Skip to content

Conversation

@alanhamlett
Copy link
Contributor

This seems like a sane default, since Flask turns on autoescape by default for html files when using the more common render_template so users will be expecting render_template_string to autoescape their template variables.

@untitaker
Copy link
Contributor

Sensible or not, this is a drastical change in behavior and a breakage of the API that deserves more discussion than just a simple PR.

@alanhamlett
Copy link
Contributor Author

@untitaker sure, where do we start?

@untitaker
Copy link
Contributor

There are a few questions unanswered:

  • How to deal with code that relies on the current default
  • Whether the change is worth the compatibility breakage
  • Which reasons @mitsuhiko originally had for the current default

@alanhamlett
Copy link
Contributor Author

How to deal with code that relies on the current default

This search finds too many usages than I know how to deal with, so just a note in the release changes?
https://github.com/search?q=render_template_string&type=Code

Whether the change is worth the compatibility breakage

I'm always for breaking compatibility in favor of better defaults, but it's not only my decision.

Which reasons @mitsuhiko originally had for the current default

@mitsuhiko any input?

@alanhamlett
Copy link
Contributor Author

What should we do about this? If this pull request isn't going to be merged I'll remove it...

@untitaker
Copy link
Contributor

I think it should be included in 1.0, but mitsuhiko should decide.

It doesn't seem that he is reachable atm, but please reopen anyway.

On 23 June 2015 09:34:05 CEST, Alan Hamlett notifications@github.com wrote:

Closed #1176.


Reply to this email directly or view it on GitHub:
#1176 (comment)

@alanhamlett
Copy link
Contributor Author

I deleted the fork, so can't reopen. Created a new pull request #1515.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 14, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants