Skip to content

feat(confmanager): Added ZMS.input.exec.restrict #431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cmeier76 wants to merge 7 commits into
base: main
Choose a base branch
from
Open

feat(confmanager): Added ZMS.input.exec.restrict #431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e02b822
feat(confmanager): Added ZMS.keywords.prevent
cmeier76 Oct 14, 2025
bafe60e
refact(standard): Extracted check_prevented_keywords
cmeier76 Oct 14, 2025
f0cb433
refact(naming): Incorporated the review comments
cmeier76 Oct 14, 2025
0e77b4c
set default
drfho Oct 15, 2025
9a88a8c
removed default to force explicit manual setting
cmeier76 Oct 20, 2025
36d1acc
removed get_env as already done in main
cmeier76 Oct 20, 2025
5c6e945
Merge branch 'main' into avoid-conf-calls-in-dt-exec
drfho Feb 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion Products/zms/_confmanager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -545,6 +545,7 @@ def getConfPropertiesDefaults(self):
{'key':'ZMS.input.file.maxlength','title':'File.upload maxlength','desc':'ZMS can limit the maximum upload-file size to the given value (in Bytes).','datatype':'string'},
{'key':'ZMS.input.image.maxlength','title':'Image.upload maxlength','desc':'ZMS can limit the maximum upload-image size to the given value (in Bytes).','datatype':'string'},
{'key':'ZMS.log.root','title':'ZMS.log.root','desc':'Use ZMSLog at absolute root node instead of current portal master','datatype':'boolean'},
{'key':'ZMS.input.exec.restrict','title':'ZMS.input.exec.restrict','desc':'Prevent usage of these keywords on standard.dt_exec','datatype':'string','default':''},
{'key':'ZMSGraphic.superres','title':'Image superres-attribute','desc':'Super-resolution attribute for ZMS standard image-objects.','datatype':'boolean','default':0},
{'key':'ZCatalog.TextIndexType','title':'Search with TextIndex-type','desc':'Use specified TextIndex-type (default: ZCTextIndex)','datatype':'string','default':'ZCTextIndex'},
{'key':'ZMSIndexZCatalog.ObjectImported.reindex','title':'Reindex ZMSIndex on content import','desc':'Please be aware that activating implicit ZMSIndex-resync on content import can block bigger sites for a while','datatype':'boolean','default':0},
Expand Down Expand Up @@ -1183,4 +1184,5 @@ def getRegistry():
return __REGISTRY__
getRegistry()

################################################################################

################################################################################
14 changes: 14 additions & 0 deletions Products/zms/standard.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2329,10 +2329,13 @@ def dt_exec(context, v, o={}):
"""
if type(v) is str:
if v.startswith('##') and v.find('return ') > 0:
check_restricted_inputs(context, value=v)
v = dt_py(context, v, o)
elif v.find('<tal:') >= 0:
check_restricted_inputs(context, value=v)
v = dt_tal(context, v, dict(o))
elif v.find('<dtml-') >= 0:
check_restricted_inputs(context, value=v)
v = dt_html(context, v, context.REQUEST)
return v

Expand Down Expand Up @@ -2629,6 +2632,17 @@ def is_conf_enabled(context, setting):
return pybool(conf_property)


def check_restricted_inputs(context, value, force_restriction=False):
prop = context.getConfProperty('ZMS.input.exec.restrict')
if isinstance(prop, str) and prop.strip() != '':
for keyword in prop.split():
if keyword in value:
raise zExceptions.MethodNotAllowed(f'Usage of "{keyword}" is forbidden.')
else:
if force_restriction:
raise zExceptions.MethodNotAllowed(f'Conf property "ZMS.input.exec.restrict" not set.')


class initutil(object):
"""Define the initialize() util."""

Expand Down