mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #22130 -- Deprecated fix_ampersands, removed utils.clean_html()

Browse Source
This commit is contained in:
Erik Romijn
2014-03-01 10:42:08 +01:00
parent 8c98f39624
commit 775975f15d
7 changed files with 64 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/releases/1.7.txt
View File

@@ -1406,3 +1406,16 @@ strings, you should use ``django.utils.html.escapejs`` or the
:tfilter:`escapejs` template filter.
If all you need is to generate valid javascript strings, you can simply use
``json.dumps()``.
``fix_ampersands`` utils method and template filter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The ``django.utils.html.fix_ampersands`` method and the :tfilter:`fix_ampersands`
template filter are deprecated, as the escaping of ampersands is already taken care
of by Django's standard HTML escaping features. Combining this with ``fix_ampersands``
would either result in double escaping, or, if the output is assumed to be safe,
a risk of introducing XSS vulnerabilities. Along with ``fix_ampersands``,
``django.utils.html.clean_html`` is deprecated, an undocumented function that calls
``fix_ampersands``.
As this is an accelerated deprecation, ``fix_ampersands`` and ``clean_html``
will be removed in Django 1.8.