#27722: if a template context is an instance of get_template(), it will raise
"TypeError: context must be a dict rather than RequestContext"
---------------------------------+------------------------------------
Reporter: Sayid Munawar | Owner: nobody
Type: Bug | Status: new
Component: Template system | Version: 1.11
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by Aymeric Augustin):
Replying to [comment:12 Tim Graham]:
> A use case for calling `{% include %}` with a compiled template is
described in #17356. The use case was for `{% include %}` with a
`django.template.base.Template`, however, it had the side effect of also
allowing `django.template.backends.django.Template` since the check is if
the `template` argument
[https://github.com/django/django/blob/d1bab24e0144d14513a1411503c95ececb425188/django/template/loader_tags.py#L174-L175
has a render() method].
Perhaps `{% include %}` could unwrap the `django.template.base.Template`
from the `django.template.backends.django.Template` when this happens,
after checking that both templates were loaded with the same engine? If
you load them with different engines, you may get hilarious results,
especially if you find XSS vulnerabilities funny and one engine has
autoescape turned off.
Alternatively it could reject `django.template.base.Template` instances,
but that would only result in another ticket asking to support it.
> In ticket:27258#comment:6 you said,
"`template.backends.django.Template.render` mustn't be called with a
`RequestContext` (I feel strongly about that one)." but that's what
happening in the latter case (apparently without any ill effects?).
You could say that mostly me being obsessed with technical correctness and
never having really come to terms with duck-typing and you wouldn't be
totally wrong but not totally true either.
The underlying motivation was to discourage confusion between:
- `template.backends.django.Template` which is the backend-agnostic,
compatible API that expects a `dict` and optionally a request
- `django.template.base.Template` which is the Django-templates-only API
that expects a `Context` or `RequestContext`
The root cause of the bug we're discussing here is one type being used
where the other is expected. So that motivation isn't without merit.
--
Ticket URL: <https://code.djangoproject.com/ticket/27722#comment:13>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.8ac0fb22e6dc0f99e0a1691fa1116dee%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
