diff options
| author | Chris McDonough <chrism@plope.com> | 2011-05-27 22:52:26 -0400 |
|---|---|---|
| committer | Chris McDonough <chrism@plope.com> | 2011-05-27 22:52:26 -0400 |
| commit | b90b9e03bb3ce56197c9fe8ed6c414853979805e (patch) | |
| tree | 4676e50cae7ce60967fc60a982510cc969b7a1f0 /docs | |
| parent | 2c65826a9d03282f7192ddee80f09a86d1033d98 (diff) | |
| parent | d0f62591ceb2f6ba6efe98ccf75703e7baee687e (diff) | |
| download | pyramid-b90b9e03bb3ce56197c9fe8ed6c414853979805e.tar.gz pyramid-b90b9e03bb3ce56197c9fe8ed6c414853979805e.tar.bz2 pyramid-b90b9e03bb3ce56197c9fe8ed6c414853979805e.zip | |
Merge branch 'master' of github.com:Pylons/pyramid
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/narr/project.rst | 2 | ||||
| -rw-r--r-- | docs/whatsnew-1.1.rst | 9 |
2 files changed, 10 insertions, 1 deletions
diff --git a/docs/narr/project.rst b/docs/narr/project.rst index c1558266a..e60708b6d 100644 --- a/docs/narr/project.rst +++ b/docs/narr/project.rst @@ -628,7 +628,7 @@ implementations. ``production.ini`` ~~~~~~~~~~~~~~~~~~~ -The ``development.ini`` file is a :term:`PasteDeploy` configuration file with +The ``production.ini`` file is a :term:`PasteDeploy` configuration file with a purpose much like that of ``development.ini``. However, it disables the WebError interactive debugger, replacing it with a logger which outputs exception messages to ``stderr`` by default. It also turns off template diff --git a/docs/whatsnew-1.1.rst b/docs/whatsnew-1.1.rst index ea56e2020..761fa8d3a 100644 --- a/docs/whatsnew-1.1.rst +++ b/docs/whatsnew-1.1.rst @@ -94,6 +94,15 @@ Minor Feature Additions Deprecations and Behavior Differences ------------------------------------- +- The default Mako renderer is now configured to escape all HTML in + expression tags. This is intended to help prevent XSS attacks caused by + rendering unsanitized input from users. To revert this behavior in user's + templates, they need to filter the expression through the 'n' filter:: + + ${ myhtml | n }. + + See https://github.com/Pylons/pyramid/issues/193. + - Deprecated all assignments to ``request.response_*`` attributes (for example ``request.response_content_type = 'foo'`` is now deprecated). Assignments and mutations of assignable request attributes that were |