angler-fishThe Vulnerability History Project

Implemented auto-escaping of variable output in templates. Fully controllable by template authors and it's possible to write filters and templates that simulataneously work in both auto-escaped and non-auto-escaped environments if you need to. Fixed #2359

      See documentation in templates.txt and templates_python.txt for how everything
works.

Backwards incompatible if you're inserting raw HTML output via template variables.

Based on an original design from Simon Willison and with debugging help from Michael Radziej.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@6671 bcc190cf-cafb-0310-a4f2-bffc1f526a37
    
commit 356662cf74c99fac90afb0f5e6aac8d2d573e62a
+2 -4
+1 -2
+1 -1
+2 -2
+2 -2
+2 -2
+1 -1
+2 -2
+3 -3
+1 -1
+3 -3
+1 -1
+4 -4
+1 -1
+1 -1
+8 -9
+6 -11
+1 -2
+1 -2
+1 -2
+1 -2
+12 -17
+3 -4
+6 -7
+5 -7
+4 -6
+1 -2
-8
-4
+3 -7
+2 -4
+1 -2
+1 -2
+5 -10
+2 -6
+14 -26
+21 -22
+25 -45
+1 -4
+33 -140
+1 -36
+1 -5
+7 -26
-124
+15 -15
+1 -148
+8 -134
+2 -2
+1 -1
+1 -1
+1 -2
-220
+100 -107
expand_less