Changeset 3523 for sandboxes

Timestamp:

04/06/11 10:15:11 (14 months ago)

Author:

tboutell

Message:

Fixes #1012: output escaping was turned off in the sandbox on February 2nd 2011. Our plugins are designed to work with or without output escaping, but you should check your client projects to make sure you explicitly enabled it or have otherwise coded in an XSS-safe fashion

Files:

• sandboxes/asandbox/branches/1.5/apps/frontend/config/settings.yml (modified) (1 diff)

sandboxes/asandbox/branches/1.5/apps/frontend/config/settings.yml

@@ -41 +41 @@
     # In 1.5 Apostrophe is compatible with the Symfony default escaping strategy
 
-    escaping_strategy:      false            # Determines how variables are made available to templates.
+    escaping_strategy:      true            # Determines how variables are made available to templates.
     escaping_method:        ESC_SPECIALCHARS # Function or helper used for escaping. Accepted values: ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, and ESC_SPECIALCHARS.
     #    # Activated modules from plugins or from the symfony core