diff --git a/tryton/common/common.py b/tryton/common/common.py index d34ccb634a..8ca80e3219 100644 --- a/tryton/common/common.py +++ b/tryton/common/common.py @@ -1463,60 +1463,6 @@ def filter_domain(domain): res.extend(filter_domain(arg)) return res -_ALLOWED_CODES = set(dis.opmap[x] for x in [ - 'POP_TOP', 'ROT_TWO', 'ROT_THREE', 'ROT_FOUR', 'DUP_TOP', 'BUILD_LIST', - 'BUILD_MAP', 'BUILD_TUPLE', 'LOAD_CONST', 'RETURN_VALUE', - 'STORE_SUBSCR', 'UNARY_POSITIVE', 'UNARY_NEGATIVE', 'UNARY_NOT', - 'UNARY_INVERT', 'BINARY_POWER', 'BINARY_MULTIPLY', 'BINARY_DIVIDE', - 'BINARY_FLOOR_DIVIDE', 'BINARY_TRUE_DIVIDE', 'BINARY_MODULO', - 'BINARY_ADD', 'BINARY_SUBTRACT', 'BINARY_LSHIFT', 'BINARY_RSHIFT', - 'BINARY_AND', 'BINARY_XOR', 'BINARY_OR', 'STORE_MAP', 'LOAD_NAME', - 'CALL_FUNCTION', 'COMPARE_OP', 'LOAD_ATTR', 'STORE_NAME', 'GET_ITER', - 'FOR_ITER', 'LIST_APPEND', 'JUMP_ABSOLUTE', 'DELETE_NAME', - 'JUMP_IF_TRUE', 'JUMP_IF_FALSE', 'JUMP_IF_FALSE_OR_POP', - 'JUMP_IF_TRUE_OR_POP', 'POP_JUMP_IF_FALSE', 'POP_JUMP_IF_TRUE', - 'BINARY_SUBSCR', - ] if x in dis.opmap) - -_SAFE_EVAL_CACHE = {} - - -def safe_eval(source, data=None): - if '__subclasses__' in source: - raise ValueError('__subclasses__ not allowed') - if hashlib: - key = hashlib.md5(source).digest() - else: - key = md5.new(source).digest() - c = _SAFE_EVAL_CACHE.get(key) - if not c: - c = compile(source, '', 'eval') - codes = [] - s = c.co_code - i = 0 - while i < len(s): - code = ord(s[i]) - codes.append(code) - if code >= dis.HAVE_ARGUMENT: - i += 3 - else: - i += 1 - for code in codes: - if code not in _ALLOWED_CODES: - raise ValueError('opcode %s not allowed' % dis.opname[code]) - if len(_SAFE_EVAL_CACHE) > 1024: - _SAFE_EVAL_CACHE.clear() - _SAFE_EVAL_CACHE[key] = c - return eval(c, {'__builtins__': { - 'True': True, - 'False': False, - 'str': str, - 'globals': locals, - 'locals': locals, - 'bool': bool, - 'dict': dict, - }}, data) - def timezoned_date(date, reverse=False): if pytz and rpc.CONTEXT.get('timezone') and rpc.TIMEZONE: diff --git a/tryton/gui/window/view_form/view/graph_gtk/line.py b/tryton/gui/window/view_form/view/graph_gtk/line.py index cb54dba5f0..6dcaae6778 100644 --- a/tryton/gui/window/view_form/view/graph_gtk/line.py +++ b/tryton/gui/window/view_form/view/graph_gtk/line.py @@ -3,7 +3,7 @@ #This code is inspired by the pycha project #(http://www.lorenzogil.com/projects/pycha/) from graph import Graph -from tryton.common import hex2rgb, float_time_to_text, safe_eval +from tryton.common import hex2rgb, float_time_to_text import locale import math import cairo @@ -34,7 +34,7 @@ class Line(Graph): if self.xrange == 0: x = 1.0 - if (not bool(safe_eval(yfield2attrs[yfield].get('empty', '1'))) + if (not bool(int(yfield2attrs[yfield].get('empty', 1))) and yval == 0): continue @@ -50,7 +50,7 @@ class Line(Graph): key2interpolation = {} for yfield in self.yfields: key = yfield.get('key', yfield['name']) - key2fill[key] = bool(safe_eval(yfield.get('fill', '0'))) + key2fill[key] = bool(int(yfield.get('fill', 0))) key2interpolation[key] = yfield.get('interpolation', 'linear') def preparePath(key): diff --git a/tryton/gui/window/view_form/view/graph_gtk/pie.py b/tryton/gui/window/view_form/view/graph_gtk/pie.py index 0ba4287c2d..6db0f80a00 100644 --- a/tryton/gui/window/view_form/view/graph_gtk/pie.py +++ b/tryton/gui/window/view_form/view/graph_gtk/pie.py @@ -5,7 +5,7 @@ from graph import Graph, Area import math import cairo -from tryton.common import hex2rgb, float_time_to_text, safe_eval +from tryton.common import hex2rgb, float_time_to_text import locale import tryton.rpc as rpc @@ -91,7 +91,7 @@ class Pie(Graph): cr.save() for slice in self.slices: if slice.isBigEnough(): - if bool(safe_eval(self.yfields[0].get('fill', '1'))): + if bool(int(self.yfields[0].get('fill', 1))): color = self.colorScheme[slice.xname] if slice.highlight: color = self.colorScheme['__highlight']