mirror of
https://github.com/django/django.git
synced 2025-10-23 21:59:11 +00:00
Converted links to external topics so they use intersphinx extension markup.
This allows to make these links more resilent to changes in the target URLs. Thanks Jannis for the report and Aymeric Augustin for the patch. Fixes #16586. git-svn-id: http://code.djangoproject.com/svn/django/trunk@16720 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
@@ -14,12 +14,12 @@ who visits the malicious site in their browser. A related type of attack,
|
||||
a site with someone else's credentials, is also covered.
|
||||
|
||||
The first defense against CSRF attacks is to ensure that GET requests (and other
|
||||
'safe' methods, as defined by `9.1.1 Safe Methods, HTTP 1.1, RFC 2616`_) are
|
||||
side-effect free. Requests via 'unsafe' methods, such as POST, PUT and DELETE,
|
||||
can then be protected by following the steps below.
|
||||
'safe' methods, as defined by 9.1.1 Safe Methods, HTTP 1.1,
|
||||
:rfc:`2616#section-9.1.1`) are side-effect free. Requests via 'unsafe' methods,
|
||||
such as POST, PUT and DELETE, can then be protected by following the steps
|
||||
below.
|
||||
|
||||
.. _Cross Site Request Forgeries: http://www.squarefree.com/securitytips/web-developers.html#CSRF
|
||||
.. _9.1.1 Safe Methods, HTTP 1.1, RFC 2616: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
|
||||
|
||||
.. _using-csrf:
|
||||
|
||||
@@ -228,9 +228,9 @@ This ensures that only forms that have originated from your Web site can be used
|
||||
to POST data back.
|
||||
|
||||
It deliberately ignores GET requests (and other requests that are defined as
|
||||
'safe' by RFC 2616). These requests ought never to have any potentially
|
||||
'safe' by :rfc:`2616`). These requests ought never to have any potentially
|
||||
dangerous side effects , and so a CSRF attack with a GET request ought to be
|
||||
harmless. RFC 2616 defines POST, PUT and DELETE as 'unsafe', and all other
|
||||
harmless. :rfc:`2616` defines POST, PUT and DELETE as 'unsafe', and all other
|
||||
methods are assumed to be unsafe, for maximum protection.
|
||||
|
||||
Caching
|
||||
|
||||
@@ -1235,13 +1235,17 @@ may be executed from the SQL Shell as the ``postgres`` user::
|
||||
postgres# CREATE DATABASE geodjango OWNER geodjango TEMPLATE template_postgis ENCODING 'utf8';
|
||||
|
||||
.. rubric:: Footnotes
|
||||
.. [#] The datum shifting files are needed for converting data to and from certain projections.
|
||||
For example, the PROJ.4 string for the `Google projection (900913) <http://spatialreference.org/ref/epsg/900913/proj4>`_
|
||||
requires the ``null`` grid file only included in the extra datum shifting files.
|
||||
It is easier to install the shifting files now, then to have debug a problem caused by their absence later.
|
||||
.. [#] Specifically, GeoDjango provides support for the `OGR <http://gdal.org/ogr>`_ library, a component of GDAL.
|
||||
.. [#] The datum shifting files are needed for converting data to and from
|
||||
certain projections.
|
||||
For example, the PROJ.4 string for the `Google projection (900913)
|
||||
<http://spatialreference.org/ref/epsg/900913/proj4>`_ requires the
|
||||
``null`` grid file only included in the extra datum shifting files.
|
||||
It is easier to install the shifting files now, then to have debug a
|
||||
problem caused by their absence later.
|
||||
.. [#] Specifically, GeoDjango provides support for the `OGR
|
||||
<http://gdal.org/ogr>`_ library, a component of GDAL.
|
||||
.. [#] See `GDAL ticket #2382 <http://trac.osgeo.org/gdal/ticket/2382>`_.
|
||||
.. [#] GeoDjango uses the `find_library <http://docs.python.org/library/ctypes.html#finding-shared-libraries>`_
|
||||
routine from ``ctypes.util`` to locate shared libraries.
|
||||
.. [#] GeoDjango uses the :func:`~ctypes.util.find_library` routine from
|
||||
:mod:`ctypes.util` to locate shared libraries.
|
||||
.. [#] The ``psycopg2`` Windows installers are packaged and maintained by
|
||||
`Jason Erickson <http://www.stickpeople.com/projects/python/win-psycopg/>`_.
|
||||
|
||||
@@ -852,8 +852,9 @@ They share this interface:
|
||||
|
||||
All parameters, if given, should be Unicode objects, except:
|
||||
|
||||
* ``pubdate`` should be a `Python datetime object`_.
|
||||
* ``enclosure`` should be an instance of ``feedgenerator.Enclosure``.
|
||||
* ``pubdate`` should be a Python :class:`~datetime.datetime` object.
|
||||
* ``enclosure`` should be an instance of
|
||||
:class:`django.utils.feedgenerator.Enclosure`.
|
||||
* ``categories`` should be a sequence of Unicode objects.
|
||||
|
||||
:meth:`.SyndicationFeed.write`
|
||||
@@ -884,7 +885,6 @@ For example, to create an Atom 1.0 feed and print it to standard output::
|
||||
</feed>
|
||||
|
||||
.. _django/utils/feedgenerator.py: http://code.djangoproject.com/browser/django/trunk/django/utils/feedgenerator.py
|
||||
.. _Python datetime object: http://docs.python.org/library/datetime.html#datetime-objects
|
||||
|
||||
.. currentmodule:: django.contrib.syndication
|
||||
|
||||
@@ -913,9 +913,9 @@ attributes. Thus, you can subclass the appropriate feed generator class
|
||||
|
||||
``SyndicationFeed.add_root_elements(self, handler)``
|
||||
Callback to add elements inside the root feed element
|
||||
(``feed``/``channel``). ``handler`` is an `XMLGenerator`_ from Python's
|
||||
built-in SAX library; you'll call methods on it to add to the XML
|
||||
document in process.
|
||||
(``feed``/``channel``). ``handler`` is an
|
||||
:class:`~xml.sax.saxutils.XMLGenerator` from Python's built-in SAX library;
|
||||
you'll call methods on it to add to the XML document in process.
|
||||
|
||||
``SyndicationFeed.item_attributes(self, item)``
|
||||
Return a ``dict`` of attributes to add to each item (``item``/``entry``)
|
||||
@@ -945,5 +945,3 @@ For example, you might start implementing an iTunes RSS feed generator like so::
|
||||
|
||||
Obviously there's a lot more work to be done for a complete custom feed class,
|
||||
but the above example should demonstrate the basic idea.
|
||||
|
||||
.. _XMLGenerator: http://docs.python.org/dev/library/xml.sax.utils.html#xml.sax.saxutils.XMLGenerator
|
||||
|
||||
Reference in New Issue
Block a user