diff options
| author | Chris McDonough <chrism@plope.com> | 2013-06-05 06:04:45 -0400 |
|---|---|---|
| committer | Chris McDonough <chrism@plope.com> | 2013-06-05 06:04:45 -0400 |
| commit | fab8454294b6271c727a0251c78b5f55df5788bf (patch) | |
| tree | a4e095937aff27abea18ea524724f4129027edd1 /CHANGES.txt | |
| parent | 3070c46702ca0e59acfbe27b7f52637e9a471875 (diff) | |
| download | pyramid-fab8454294b6271c727a0251c78b5f55df5788bf.tar.gz pyramid-fab8454294b6271c727a0251c78b5f55df5788bf.tar.bz2 pyramid-fab8454294b6271c727a0251c78b5f55df5788bf.zip | |
add changelog note
Diffstat (limited to 'CHANGES.txt')
| -rw-r--r-- | CHANGES.txt | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/CHANGES.txt b/CHANGES.txt index a471addce..6a26879a3 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -29,6 +29,11 @@ Features ``initialize_myapp_db etc/development.ini a=1 b=2``. See https://github.com/Pylons/pyramid/pull/911 +- The ``request.session.check_csrf_token()`` method and the ``check_csrf`` view + predicate now take into account the value of the HTTP header named + ``X-CSRF-Token`` (as well as the ``csrf_token`` form parameter, which they + always did). The header is tried when the form parameter does not exist. + Bug Fixes --------- |