Ticket #9579: safe_join_base_path_correction.patch

django/utils/_os.py

@@ -1 @@
-from os.path import join, normcase, abspath, sep
+from os.path import join, normcase, abspath, sep, curdir
 from django.utils.encoding import force_unicode
 
 def safe_join(base, *paths):
@@ -13 +13 @@
     # insensitive operating systems (like Windows).
     base = force_unicode(base)
     paths = [force_unicode(p) for p in paths]
-    final_path = normcase(abspath(join(base, *paths)))
-    base_path = normcase(abspath(base))
+    abs_path = force_unicode(abspath(curdir))
+    final_path = normcase(join(abs_path, join(base, *paths)))
+    base_path = normcase(join(abs_path, base))
     base_path_len = len(base_path)
     # Ensure final_path starts with base_path and that the next character after
     # the final path is os.sep (or nothing, in which case final_path must be