#32223: Path.resolve(strict=True) can raise a PermissionError in autoreloader.
-------------------------------------+-------------------------------------
Reporter: Mariusz Felisiak | Owner: Mariusz
| Felisiak
Type: Bug | Status: assigned
Component: Core (Management | Version: 3.1
commands) |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Nick Pope):
I think we need more clarity on what is going on here. The report in the
other ticket says:
> Just to explain a little, this configuration is pretty common in shared-
system environments - it is intentional and prevents users from
enumerating local users on the system and accessing their home directories
in case of miss-configured permissions.
But to see `PermissionError` like this it implies that `/usr` is not
executable which ought to mean it cannot be traversed in which case there
are surely larger problems? Also `/usr/home/…` is highly irregular.
Is this using `ugidfw` again? If it breaks the expectations around how as
permissions work, or is configured incorrectly, then something needs
fixing elsewhere, not in Django. I noticed this too:
https://bugs.python.org/issue41593
I also see that we're using the undocumented `pathlib.Path.absolute()`
which is not recommended and may even go away.
`pathlib.Path.resolve(strict=True) is the documented and recommended way
to do this.
--
Ticket URL: <https://code.djangoproject.com/ticket/32223#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.0739ba54376d3e43bdf76af28b7daa7a%40djangoproject.com.
