Merge commit from fork

- Change one renderer from jinja to django
- Move the other to a sandboxed environment

src/backend/InvenTree/common/setting/system.py

@@ -11,7 +11,7 @@ from django.core.exceptions import FieldDoesNotExist, ValidationError
 from django.core.validators import MaxValueValidator, MinValueValidator, URLValidator
 from django.utils.translation import gettext_lazy as _
 
-from jinja2 import Template
+from jinja2.sandbox import SandboxedEnvironment
 
 import build.validators
 import common.currency
@@ -52,7 +52,7 @@ def validate_part_name_format(value):
     p = Part(name='test part', description='some test part')
 
     try:
-        Template(value).render({'part': p})
+        SandboxedEnvironment().from_string(value).render({'part': p})
     except Exception as exc:
         raise ValidationError({'value': str(exc)})
 

src/backend/InvenTree/stock/generators.py

@@ -4,8 +4,7 @@ from inspect import signature
 from typing import Optional
 
 from django.core.exceptions import ValidationError
-
-from jinja2 import Template
+from django.template import Context, Template
 
 import common.models
 import InvenTree.exceptions
@@ -76,7 +75,7 @@ def generate_batch_code(**kwargs):
         'STOCK_BATCH_CODE_TEMPLATE', ''
     )
 
-    return Template(batch_template).render(context)
+    return Template(batch_template).render(Context(context))
 
 
 def generate_serial_number(part=None, quantity=1, **kwargs) -> Optional[str]: