From 3bbe82491853f5eb8f94858d73d8e0cb2a0603c4 Mon Sep 17 00:00:00 2001 From: Chris McDonough Date: Thu, 8 Sep 2011 03:08:26 -0400 Subject: privatize --- pyramid/static.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pyramid/static.py b/pyramid/static.py index 72a76a014..63c7dea73 100644 --- a/pyramid/static.py +++ b/pyramid/static.py @@ -167,21 +167,21 @@ class static_view(object): url = url + '?' + qs return HTTPMovedPermanently(url) -has_insecure_pathelement = set(['..', '.', '']).intersection -seps = set(['/', os.sep]) -def contains_slash(item): - for sep in seps: +_has_insecure_pathelement = set(['..', '.', '']).intersection +_seps = set(['/', os.sep]) +def _contains_slash(item): + for sep in _seps: if sep in item: return True @lru_cache(1000) def _secure_path(path_tuple): - if has_insecure_pathelement(path_tuple): + if _has_insecure_pathelement(path_tuple): # belt-and-suspenders security; this should never be true # unless someone screws up the traversal_path code # (request.subpath is computed via traversal_path too) return None - if any([contains_slash(item) for item in path_tuple]): + if any([_contains_slash(item) for item in path_tuple]): return None encoded = u'/'.join(path_tuple) # will be unicode return encoded -- cgit v1.2.3