diff options
| author | Marc Tamlyn <marc.tamlyn@gmail.com> | 2012-08-18 14:46:17 +0100 |
|---|---|---|
| committer | Andrew Godwin <andrew@aeracode.org> | 2012-08-18 15:07:21 +0100 |
| commit | 58683e9c82d6e7c5fbb7acef79eef9408b776ab0 (patch) | |
| tree | dd330646599bd4b54b9736b89abfd56b482104f2 /docs/ref | |
| parent | 547b181046539f548839e42544521503fbe4d821 (diff) | |
Fixed #16744 -- Class based view should have the view object in the context
Updated the most recent patch from @claudep to apply again and updated
the documentation location.
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/class-based-views/mixins-simple.txt | 16 | ||||
| -rw-r--r-- | docs/ref/templates/api.txt | 2 |
2 files changed, 16 insertions, 2 deletions
diff --git a/docs/ref/class-based-views/mixins-simple.txt b/docs/ref/class-based-views/mixins-simple.txt index 085c8a5fc7..61fc945cd3 100644 --- a/docs/ref/class-based-views/mixins-simple.txt +++ b/docs/ref/class-based-views/mixins-simple.txt @@ -17,8 +17,20 @@ ContextMixin .. method:: get_context_data(**kwargs) - Returns a dictionary representing the template context. The - keyword arguments provided will make up the returned context. + Returns a dictionary representing the template context. The keyword + arguments provided will make up the returned context. + + The template context of all class-based generic views include a + ``view`` variable that points to the ``View`` instance. + + .. admonition:: Use ``alters_data`` where appropriate + + Note that having the view instance in the template context may + expose potentially hazardous methods to template authors. To + prevent methods like this from being called in the template, set + ``alters_data=True`` on those methods. For more information, read + the documentation on :ref:`rendering a template context + <alters-data-description>`. TemplateResponseMixin --------------------- diff --git a/docs/ref/templates/api.txt b/docs/ref/templates/api.txt index bd2b4c6e9d..c52194e6b7 100644 --- a/docs/ref/templates/api.txt +++ b/docs/ref/templates/api.txt @@ -198,6 +198,8 @@ straight lookups. Here are some things to keep in mind: * A variable can only be called if it has no required arguments. Otherwise, the system will return an empty string. +.. _alters-data-description: + * Obviously, there can be side effects when calling some variables, and it'd be either foolish or a security hole to allow the template system to access them. |
