037.MB7MmI.rst
@@ -0,0 +1,2 @@
+Disable user site packages directory when a ``._pth`` file is used, even if
+it contains ``import site``.
diff --git a/Modules/getpath.py b/Modules/getpath.py
index b89d7427e3fe..ceb605a75c85 100644
--- a/Modules/getpath.py
+++ b/Modules/getpath.py
@@ -790,6 +790,7 @@ if pth:
     config['isolated'] = 1
     config['use_environment'] = 0
     config['site_import'] = 0
+    config['user_site_directory'] = 0
     config['safe_path'] = 1
     pythonpath = []
     for line in pth: