diff options
| author | Carlos de la Guardia <cguardia@yahoo.com> | 2011-06-06 12:03:46 -0500 |
|---|---|---|
| committer | Carlos de la Guardia <cguardia@yahoo.com> | 2011-06-06 12:03:46 -0500 |
| commit | a5713863a80a493a1485057609578b907d04c770 (patch) | |
| tree | e2230d20775d9fa80ea8dafa06910b65cb6859d5 /docs/whatsnew-1.1.rst | |
| parent | ffca4ef5eba01234433bc4d6029dee719ab261d0 (diff) | |
| parent | 703e3677dc42518cb80626650aaf62e7db17812a (diff) | |
| download | pyramid-a5713863a80a493a1485057609578b907d04c770.tar.gz pyramid-a5713863a80a493a1485057609578b907d04c770.tar.bz2 pyramid-a5713863a80a493a1485057609578b907d04c770.zip | |
Merge branch 'master' of github.com:Pylons/pyramid
Diffstat (limited to 'docs/whatsnew-1.1.rst')
| -rw-r--r-- | docs/whatsnew-1.1.rst | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/whatsnew-1.1.rst b/docs/whatsnew-1.1.rst index 992e0b637..ce2f7210a 100644 --- a/docs/whatsnew-1.1.rst +++ b/docs/whatsnew-1.1.rst @@ -53,6 +53,10 @@ Static Routes Minor Feature Additions ----------------------- +- New authentication policy: + :class:`pyramid.authentication.SessionAuthenticationPolicy`, which uses a + session to store credentials. + - Integers and longs passed as ``elements`` to :func:`pyramid.url.resource_url` or :meth:`pyramid.request.Request.resource_url` e.g. ``resource_url(context, @@ -90,6 +94,15 @@ Minor Feature Additions Deprecations and Behavior Differences ------------------------------------- +- The default Mako renderer is now configured to escape all HTML in + expression tags. This is intended to help prevent XSS attacks caused by + rendering unsanitized input from users. To revert this behavior in user's + templates, they need to filter the expression through the 'n' filter:: + + ${ myhtml | n }. + + See https://github.com/Pylons/pyramid/issues/193. + - Deprecated all assignments to ``request.response_*`` attributes (for example ``request.response_content_type = 'foo'`` is now deprecated). Assignments and mutations of assignable request attributes that were |