.. _changes_1.7.6: 1.7.6 (2017-06-11) ================== - Fix a bug in which ``pyramid.security.ALL_PERMISSIONS`` failed to return a valid iterator in its ``__iter__`` implementation. See https://github.com/Pylons/pyramid/pull/3077 .. _changes_1.7.5: 1.7.5 (2017-03-12) ================== - HTTPException's accepts a detail kwarg that may be used to pass additional details to the exception. You may now pass objects so long as they have a valid __str__ method. See https://github.com/Pylons/pyramid/pull/2951 - Fix a reference cycle causing memory leaks in which the registry would keep a ``Configurator`` instance alive even after the configurator was discarded. Another fix was also added for the ``global_registries`` object in which the registry was stored in a closure preventing it from being deallocated. See https://github.com/Pylons/pyramid/pull/2972 .. _changes_1.7.4: 1.7.4 (2017-01-24) ================== - Update HACKING.txt from stale branch that was never merged to master. See https://github.com/Pylons/pyramid/pull/2785 - Fix an inconsistency in the documentation between view predicates and route predicates and highlight the differences in their APIs. See https://github.com/Pylons/pyramid/pull/2765 - Fix incompatibilities in the ``prequest`` test suite caused by changes in WebOb 1.7. See https://github.com/Pylons/pyramid/pull/2788 - Fix bug in i18n where the default domain would always use the Germanic plural style, even if a different plural function is defined in the relevant messages file. See https://github.com/Pylons/pyramid/pull/2865 .. _changes_1.7.3: 1.7.3 (2016-08-17) ================== Bug Fixes --------- - Oops, Apparently wheels do not build cleanly every time, so build artifacts from 1.6.3 creeped into the wheel for 1.7.2. Note to self: ``rm -rf build``. .. _changes_1.7.2: 1.7.2 (2016-08-16) ================== - Revert changes from #2706 released in Pyramid 1.7.1. JSON renderers will continue to return unicode data instead of UTF-8 encoded bytes. This means that WebOb responses are still expected to handle unicode data even though JSON does not have a charset. See https://github.com/Pylons/pyramid/issues/2744 .. _changes_1.7.1: 1.7.1 (2016-08-16) ================== - Change flake8 noqa directive to ignore only a single line instead of the entire file in scaffold and documentation. See https://github.com/Pylons/pyramid/pull/2646 - Add option to build docs as PDF only via tox. See: https://github.com/Pylons/pyramid/issues/2575 - Correct the column type used in the SQLAlchemy + URL Dispatch tutorial by changing it from Integer to Text. See https://github.com/Pylons/pyramid/pull/2591 - Fix a bug in which the ``password_hash`` in the Wiki2 tutorial was sometimes being treated as bytes instead of unicode. See https://github.com/Pylons/pyramid/pull/2705 - Properly emit a ``DeprecationWarning`` for using ``pyramid.config.Configurator.set_request_property`` instead of ``pyramid.config.Configurator.add_request_method``. - Updated Windows installation instructions and related bits. See: https://github.com/Pylons/pyramid/issues/2661 - Fixed bug in `proutes` such that it now shows the correct view when a class and `attr` is involved. See: https://github.com/Pylons/pyramid/pull/2687 - The JSON renderers now encode their result as UTF-8. The renderer helper will now warn the user and encode the result as UTF-8 if a renderer returns a text type and the response does not have a valid character set. See https://github.com/Pylons/pyramid/pull/2706 1.7 (2016-05-19) ================ - Fix a bug in the wiki2 tutorial where bcrypt is always expecting byte strings. See https://github.com/Pylons/pyramid/pull/2576 - Simplify windows detection code and remove some duplicated data. See https://github.com/Pylons/pyramid/pull/2585 and https://github.com/Pylons/pyramid/pull/2586 1.7b4 (2016-05-12) ================== - Fixed the exception view tween to re-raise the original exception if no exception view could be found to handle the exception. This better allows tweens further up the chain to handle exceptions that were left unhandled. Previously they would be converted into a ``PredicateMismatch`` exception if predicates failed to allow the view to handle the exception. See https://github.com/Pylons/pyramid/pull/2567 - Exposed the ``pyramid.interfaces.IRequestFactory`` interface to mirror the public ``pyramid.interfaces.IResponseFactory`` interface. 1.7b3 (2016-05-10) ================== - Fix ``request.invoke_exception_view`` to raise an ``HTTPNotFound`` exception if no view is matched. Previously ``None`` would be returned if no views were matched and a ``PredicateMismatch`` would be raised if a view "almost" matched (a view was found matching the context). See https://github.com/Pylons/pyramid/pull/2564 - Add defaults for py.test configuration and coverage to all three scaffolds, and update documentation accordingly. See https://github.com/Pylons/pyramid/pull/2550 - Add ``linkcheck`` to ``Makefile`` for Sphinx. To check the documentation for broken links, use the command ``make linkcheck SPHINXBUILD=$VENV/bin/sphinx-build``. Also removed and fixed dozens of broken external links. - Fix the internal runner for scaffold tests to ensure they work with pip and py.test. See https://github.com/Pylons/pyramid/pull/2565 1.7b2 (2016-05-01) ================== - Removed inclusion of pyramid_tm in development.ini for alchemy scaffold See https://github.com/Pylons/pyramid/issues/2538 - A default permission set via ``config.set_default_permission`` will no longer be enforced on an exception view. This has been the case for a while with the default exception views (``config.add_notfound_view`` and ``config.add_forbidden_view``), however for any other exception view a developer had to remember to set ``permission=NO_PERMISSION_REQUIRED`` or be surprised when things didn't work. It is still possible to force a permission check on an exception view by setting the ``permission`` argument manually to ``config.add_view``. This behavior is consistent with the new CSRF features added in the 1.7 series. See https://github.com/Pylons/pyramid/pull/2534 1.7b1 (2016-04-25) ================== - This release announces the beta period for 1.7. - Fix an issue where some files were being included in the alchemy scafffold which had been removed from the 1.7 series. See https://github.com/Pylons/pyramid/issues/2525 1.7a2 (2016-04-19) ================== Features -------- - Automatic CSRF checks are now disabled by default on exception views. They can be turned back on by setting the appropriate `require_csrf` option on the view. See https://github.com/Pylons/pyramid/pull/2517 - The automatic CSRF API was reworked to use a config directive for setting the options. The ``pyramid.require_default_csrf`` setting is no longer supported. Instead, a new ``config.set_default_csrf_options`` directive has been introduced that allows the developer to specify the default value for ``require_csrf`` as well as change the CSRF token, header and safe request methods. The ``pyramid.csrf_trusted_origins`` setting is still supported. See https://github.com/Pylons/pyramid/pull/2518 Bug fixes --------- - CSRF origin checks had a bug causing the checks to always fail. See https://github.com/Pylons/pyramid/pull/2512 - Fix the test suite to pass on windows. See https://github.com/Pylons/pyramid/pull/2520 1.7a1 (2016-04-16) ================== Backward Incompatibilities -------------------------- - Following the Pyramid deprecation period (1.4 -> 1.6), AuthTktAuthenticationPolicy's default hashing algorithm is changing from md5 to sha512. If you are using the authentication policy and need to continue using md5, please explicitly set hashalg to 'md5'. This change does mean that any existing auth tickets (and associated cookies) will no longer be valid, and users will no longer be logged in, and have to login to their accounts again. See https://github.com/Pylons/pyramid/pull/2496 - The ``check_csrf_token`` function no longer validates a csrf token in the query string of a request. Only headers and request bodies are supported. See https://github.com/Pylons/pyramid/pull/2500 Features -------- - Added a new setting, ``pyramid.require_default_csrf`` which may be used to turn on CSRF checks globally for every POST request in the application. This should be considered a good default for websites built on Pyramid. It is possible to opt-out of CSRF checks on a per-view basis by setting ``require_csrf=False`` on those views. See https://github.com/Pylons/pyramid/pull/2413 - Added a ``require_csrf`` view option which will enforce CSRF checks on any request with an unsafe method as defined by RFC2616. If the CSRF check fails a ``BadCSRFToken`` exception will be raised and may be caught by exception views (the default response is a ``400 Bad Request``). This option should be used in place of the deprecated ``check_csrf`` view predicate which would normally result in unexpected ``404 Not Found`` response to the client instead of a catchable exception. See https://github.com/Pylons/pyramid/pull/2413 and https://github.com/Pylons/pyramid/pull/2500 - Added an additional CSRF validation that checks the origin/referrer of a request and makes sure it matches the current ``request.domain``. This particular check is only active when accessing a site over HTTPS as otherwise browsers don't always send the required information. If this additional CSRF validation fails a ``BadCSRFOrigin`` exception will be raised and may be caught by exception views (the default response is ``400 Bad Request``). Additional allowed origins may be configured by setting ``pyramid.csrf_trusted_origins`` to a list of domain names (with ports if on a non standard port) to allow. Subdomains are not allowed unless the domain name has been prefixed with a ``.``. See https://github.com/Pylons/pyramid/pull/2501 - Added a new ``pyramid.session.check_csrf_origin`` API for validating the origin or referrer headers against the request's domain. See https://github.com/Pylons/pyramid/pull/2501 - Pyramid HTTPExceptions will now take into account the best match for the clients Accept header, and depending on what is requested will return text/html, application/json or text/plain. The default for */* is still text/html, but if application/json is explicitly mentioned it will now receive a valid JSON response. See https://github.com/Pylons/pyramid/pull/2489 - A new event and interface (BeforeTraversal) has been introduced that will notify listeners before traversal starts in the router. See https://github.com/Pylons/pyramid/pull/2469 and https://github.com/Pylons/pyramid/pull/1876 - Add a new "view deriver" concept to Pyramid to allow framework authors to inject elements into the standard Pyramid view pipeline and affect all views in an application. This is similar to a decorator except that it has access to options passed to ``config.add_view`` and can affect other stages of the pipeline such as the raw response from a view or prior to security checks. See https://github.com/Pylons/pyramid/pull/2021 - Allow a leading ``=`` on the key of the request param predicate. For example, '=abc=1' is equivalent down to ``request.params['=abc'] == '1'``. See https://github.com/Pylons/pyramid/pull/1370 - A new ``request.invoke_exception_view(...)`` method which can be used to invoke an exception view and get back a response. This is useful for rendering an exception view outside of the context of the excview tween where you may need more control over the request. See https://github.com/Pylons/pyramid/pull/2393 - Allow using variable substitutions like ``%(LOGGING_LOGGER_ROOT_LEVEL)s`` for logging sections of the .ini file and populate these variables from the ``pserve`` command line -- e.g.: ``pserve development.ini LOGGING_LOGGER_ROOT_LEVEL=DEBUG`` See https://github.com/Pylons/pyramid/pull/2399 Documentation Changes --------------------- - A complete overhaul of the docs: - Use pip instead of easy_install. - Become opinionated by preferring Python 3.4 or greater to simplify installation of Python and its required packaging tools. - Use venv for the tool, and virtual environment for the thing created, instead of virtualenv. - Use py.test and pytest-cov instead of nose and coverage. - Further updates to the scaffolds as well as tutorials and their src files. See https://github.com/Pylons/pyramid/pull/2468 - A complete overhaul of the ``alchemy`` scaffold as well as the Wiki2 SQLAlchemy + URLDispatch tutorial to introduce more modern features into the usage of SQLAlchemy with Pyramid and provide a better starting point for new projects. See https://github.com/Pylons/pyramid/pull/2024 Bug Fixes --------- - Fix ``pserve --browser`` to use the ``--server-name`` instead of the app name when selecting a section to use. This was only working for people who had server and app sections with the same name, for example ``[app:main]`` and ``[server:main]``. See https://github.com/Pylons/pyramid/pull/2292 Deprecations ------------ - The ``check_csrf`` view predicate has been deprecated. Use the new ``require_csrf`` option or the ``pyramid.require_default_csrf`` setting to ensure that the ``BadCSRFToken`` exception is raised. See https://github.com/Pylons/pyramid/pull/2413 - Support for Python 3.3 will be removed in Pyramid 1.8. https://github.com/Pylons/pyramid/issues/2477 - Python 2.6 is no longer supported by Pyramid. See https://github.com/Pylons/pyramid/issues/2368 - Dropped Python 3.2 support. See https://github.com/Pylons/pyramid/pull/2256