CVE-2013-4315: Directory traversal with ssi template tag

[Felix Dreissig]

"Django's template language includes two methods of including and rendering one template inside another:

The {% include %} tag takes a template name, and uses Django's template loading mechanism (which is restricted to the directories specified in the TEMPLATE_DIRS setting, as with any other normal template load in Django).
The {% ssi %} tag, which takes a file path and includes that file's contents (optionally parsing and rendering it as a template).

Since the ssi tag is not restricted to TEMPLATE_DIRS, it represents a security risk; the setting ALLOWED_INCLUDE_ROOTS thus is required, and specifies filesystem locations from which ssi may read files."

https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/

[Felix Dreissig (f30)]

This was fixed in one go with #1225784.