summaryrefslogtreecommitdiff
path: root/docs/ref
diff options
context:
space:
mode:
authorMarc Tamlyn <marc.tamlyn@gmail.com>2012-08-18 14:46:17 +0100
committerAndrew Godwin <andrew@aeracode.org>2012-08-18 15:07:21 +0100
commit58683e9c82d6e7c5fbb7acef79eef9408b776ab0 (patch)
treedd330646599bd4b54b9736b89abfd56b482104f2 /docs/ref
parent547b181046539f548839e42544521503fbe4d821 (diff)
Fixed #16744 -- Class based view should have the view object in the context
Updated the most recent patch from @claudep to apply again and updated the documentation location.
Diffstat (limited to 'docs/ref')
-rw-r--r--docs/ref/class-based-views/mixins-simple.txt16
-rw-r--r--docs/ref/templates/api.txt2
2 files changed, 16 insertions, 2 deletions
diff --git a/docs/ref/class-based-views/mixins-simple.txt b/docs/ref/class-based-views/mixins-simple.txt
index 085c8a5fc7..61fc945cd3 100644
--- a/docs/ref/class-based-views/mixins-simple.txt
+++ b/docs/ref/class-based-views/mixins-simple.txt
@@ -17,8 +17,20 @@ ContextMixin
.. method:: get_context_data(**kwargs)
- Returns a dictionary representing the template context. The
- keyword arguments provided will make up the returned context.
+ Returns a dictionary representing the template context. The keyword
+ arguments provided will make up the returned context.
+
+ The template context of all class-based generic views include a
+ ``view`` variable that points to the ``View`` instance.
+
+ .. admonition:: Use ``alters_data`` where appropriate
+
+ Note that having the view instance in the template context may
+ expose potentially hazardous methods to template authors. To
+ prevent methods like this from being called in the template, set
+ ``alters_data=True`` on those methods. For more information, read
+ the documentation on :ref:`rendering a template context
+ <alters-data-description>`.
TemplateResponseMixin
---------------------
diff --git a/docs/ref/templates/api.txt b/docs/ref/templates/api.txt
index bd2b4c6e9d..c52194e6b7 100644
--- a/docs/ref/templates/api.txt
+++ b/docs/ref/templates/api.txt
@@ -198,6 +198,8 @@ straight lookups. Here are some things to keep in mind:
* A variable can only be called if it has no required arguments. Otherwise,
the system will return an empty string.
+.. _alters-data-description:
+
* Obviously, there can be side effects when calling some variables, and
it'd be either foolish or a security hole to allow the template system
to access them.