1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
unreleased
==========
Features
--------
- Deprecated ``pyramid.session.PickleSerializer``.
See https://github.com/pylons/pyramid/issues/2709
and https://github.com/pylons/pyramid/pull/3353
and https://github.com/pylons/pyramid/pull/3413
- Changed the default ``serializer`` on
``pyramid.session.SignedCookieSessionFactory`` to use
``pyramid.session.JSONSerializer`` instead of
``pyramid.session.PickleSerializer``. Read
"Changes to ISession in Pyramid 2.0" in the "Sessions" chapter of the
documentation for more information about why this change was made.
See https://github.com/Pylons/pyramid/pull/3413
- It is now possible to control whether a route pattern contains a trailing
slash when it is composed with a route prefix using
``config.include(..., route_prefix=...)`` or
``with config.route_prefix_context(...)``. This can be done by specifying
an empty pattern and setting the new argument
``inherit_slash=True``. For example:
.. code-block:: python
with config.route_prefix_context('/users'):
config.add_route('users', '', inherit_slash=True)
In the example, the resulting pattern will be ``/users``. Similarly, if the
route prefix were ``/users/`` then the final pattern would be ``/users/``.
If the ``pattern`` was ``'/'``, then the final pattern would always be
``/users/``. This new setting is only available if the pattern supplied
to ``add_route`` is the empty string (``''``).
See https://github.com/Pylons/pyramid/pull/3420
- No longer define ``pyramid.request.Request.json_body`` which is already
provided by WebOb. This allows the attribute to now be settable.
See https://github.com/Pylons/pyramid/pull/3447
- Improve debugging info from ``pyramid.view.view_config`` decorator.
See https://github.com/Pylons/pyramid/pull/3483
- A new parameter, ``allow_no_origin``, was added to
``pyramid.config.Configurator.set_default_csrf_options`` as well as
``pyramid.csrf.check_csrf_origin``. This option controls whether a
request is rejected if it has no ``Origin`` or ``Referer`` header -
often the result of a user configuring their browser not to send a
``Referer`` header for privacy reasons even on same-domain requests.
The default is to reject requests without a known origin. It is also
possible to allow the special ``Origin: null`` header by adding it to the
``pyramid.csrf_trusted_origins`` list in the settings.
See https://github.com/Pylons/pyramid/pull/3512
and https://github.com/Pylons/pyramid/pull/3518
- A new parameter, ``check_origin``, was added to
``pyramid.config.Configurator.set_default_csrf_options`` which disables
origin checking entirely.
See https://github.com/Pylons/pyramid/pull/3518
- Added ``pyramid.interfaces.IPredicateInfo`` which defines the object passed
to predicate factories as their second argument.
See https://github.com/Pylons/pyramid/pull/3514
Deprecations
------------
Backward Incompatibilities
--------------------------
- ``pcreate`` and the builtin scaffolds have been removed in favor of
using the ``cookiecutter`` tool and the ``pyramid-cookiecutter-starter``
cookiecutter. The script and scaffolds were deprecated in Pyramid 1.8.
See https://github.com/Pylons/pyramid/pull/3406
- Removed ``pyramid.interfaces.ITemplateRenderer``. This interface was
deprecated since Pyramid 1.5 and was an interface
used by libraries like ``pyramid_mako`` and ``pyramid_chameleon`` but
provided no functionality within Pyramid itself.
See https://github.com/Pylons/pyramid/pull/3409
- Removed ``pyramid.security.has_permission``,
``pyramid.security.authenticated_userid``,
``pyramid.security.unauthenticated_userid``, and
``pyramid.security.effective_principals``. These methods were deprecated
in Pyramid 1.5 and all have equivalents available as properties on the
request. For example, ``request.authenticated_userid``.
See https://github.com/Pylons/pyramid/pull/3410
- Removed support for supplying a media range to the ``accept`` predicate of
both ``pyramid.config.Configurator.add_view`` and
``pyramid.config.Configurator.add_route``. These options were deprecated
in Pyramid 1.10 and WebOb 1.8 because they resulted in uncontrollable
matching that was not compliant with the RFC.
See https://github.com/Pylons/pyramid/pull/3411
- Removed ``pyramid.session.UnencryptedCookieSessionFactoryConfig``. This
session factory was replaced with
``pyramid.session.SignedCookieSessionFactory`` in Pyramid 1.5 and has been
deprecated since then.
See https://github.com/Pylons/pyramid/pull/3412
- Removed ``pyramid.session.signed_serialize``, and
``pyramid.session.signed_deserialize``. These methods were only used by
the now-removed ``pyramid.session.UnencryptedCookieSessionFactoryConfig``
and were coupled to the vulnerable pickle serialization format which could
lead to remove code execution if the secret key is compromised.
See https://github.com/Pylons/pyramid/pull/3412
- Changed the default ``serializer`` on
``pyramid.session.SignedCookieSessionFactory`` to use
``pyramid.session.JSONSerializer`` instead of
``pyramid.session.PickleSerializer``. Read
"Changes to ISession in Pyramid 2.0" in the "Sessions" chapter of the
documentation for more information about why this change was made.
See https://github.com/Pylons/pyramid/pull/3413
- ``pyramid.request.Request.invoke_exception_view`` will no longer be called
by the default execution policy.
See https://github.com/Pylons/pyramid/pull/3496
- ``pyramid.config.Configurator.scan`` will no longer, by default, execute
Venusian decorator callbacks registered for categories other than
``'pyramid'``. To find any decorator regardless of category, specify
``config.scan(..., categories=None)``.
See https://github.com/Pylons/pyramid/pull/3510
- The second argument to predicate factories has been changed from ``config``
to ``info``, an instance of ``pyramid.interfaces.IPredicateInfo``. This
limits the data available to predicates but still provides the package,
registry, settings and dotted-name resolver which should cover most use
cases and is largely backward compatible.
See https://github.com/Pylons/pyramid/pull/3514
- Removed the ``check_csrf`` predicate. Instead, use
``pyramid.config.Configurator.set_default_csrf_options`` and the
``require_csrf`` view option to enable automatic CSRF checking.
See https://github.com/Pylons/pyramid/pull/3521
Documentation Changes
---------------------
- Restore build of PDF on Read The Docs.
See https://github.com/Pylons/pyramid/issues/3290
- Fix docs build for Sphinx 2.0.
See https://github.com/Pylons/pyramid/pull/3480
|
