[FIX] continuing implementation of safe_eval: fixed some evaluation contexts

bzr revid: odo@openerp.com-20100601082829-n6iqqm8f0wuscvtm

1 files changed, 11 insertions, 2 deletions

diff --git a/bin/tools/safe_eval.py b/bin/tools/safe_eval.py
index f1a2ca1b5e7..0fcc7a20eb9 100644
--- a/bin/tools/safe_eval.py
+++ b/bin/tools/safe_eval.py
@@ -193,8 +193,8 @@ except ImportError:
 
 
 
-def safe_eval(expr, globals_dict=None, locals_dict=None, mode="eval"):
-    """safe_eval(expression[, globals[, locals[, mode]]]) -> value
+def safe_eval(expr, globals_dict=None, locals_dict=None, mode="eval", nocopy=False):
+    """safe_eval(expression[, globals[, locals[, mode[, nocopy]]]]) -> result
 
     System-restricted Python expression evaluation
 
@@ -216,6 +216,14 @@ def safe_eval(expr, globals_dict=None, locals_dict=None, mode="eval"):
 
     if globals_dict is None:
         globals_dict = {}
+
+    # prevent altering the globals/locals from within the sandbox
+    # by taking a copy.
+    if not nocopy:
+        globals_dict = dict(globals_dict)
+        if locals_dict is not None:
+            locals_dict = dict(locals_dict)
+
     globals_dict.update(
             __builtins__ = {
                 'True': True,
@@ -230,6 +238,7 @@ def safe_eval(expr, globals_dict=None, locals_dict=None, mode="eval"):
                 'tuple': tuple,
             }
     )
+
     return eval(test_expr(expr,_SAFE_OPCODES, mode=mode), globals_dict, locals_dict)