diff options
| author | andrewnester <andrew.nester.dev@gmail.com> | 2017-01-09 14:20:57 +0300 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2017-01-27 10:36:19 -0500 |
| commit | d2e40dd8c2031cd03700e72d87d455d5e974800c (patch) | |
| tree | af36f29325ccacfc4c18915ed421e603d7a165ec /docs | |
| parent | 110f4bb6a2600e3b466ee6fa0c938c4bc54ea53f (diff) | |
Fixed #27678 -- Warned that the template system isn't safe against untrusted authors.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/topics/templates.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/docs/topics/templates.txt b/docs/topics/templates.txt index c443880004..df5bd9d460 100644 --- a/docs/topics/templates.txt +++ b/docs/topics/templates.txt @@ -36,6 +36,13 @@ For historical reasons, both the generic support for template engines and the implementation of the Django template language live in the ``django.template`` namespace. +.. warning:: + + The template system isn't safe against untrusted template authors. For + example, a site shouldn't allow its users to provide their own templates, + since template authors can do things like perform XSS attacks and access + properties of template variables that may contain sensitive information. + .. _template-engines: Support for template engines |