changeset:   82288:936621d33c38
branch:      2.6
parent:      79994:4a17784f2fee
user:        Barry Warsaw <barry@python.org>
date:        Wed Feb 20 18:19:55 2013 -0500
files:       Lib/lib-tk/Tkinter.py Misc/NEWS
description:
- Issue #16248: Disable code execution from the user's home directory by
  tkinter when the -E flag is passed to Python.  Patch by Zachary Ware.


diff -r 4a17784f2fee -r 936621d33c38 Lib/lib-tk/Tkinter.py
--- a/Lib/lib-tk/Tkinter.py	Sun Oct 28 08:04:38 2012 +0100
+++ b/Lib/lib-tk/Tkinter.py	Wed Feb 20 18:19:55 2013 -0500
@@ -1643,7 +1643,9 @@
         self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
         if useTk:
             self._loadtk()
-        self.readprofile(baseName, className)
+        if not sys.flags.ignore_environment:
+            # Issue #16248: Honor the -E flag to avoid code injection.
+            self.readprofile(baseName, className)
     def loadtk(self):
         if not self._tkloaded:
             self.tk.loadtk()
diff -r 4a17784f2fee -r 936621d33c38 Misc/NEWS
--- a/Misc/NEWS	Sun Oct 28 08:04:38 2012 +0100
+++ b/Misc/NEWS	Wed Feb 20 18:19:55 2013 -0500
@@ -13,6 +13,9 @@
 Library
 -------
 
+- Issue #16248: Disable code execution from the user's home directory by
+  tkinter when the -E flag is passed to Python.  Patch by Zachary Ware.
+
 
 What's New in Python 2.6.8?
 ===========================