Commit 84d7c93f authored by Aymeric Augustin's avatar Aymeric Augustin
Browse files

Raised an error when allowed_include_roots is a string. 

This avoids leaving projects silently vulnerable when this option is set
to a string instead of a one-item tuple containing that string, a very
common misconfiguration.
parent cf1f36bb

django/template/engine.py

+5 −1
Original line number Diff line number Diff line
@@ -36,7 +36,11 @@ class Engine(object): 
        else:

            if app_dirs:

                raise ImproperlyConfigured(

                    "APP_DIRS must not be set when LOADERS is defined.")

                    "app_dirs must not be set when loaders is defined.")



        if isinstance(allowed_include_roots, six.string_types):

            raise ImproperlyConfigured(

                "allowed_include_roots must be a tuple, not a string.")



        self.dirs = dirs

        self.app_dirs = app_dirs