Mercurial > p > roundup > code
diff doc/customizing.txt @ 5004:494d255043c9
Display errors containing HTML with RejectRaw (issue2550847)
In general outputting un-escaped HTML in a message to the user is an
unsafe operation, which is why error message are escaped by default. In
some cases though it is desirable for a detector to include HTML within
an error message. For these cases where HTML is required the RejectRaw
exception can be used within the detector.
| author | John Kristensen <john@jerrykan.com> |
|---|---|
| date | Sat, 10 Oct 2015 23:35:51 +1100 |
| parents | 2fce201a2b47 |
| children | b8a04cce88ff |
line wrap: on
line diff
--- a/doc/customizing.txt Sat Oct 10 23:07:17 2015 +1100 +++ b/doc/customizing.txt Sat Oct 10 23:35:51 2015 +1100 @@ -928,7 +928,13 @@ And then when your rejection criteria have been detected, simply:: - raise Reject + raise Reject('Description of error') + +Error messages raised with ``Reject`` automatically have any HTML content +escaped before being displayed to the user. To display an error message to the +user without performing any HTML escaping the ``RejectRaw`` should be used. All +security implications should be carefully considering before using +``RejectRaw``. Generating email from Roundup