Products.CMFCore.DynamicType.icon buggy reliance on length of portal_url

Bug #1202879 reported by Darryl Dixon
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Zope CMF buildout
New
Undecided
Unassigned

Bug Description

This commit:
http://svn.zope.org/Products.CMFCore/trunk/Products/CMFCore/DynamicType.py?rev=105763&r1=105607&r2=105763

Introduced an implicit assumption about the length of portal_url which is not necessarily always true - it assumes both that it is non-zero length and that it does not include "/" at the end of itself. This line is the problematic one:
icon = icon[len(portal_url)+1:]

In order to make this line safe, the code just needs to by slightly more defensive; it needs:
a) to test for non-zero portal_url, and
b) to test that portal_url does *not* end with "/"

Otherwise, this method may return values like:
"ocument_icon.png"

Revision history for this message
Darryl Dixon (esrever-otua) wrote :

An example of a working version of the affected function would be:

def icon(self, relative_to_portal=0):
    """
    Using this method allows the content class
    creator to grab icons on the fly instead of using a fixed
    attribute on the class.
    """
    utool = getToolByName(self, 'portal_url')
    portal_url = utool()
    icon = self.getIconURL()
    if portal_url:
        if icon.startswith(portal_url):
            icon = icon[len(portal_url):]
            while icon.startswith('/'):
                icon = icon[1:]
            if not relative_to_portal:
                # Relative to REQUEST['BASEPATH1']
                icon = '%s/%s' % (utool(relative=1), icon)
    return icon

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.