diff options
| author | Erik Romijn <eromijn@solidlinks.nl> | 2014-03-01 10:42:08 +0100 |
|---|---|---|
| committer | Erik Romijn <eromijn@solidlinks.nl> | 2014-03-01 14:07:57 +0100 |
| commit | 775975f15d7d461c154e558cba5fb0592539126f (patch) | |
| tree | 818be1016cf0527aa38888151778bfd59fcd9012 /docs | |
| parent | 8c98f39624a60c63a16e097b64e5f71ecc27271f (diff) | |
Fixed #22130 -- Deprecated fix_ampersands, removed utils.clean_html()
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/internals/deprecation.txt | 3 | ||||
| -rw-r--r-- | docs/ref/templates/builtins.txt | 3 | ||||
| -rw-r--r-- | docs/releases/1.7.txt | 13 |
3 files changed, 19 insertions, 0 deletions
diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt index f64cc53d25..36bc2ee533 100644 --- a/docs/internals/deprecation.txt +++ b/docs/internals/deprecation.txt @@ -209,6 +209,9 @@ details on these changes. (``django.contrib.gis.sitemaps.views.index`` and ``django.contrib.gis.sitemaps.views.sitemap``). +* ``django.utils.html.fix_ampersands``, the ``fix_ampersands`` template filter and + ``django.utils.html.clean_html`` will be removed following an accelerated deprecation. + .. _deprecation-removed-in-1.7: 1.7 diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt index a5d4c7c26e..bb02187727 100644 --- a/docs/ref/templates/builtins.txt +++ b/docs/ref/templates/builtins.txt @@ -1582,6 +1582,9 @@ fix_ampersands This is rarely useful as ampersands are automatically escaped. See :tfilter:`escape` for more information. +.. deprecated:: 1.7 + This filter has been deprecated and will be removed in Django 1.8. + Replaces ampersands with ``&`` entities. For example:: diff --git a/docs/releases/1.7.txt b/docs/releases/1.7.txt index 98b336f630..882fa69dee 100644 --- a/docs/releases/1.7.txt +++ b/docs/releases/1.7.txt @@ -1406,3 +1406,16 @@ strings, you should use ``django.utils.html.escapejs`` or the :tfilter:`escapejs` template filter. If all you need is to generate valid javascript strings, you can simply use ``json.dumps()``. + +``fix_ampersands`` utils method and template filter +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The ``django.utils.html.fix_ampersands`` method and the :tfilter:`fix_ampersands` +template filter are deprecated, as the escaping of ampersands is already taken care +of by Django's standard HTML escaping features. Combining this with ``fix_ampersands`` +would either result in double escaping, or, if the output is assumed to be safe, +a risk of introducing XSS vulnerabilities. Along with ``fix_ampersands``, +``django.utils.html.clean_html`` is deprecated, an undocumented function that calls +``fix_ampersands``. +As this is an accelerated deprecation, ``fix_ampersands`` and ``clean_html`` +will be removed in Django 1.8. |