From 718f149bb203d6b3f77bb8126e664054ee90fe7d Mon Sep 17 00:00:00 2001 From: Luke Plant Date: Thu, 19 Apr 2012 15:00:55 +0000 Subject: Added more explicit warnings about unconfigured reStructured Text usage in docs. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17915 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/ref/contrib/markup.txt | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'docs/ref') diff --git a/docs/ref/contrib/markup.txt b/docs/ref/contrib/markup.txt index 4ee2f94128..8f3e0a95f9 100644 --- a/docs/ref/contrib/markup.txt +++ b/docs/ref/contrib/markup.txt @@ -46,6 +46,15 @@ When using the ``restructuredtext`` markup filter you can define a override the default writer settings. See the `restructuredtext writer settings`_ for details on what these settings are. +.. warning:: + + reStructured Text has features that allow raw HTML to be included, and that + allow arbitrary files to be included. These can lead to XSS vulnerabilities + and leaking of private information. It is your responsibility to check the + features of this library and configure appropriately to avoid this. See the + `Deploying Docutils Securely + `_ documentation. + .. _restructuredtext writer settings: http://docutils.sourceforge.net/docs/user/config.html#html4css1-writer Markdown -- cgit v1.3