From 18b25a643bb7fe4c8dc1f832470c1cf2ff513a9e Mon Sep 17 00:00:00 2001
From: Michael Merickel <michael@merickel.org>
Date: Fri, 27 May 2011 03:37:22 -0500
Subject: Attempt to fix issue #193 by setting mako default filter to 'h'.

---
 docs/whatsnew-1.1.rst | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'docs/whatsnew-1.1.rst')

diff --git a/docs/whatsnew-1.1.rst b/docs/whatsnew-1.1.rst
index ea56e2020..761fa8d3a 100644
--- a/docs/whatsnew-1.1.rst
+++ b/docs/whatsnew-1.1.rst
@@ -94,6 +94,15 @@ Minor Feature Additions
 Deprecations and Behavior Differences
 -------------------------------------
 
+- The default Mako renderer is now configured to escape all HTML in
+  expression tags. This is intended to help prevent XSS attacks caused by
+  rendering unsanitized input from users. To revert this behavior in user's
+  templates, they need to filter the expression through the 'n' filter::
+
+     ${ myhtml | n }.
+
+  See https://github.com/Pylons/pyramid/issues/193.
+
 - Deprecated all assignments to ``request.response_*`` attributes (for
   example ``request.response_content_type = 'foo'`` is now deprecated).
   Assignments and mutations of assignable request attributes that were
-- 
cgit v1.2.3