From: Antoine Pitrou <solipsis@pitrou.net>
Date: Sun, 9 Dec 2012 13:46:18 +0000 (+0100)
Subject: Issue #16248: Disable code execution from the user's home directory by tkinter when... 
X-Git-Tag: v2.7.4rc1~316
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7dddec4e9d8aa01f9c25d7824f67510eab931855;p=thirdparty%2FPython%2Fcpython.git

Issue #16248: Disable code execution from the user's home directory by tkinter when the -E flag is passed to Python.
Patch by Zachary Ware.
---

diff --git a/Lib/lib-tk/Tkinter.py b/Lib/lib-tk/Tkinter.py
index 795cc453fff7..cec31fd9ab12 100644
--- a/Lib/lib-tk/Tkinter.py
+++ b/Lib/lib-tk/Tkinter.py
@@ -1709,7 +1709,9 @@ class Tk(Misc, Wm):
         self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
         if useTk:
             self._loadtk()
-        self.readprofile(baseName, className)
+        if not sys.flags.ignore_environment:
+            # Issue #16248: Honor the -E flag to avoid code injection.
+            self.readprofile(baseName, className)
     def loadtk(self):
         if not self._tkloaded:
             self.tk.loadtk()
diff --git a/Misc/NEWS b/Misc/NEWS
index ecf0aa32c35a..0db76a962ab7 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -160,6 +160,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #16248: Disable code execution from the user's home directory by
+  tkinter when the -E flag is passed to Python.  Patch by Zachary Ware.
+
 - Issue #16628: Fix a memory leak in ctypes.resize().
 
 - Issue #13614: Fix setup.py register failure with invalid rst in description.