Upgrading Werkzeug 0.2 to 0.3
Breaking0.2 → 0.3.1Breaking2Security1New16Changed3Fixed4
BreakingUpgrade verdict
2 breaking changes and a security fix.
In plain terms
- Properties built with environ_property can no longer be assigned unless writability is requested.
- Missing-key errors from these containers now produce meaningful HTTP responses if uncaught.
- A security flaw in the SecureCookie helper has been fixed, so upgrading is recommended.
Must act 3 items need code or config changes
What you must change
Breaking2
environ_property is now read-only by default.
environ_propertyMultiDict, CombinedMultiDict, Headers, and EnvironHeaders raise special key errors that subclass BadRequest.MultiDictCombinedMultiDictHeadersEnvironHeadersBadRequestSecurity1
Fixes a security problem with werkzeug.contrib.SecureCookie.
werkzeug.contrib.SecureCookieAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- added:
export make_app
- added:
class CoolMagicApplication(object) - added:
constructor CoolMagicApplication(config) - added:
function make_app(config=…)
- added:
variable request
- added:
class Request(BaseRequest) - added:
class Response(BaseResponse) - added:
class TemplateResponse(Response) - added:
class ThreadedRequest(object) - added:
constructor Request(environ, url_adapter) - added:
constructor TemplateResponse(template_name, **values) - added:
field Request.charset - added:
field Response.charset - added:
field Response.default_mimetype - added:
function export(string, template=…, **extra) - added:
function url_for(endpoint, **values) - added:
variable exported_views - added:
variable local - added:
variable local_manager - added:
variable template_env
- added:
function about() - added:
function broken() - added:
function index() - added:
function not_found()
- added:
class Couchy(object) - added:
constructor Couchy(db_uri) - added:
method Couchy.dispatch(environ, start_response)
- added:
class URL(Document) - added:
field URL.added - added:
field URL.db - added:
field URL.public - added:
field URL.shorty_id - added:
field URL.target - added:
method URL.store() - added:
property URL.short_url - added:
static method URL.load(id) - added:
static method URL.query(code)
- added:
class Pagination(object) - added:
constructor Pagination(results, per_page, page, endpoint) - added:
field Pagination.has_next - added:
field Pagination.has_previous - added:
field Pagination.next - added:
field Pagination.pages - added:
field Pagination.previous - added:
function expose(rule, **kw) - added:
function get_random_uid() - added:
function render_template(template, **context) - added:
function url_for(endpoint, _external=…, **values) - added:
function validate_url(url) - added:
property Pagination.count - added:
property Pagination.entries - added:
variable ALLOWED_SCHEMES - added:
variable STATIC_PATH - added:
variable TEMPLATE_PATH - added:
variable URL_CHARS - added:
variable application - added:
variable jinja_env - added:
variable local - added:
variable local_manager - added:
variable url_map
- added:
function display(request, uid) - added:
function link(request, uid) - added:
function list(request, page) - added:
function new(request) - added:
function not_found(request)
- added:
export make_app
- added:
class Cup(object) - added:
class Page(object) - added:
class PageMeta(type) - added:
constructor Cup(database, interval=…) - added:
constructor Page(cup, request, url_adapter) - added:
constructor PageMeta(name, bases, d) - added:
field Page.url_arguments - added:
field PageMeta.identifier - added:
function make_app(database, interval=…) - added:
method Cup.dispatch_request(request) - added:
method Cup.update_master() - added:
method Page.get_response() - added:
method Page.process() - added:
method Page.render_template(template=…) - added:
method Page.url_for(endpoint, **values) - added:
variable pages - added:
variable templates - added:
variable url_map
- added:
class Database(object) - added:
constructor Database(filename) - added:
method Database.close() - added:
method Database.setdefault(key, factory) - added:
method Database.sync()
- added:
class Player(object) - added:
class Server(Syncable) - added:
class ServerBrowser(Syncable) - added:
class ServerError(Exception) - added:
class Syncable(object) - added:
constructor Player(server, name, score) - added:
constructor Server(addr, server_id) - added:
constructor ServerBrowser(cup) - added:
field Syncable.last_sync - added:
method Syncable.sync() - added:
variable GAMETYPES
- added:
class MissingPage(Page) - added:
class Search(Page) - added:
class Server(Page) - added:
class ServerList(Page) - added:
field Search.url_rule - added:
field Server.url_rule - added:
field ServerList.url_rule - added:
method MissingPage.get_response() - added:
method Search.process() - added:
method Server.process(id) - added:
method ServerList.order_link(name, title) - added:
method ServerList.process()
- added:
function unicodecmp(a, b)
- added:
export make_app
- added:
class Application(object) - added:
class Request(BaseRequest) - added:
class Response(BaseResponse) - added:
class TemplateResponse(Response) - added:
constructor Application() - added:
constructor Request(environ, urls) - added:
constructor TemplateResponse(template_name, **values) - added:
function expose(name) - added:
method Request.url_for(endpoint, **args) - added:
method TemplateResponse.render_template(name, values) - added:
variable TEMPLATES - added:
variable views
- added:
variable map
- added:
function about(req) - added:
function blog_index(req) - added:
function blog_show(req, post_id) - added:
function index(req) - added:
function page_not_found(req)
- added:
export Plnt
- added:
class Blog(object) - added:
class Entry(object) - added:
constructor Blog(name, url, feed_url, description=…) - added:
function new_db_session() - added:
variable Session - added:
variable blog_table - added:
variable entry_table - added:
variable metadata
- added:
function sync() - added:
variable HTML_MIMETYPES
- added:
class Pagination(object) - added:
constructor Pagination(query, per_page, page, endpoint) - added:
field Pagination.has_next - added:
field Pagination.has_previous - added:
field Pagination.next - added:
field Pagination.pages - added:
field Pagination.previous - added:
function expose(url_rule, endpoint=…, **kwargs) - added:
function nl2p(s) - added:
function render_template(template_name, **context) - added:
function strip_tags(s) - added:
function url_for(endpoint, **kw) - added:
property Pagination.count - added:
property Pagination.entries - added:
variable application - added:
variable endpoints - added:
variable html_entities - added:
variable jinja_env - added:
variable local - added:
variable local_manager - added:
variable request - added:
variable template_path - added:
variable url_adapter - added:
variable url_map
- added:
function about(request) - added:
function index(request, page) - added:
variable PER_PAGE
- added:
class Plnt(object) - added:
constructor Plnt(database_uri) - added:
method Plnt.bind_to_context() - added:
method Plnt.dispatch_request(environ, start_response) - added:
method Plnt.init_database() - added:
variable SHARED_DATA
- added:
class Shorty(object) - added:
constructor Shorty(db_uri) - added:
method Shorty.dispatch(environ, start_response) - added:
method Shorty.init_database()
- added:
class URL(object) - added:
constructor URL(target, public=…, uid=…, added=…) - added:
property URL.short_url - added:
variable url_table
- added:
class Pagination(object) - added:
constructor Pagination(query, per_page, page, endpoint) - added:
field Pagination.has_next - added:
field Pagination.has_previous - added:
field Pagination.next - added:
field Pagination.pages - added:
field Pagination.previous - added:
function expose(rule, **kw) - added:
function get_random_uid() - added:
function render_template(template, **context) - added:
function url_for(endpoint, _external=…, **values) - added:
function validate_url(url) - added:
property Pagination.count - added:
property Pagination.entries - added:
variable ALLOWED_SCHEMES - added:
variable STATIC_PATH - added:
variable Session - added:
variable TEMPLATE_PATH - added:
variable URL_CHARS - added:
variable application - added:
variable jinja_env - added:
variable local - added:
variable local_manager - added:
variable metadata - added:
variable url_map
- added:
function display(request, uid) - added:
function link(request, uid) - added:
function list(request, page) - added:
function new(request) - added:
function not_found(request)
- added:
export SimpleWiki
- added:
function missing_action(request, action) - added:
function on_diff(request, page_name) - added:
function on_edit(request, page_name) - added:
function on_log(request, page_name) - added:
function on_revert(request, page_name) - added:
function on_show(request, page_name) - added:
function page_missing(request, page_name, revision_requested, protected=…)
- added:
class SimpleWiki(object) - added:
constructor SimpleWiki(database_uri) - added:
method SimpleWiki.bind_to_context() - added:
method SimpleWiki.dispatch_request(environ, start_response) - added:
method SimpleWiki.init_database() - added:
variable SHARED_DATA
- added:
class Page(object) - added:
class Revision(object) - added:
class RevisionedPage(Page, Revision) - added:
constructor Page(name) - added:
constructor Revision(page, text, change_note=…, timestamp=…) - added:
constructor RevisionedPage() - added:
function new_db_session() - added:
method Revision.render() - added:
property Page.title - added:
variable metadata - added:
variable page_table - added:
variable revision_table - added:
variable session
- added:
function page_index(request) - added:
function page_not_found(request, page_name) - added:
function recent_changes(request) - added:
variable pages
- added:
class Pagination(object) - added:
class Request(BaseRequest) - added:
class Response(BaseResponse) - added:
constructor Pagination(query, per_page, page, link) - added:
constructor Response(response=…, status=…, headers=…, mimetype=…, content_type=…) - added:
field Response.default_mimetype - added:
function format_datetime(obj) - added:
function generate_template(template_name, **context) - added:
function href(*args, **kw) - added:
function parse_creole(markup) - added:
method Request.bind_to_context() - added:
property Pagination.count - added:
property Pagination.entries - added:
property Pagination.has_next - added:
property Pagination.has_previous - added:
property Pagination.next - added:
property Pagination.pages - added:
property Pagination.previous - added:
variable TEMPLATE_PATH - added:
variable application - added:
variable creole_parser - added:
variable local - added:
variable local_manager - added:
variable request - added:
variable template_loader
- changed:
constructor FeedEntry(title=…, content=…, **kwargs) → constructor FeedEntry(title=…, content=…, feed_url=…, **kwargs)
- added:
method BaseCache.dec(key, delta=…) - added:
method BaseCache.inc(key, delta=…) - added:
method MemcachedCache.dec(key, delta=…) - added:
method MemcachedCache.get_dict(*keys) - added:
method MemcachedCache.inc(key, delta=…) - added:
variable is_cmemcache
- changed:
class Request(BaseRequest) → class Request(RequestBase) - changed:
class Response(BaseResponse) → class Response(ResponseBase)
- removed:
method SecureCookie.new_salt(secret_key)
- added:
class DebuggedApplication(object) - added:
constructor DebuggedApplication(app, evalex=…, request_key=…, console_path=…, console_init_func=…, show_hidden_frames=…) - added:
export Console - added:
export Request - added:
export Response - added:
export debug_repr - added:
export get_current_traceback - added:
export render_template - added:
method DebuggedApplication.debug_application(environ, start_response) - added:
method DebuggedApplication.display_console(request) - added:
method DebuggedApplication.execute_command(request, command, frame) - added:
method DebuggedApplication.get_resource(request, filename) - added:
method DebuggedApplication.get_source(request, frame) - added:
method DebuggedApplication.paste_traceback(request, traceback)
- added:
class DebugReprGenerator(object) - added:
constructor DebugReprGenerator() - added:
field DebugReprGenerator.deque_repr - added:
field DebugReprGenerator.frozenset_repr - added:
field DebugReprGenerator.list_repr - added:
field DebugReprGenerator.set_repr - added:
field DebugReprGenerator.tuple_repr - added:
function debug_repr(obj) - added:
function dump(obj=…) - added:
method DebugReprGenerator.dict_repr(d, recursive, limit=…) - added:
method DebugReprGenerator.dispatch_repr(obj, recursive) - added:
method DebugReprGenerator.dump_locals(d) - added:
method DebugReprGenerator.dump_object(obj) - added:
method DebugReprGenerator.fallback_repr() - added:
method DebugReprGenerator.object_repr(obj) - added:
method DebugReprGenerator.regex_repr(obj) - added:
method DebugReprGenerator.repr(obj) - added:
method DebugReprGenerator.string_repr(obj, limit=…) - added:
variable RegexType - added:
variable deque - added:
variable helper - added:
variable missing
- added:
function get_template(filename) - added:
function render_template(template_filename, **context)
- removed:
class Aborter(object) - removed:
class BadGateway(HTTPException) - removed:
class BadRequest(HTTPException) - removed:
class Forbidden(HTTPException) - removed:
class Gone(HTTPException) - removed:
class InternalServerError(HTTPException) - removed:
class LengthRequired(HTTPException) - removed:
class MethodNotAllowed(HTTPException) - removed:
class NotAcceptable(HTTPException) - removed:
class NotFound(HTTPException) - removed:
class NotImplemented(HTTPException) - removed:
class PreconditionFailed(HTTPException) - removed:
class RequestEntityTooLarge(HTTPException) - removed:
class RequestTimeout(HTTPException) - removed:
class RequestURITooLarge(HTTPException) - removed:
class ServiceUnavailable(HTTPException) - removed:
class Unauthorized(HTTPException) - removed:
class UnsupportedMediaType(HTTPException) - removed:
constructor Aborter(mapping=…, extra=…) - removed:
constructor MethodNotAllowed(valid_methods=…, description=…) - removed:
field BadGateway.code - removed:
field BadGateway.description - removed:
field BadRequest.code - removed:
field BadRequest.description - removed:
field Forbidden.code - removed:
field Forbidden.description - removed:
field Gone.code - removed:
field Gone.description - removed:
field InternalServerError.code - removed:
field InternalServerError.description - removed:
field LengthRequired.code - removed:
field LengthRequired.description - removed:
field MethodNotAllowed.code - removed:
field NotAcceptable.code - removed:
field NotAcceptable.description - removed:
field NotFound.code - removed:
field NotFound.description - removed:
field NotImplemented.code - removed:
field NotImplemented.description - removed:
field PreconditionFailed.code - removed:
field PreconditionFailed.description - removed:
field RequestEntityTooLarge.code - removed:
field RequestEntityTooLarge.description - removed:
field RequestTimeout.code - removed:
field RequestTimeout.description - removed:
field RequestURITooLarge.code - removed:
field RequestURITooLarge.description - removed:
field ServiceUnavailable.code - removed:
field ServiceUnavailable.description - removed:
field Unauthorized.code - removed:
field Unauthorized.description - removed:
field UnsupportedMediaType.code - removed:
field UnsupportedMediaType.description - removed:
method MethodNotAllowed.get_description(environ) - removed:
method MethodNotAllowed.get_headers(environ) - removed:
variable abort - removed:
variable default_exceptions - added:
field HTTPException.wrap - added:
method HTTPException.wrap(exception, name=…)
- removed:
field CacheControl.clear - removed:
field CacheControl.pop - removed:
field CacheControl.popitem - removed:
field CacheControl.setdefault - removed:
field CacheControl.update - removed:
method CacheControl.calls_update() - removed:
variable HTTP_STATUS_CODES - changed:
class CacheControl(dict) → class CacheControl(_UpdateDict) - added:
class Authorization(dict) - added:
class WWWAuthenticate(_UpdateDict) - added:
constructor Authorization(auth_type, data=…) - added:
constructor WWWAuthenticate(auth_type=…, values=…, on_update=…) - added:
field Authorization.cnonce - added:
field Authorization.nc - added:
field Authorization.nonce - added:
field Authorization.opaque - added:
field Authorization.password - added:
field Authorization.qop - added:
field Authorization.realm - added:
field Authorization.response - added:
field Authorization.uri - added:
field Authorization.username - added:
field WWWAuthenticate.algorithm - added:
field WWWAuthenticate.auth_property - added:
field WWWAuthenticate.domain - added:
field WWWAuthenticate.nonce - added:
field WWWAuthenticate.opaque - added:
field WWWAuthenticate.qop - added:
field WWWAuthenticate.realm - added:
field WWWAuthenticate.stale - added:
field WWWAuthenticate.type - added:
function dump_header(iterable, allow_token=…) - added:
function parse_authorization_header(value) - added:
function parse_dict_header(value) - added:
function parse_list_header(value) - added:
function parse_www_authenticate_header(value, on_update=…) - added:
function quote_header_value(value, extra_chars=…, allow_token=…) - added:
method Authorization.qop() - added:
method WWWAuthenticate.auth_property(doc=…) - added:
method WWWAuthenticate.set_basic(realm=…) - added:
method WWWAuthenticate.set_digest(realm, nonce, qop=…, opaque=…, algorithm=…, stale=…) - added:
method WWWAuthenticate.to_header()
- changed:
constructor Rule(string, defaults=…, subdomain=…, methods=…, build_only=…, endpoint=…, strict_slashes=…) → constructor Rule(string, defaults=…, subdomain=…, methods=…, build_only=…, endpoint=…, strict_slashes=…, redirect_to=…)
- changed:
function run_simple(hostname, port, application, use_reloader=…, extra_files=…, reloader_interval=…, threaded=…, processes=…, request_handler=…) → function run_simple(hostname, port, application, use_reloader=…, use_debugger=…, use_evalex=…, extra_files=…, reloader_interval=…, threaded=…, processes=…, request_handler=…)
- removed:
class BaseReporterStream(BaseReporterStream) - removed:
class BaseReporterStream(object) - removed:
constructor BaseReporterStream(environ, threshold) - removed:
field BaseResponse.response_body - removed:
method BaseResponse.write(data) - removed:
method BaseResponse.writelines(lines) - changed:
class Request(BaseRequest, AcceptMixin, ETagRequestMixin, UserAgentMixin) → class Request(BaseRequest, AcceptMixin, ETagRequestMixin, UserAgentMixin, AuthorizationMixin) - changed:
class Response(BaseResponse, ETagResponseMixin, ResponseStreamMixin, CommonResponseDescriptorsMixin) → class Response(BaseResponse, ETagResponseMixin, ResponseStreamMixin, CommonResponseDescriptorsMixin, WWWAuthenticateMixin) - changed:
constructor BaseRequest(environ, populate_request=…) → constructor BaseRequest(environ, populate_request=…, shallow=…) - added:
class AuthorizationMixin(object) - added:
class WWWAuthenticateMixin(object) - added:
field AuthorizationMixin.authorization - added:
field BaseRequest.application - added:
field BaseRequest.encoding_errors - added:
field BaseRequest.remote_user - added:
field WWWAuthenticateMixin.www_authenticate - added:
method AuthorizationMixin.authorization() - added:
method BaseRequest.application(f) - added:
method WWWAuthenticateMixin.www_authenticate()