| Age | Commit message (Collapse) | Author |
|
|
|
- Renamed `SessionCSRFStoragePolicy` to `LegacySessionCSRFStoragePolicy` for
the version that uses the legacy `ISession.get_csrf_token` and
`ISession.new_csrf_token` apis and set that as the default.
- Added new `SessionCSRFStoragePolicy` that stores data in the session
similar to how the `SessionAuthenticationPolicy` works.
- `CookieCSRFStoragePolicy` did not properly return the newly generated
token from `get_csrf_token` after calling `new_csrf_token`. It needed
to cache the new value since the response callback does not affect
the current request.
- `CookieCSRFStoragePolicy` was not forwarding the `domain` value to the
`CookieProfile` causing that setting to be ignored.
- Removed `check_csrf_token` from the `ICSRFStoragePolicy` interface
to simplify implementations of storage policies.
- Added an introspectable item for the configured storage policy so that
it appears on the debugtoolbar.
- Added a change note on `ISession` that it no longer required the csrf methods.
- Leave deprecated shims in ``pyramid.session`` for
``check_csrf_origin`` and ``check_csrf_token``.
|
|
- https://github.com/Pylons/pyramid-cookiecutter-starter/pull/28
- https://github.com/Pylons/pyramid-cookiecutter-zodb/pull/7
- https://github.com/Pylons/pyramid-cookiecutter-alchemy/pull/8
|
|
|
|
tests given previous improvements to CSRF.
|
|
|
|
- refs: https://github.com/Pylons/pyramid-cookiecutter-starter/pull/27#issuecomment-296507821
|
|
change cgi.escape to pyramid compat.escape
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
implemenations based on feedback, split CSRF implementation and option configuration and make the csrf token function exposed as a system default rather than a renderer event.
|
|
|
|
regarding naming of variables and code cleanup.
|
|
the session machinery.
Adds configuration of this to the csrf_options configurator commands. Make the default implementation a fallback to the old one. Documentation patches for new best practices given updates CSRF implementation.
|
|
|
|
As suggested by https://docs.python.org/3.6/library/cgi.html
cgi.escape()
Deprecated since version 3.2: This function is unsafe because quote is false by default, and therefore deprecated. Use html.escape() instead.
|
|
|
|
|
|
|
|
(cherry picked from commit 40dd034)
Refs: https://github.com/Pylons/pyramid-cookiecutter-starter/pull/22
|
|
update pyramid-cookiecutter-starter prompts and reformat presentation…
|
|
cookiecutter prompts
|
|
|
|
|
|
- See https://github.com/Pylons/pyramid/issues/2897#issuecomment-277494816
- Closes #2897
|
|
- closes #2944
|
|
|
|
|
|
"functions, classes or any callable that accept" was messing with the flow while reading. Proposed change flows a little better for me.
(cherry picked from commit 87d8aba)
|
|
distinguish between Pyramid itself and view code raising the exception as in previous exception listing.
(cherry picked from commit eb166fb)
|
|
minor change to flow better
(cherry picked from commit 0c705c9)
|
|
- ref: #2919
|
|
|
|
|
|
|
|
|
|
(cherry picked from commit 981869a)
|
|
|
|
- Closes #2904
|
|
|
|
|
|
|
|
closes #2890
|
|
|
|
- Installation overhauled
- update project.rst to remove duplication
- Windows paths never end with "\" except for a drive name, for example C:\
- use backslashes for paths
- backslashes cannot be used for line continuation on Windows
- update extra packages for Windows
- Python now has a Windows launcher
|