Fixed #17837. Improved markdown safety.

Markdown enable_attributes is now False when safe_mode is enabled. Documented
the markdown "safe" argument. Added warnings when the safe argument is
passed to versions of markdown which cannot be made safe. Deprecated
versions of markdown < 2.1. Many thanks to ptone for the patch.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@17735 bcc190cf-cafb-0310-a4f2-bffc1f526a37

3 files changed, 40 insertions, 0 deletions

diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt
index cb91a1c0a3..81ca7afa27 100644
--- a/docs/internals/deprecation.txt
+++ b/docs/internals/deprecation.txt
@@ -196,6 +196,11 @@ these changes.
   filesystem path to a ``locale`` directory containing non-app-specific
   translations in its value.
 
+* The Markup contrib app will no longer support versions of Python-Markdown
+  library earlier than 2.1. An accelerated timeline was used as this was
+  a security related deprecation.
+
+
 1.6
 ---
 
diff --git a/docs/ref/contrib/markup.txt b/docs/ref/contrib/markup.txt
index d671e46e2c..3abc27bf5d 100644
--- a/docs/ref/contrib/markup.txt
+++ b/docs/ref/contrib/markup.txt
@@ -47,3 +47,19 @@ override the default writer settings. See the `restructuredtext writer
 settings`_ for details on what these settings are.
 
 .. _restructuredtext writer settings: http://docutils.sourceforge.net/docs/user/config.html#html4css1-writer
+
+Markdown
+--------
+
+The Python Markdown library supports options named "safe_mode" and
+"enable_attributes". Both relate to the security of the output. To enable both
+options in tandem, the markdown filter supports the "safe" argument.
+
+    {{ markdown_content_var|markdown:"safe" }}
+
+.. warning::
+
+    Versions of the Python-Markdown library prior to 2.1 do not support the
+    optional disabling of attributes and by default they will be included in
+    any output from the markdown filter - a warning is issued if this is the
+    case.
diff --git a/docs/releases/1.4.txt b/docs/releases/1.4.txt
index c3bbe480ea..d82ca03d28 100644
--- a/docs/releases/1.4.txt
+++ b/docs/releases/1.4.txt
@@ -1096,6 +1096,16 @@ field. This was something that should not have worked, and in 1.4 loading such
 incomplete fixtures will fail. Because fixtures are a raw import, they should
 explicitly specify all field values, regardless of field options on the model.
 
+Attributes disabled in markdown when safe mode set
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Prior to Django 1.4, attributes were included in any markdown output regardless
+of safe mode setting of the filter. With version > 2.1 of the Python-Markdown
+library, an enable_attributes option was added. When the safe argument is
+passed to the markdown filter, both the ``safe_mode=True`` and
+``enable_attributes=False`` options are set. If using a version of the
+Python-Markdown library less than 2.1, a warning is issued that the output is
+insecure.
 
 Features deprecated in 1.4
 ==========================
@@ -1262,3 +1272,12 @@ each request to a site map now creates a new Paginator object and calls the
 ``items()`` method is doing, this may have a negative performance impact.
 To mitigate the performance impact, consider using the :doc:`caching
 framework </topics/cache>` within your ``Sitemap`` subclass.
+
+Versions of Python-Markdown earlier than 2.1
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Versions of Python-Markdown earlier than 2.1 do not support the option to
+disable attributes. As a security issue, earlier versions of this library will
+not be supported by the markup contrib app in 1.5 under an accelerated
+deprecation timeline.
+