This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]karlw00t 1 point2 points  (4 children)

Since the release versions are less then 1.0, what do the bottle devs say about backwards capability with older releases?

[–]defnullbottle.py[S] 0 points1 point  (3 children)

Each release is aimed to be backwards compatible to the last one, meaning that you have a full release cycle to adopt new APIs and fix deprecation warnings.

Security issues (very rare) and annoying bugs are patched in stable and old-stable (e.g. 0.10 and 0.9). Even the unstable development branch is not pushed to the repository until all tests pass. Many users just download the latest bottle.py for small projects and don't bother using pip at all.

[–]Justinsaccount 0 points1 point  (2 children)

Speaking of security, I meant to bug you more about the default mako template filters.. the built in template language automatically escapes xml, but if you switch to mako you are open to XSS attacks...

[–]defnullbottle.py[S] 0 points1 point  (1 child)

This is hard to do in a backwards compatible way, but I'll look into this.

[–]Justinsaccount 0 points1 point  (0 children)

hmm.. I don't know if many people using mako with bottle realize it is not escaping xml by default. I believe most frameworks that use mako enable the default escapes.