diff options
| author | Carlos de la Guardia <cguardia@yahoo.com> | 2011-06-06 12:03:46 -0500 |
|---|---|---|
| committer | Carlos de la Guardia <cguardia@yahoo.com> | 2011-06-06 12:03:46 -0500 |
| commit | a5713863a80a493a1485057609578b907d04c770 (patch) | |
| tree | e2230d20775d9fa80ea8dafa06910b65cb6859d5 /CHANGES.txt | |
| parent | ffca4ef5eba01234433bc4d6029dee719ab261d0 (diff) | |
| parent | 703e3677dc42518cb80626650aaf62e7db17812a (diff) | |
| download | pyramid-a5713863a80a493a1485057609578b907d04c770.tar.gz pyramid-a5713863a80a493a1485057609578b907d04c770.tar.bz2 pyramid-a5713863a80a493a1485057609578b907d04c770.zip | |
Merge branch 'master' of github.com:Pylons/pyramid
Diffstat (limited to 'CHANGES.txt')
| -rw-r--r-- | CHANGES.txt | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/CHANGES.txt b/CHANGES.txt index 0992af9ef..9dd1af2c5 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -37,9 +37,15 @@ Documentation - Added "What's New in Pyramid 1.1" to HTML rendering of documentation. +- Added API docs for ``pyramid.authentication.SessionAuthenticationPolicy``. + Features -------- +- New authentication policy: + ``pyramid.authentication.SessionAuthenticationPolicy``, which uses a session + to store credentials. + - Accessing the ``response`` attribute of a ``pyramid.request.Request`` object (e.g. ``request.response`` within a view) now produces a new ``pyramid.response.Response`` object. This feature is meant to be used @@ -230,6 +236,13 @@ Deprecations Behavior Changes ---------------- +- The default Mako renderer is now configured to escape all HTML in + expression tags. This is intended to help prevent XSS attacks caused by + rendering unsanitized input from users. To revert this behavior in user's + templates, they need to filter the expression through the 'n' filter. + For example, ${ myhtml | n }. + See https://github.com/Pylons/pyramid/issues/193. + - A custom request factory is now required to return a response object that has a ``response`` attribute (or "reified"/lazy property) if they the request is meant to be used in a view that uses a renderer. This |