Upgrading Werkzeug 0.7 to 0.8
Breaking0.7.2 → 0.8.3Breaking2Security2Platform1New6Changed10Fixed13Other1
BreakingUpgrade verdict
2 breaking changes and a platform requirement change and 2 security fixes.
In plain terms
- When a required form field is missing, you now get one general error type instead of different error types per data structure.
- wsgi.make_line_iter now requires a limit not higher than the length the stream can provide.
- This version no longer works on Python 2.4, so users on that version must upgrade Python.
- Redirects to untrusted URLs could be abused to run malicious scripts; this is now fixed.
Must act 5 items need code or config changes
What you must change
Breaking2
Removes data structure specific KeyErrors in favor of a general purpose BadRequestKeyError.
BadRequestKeyErrorwsgi.make_line_iter now requires a limit not higher than the length the stream can provide.
wsgi.make_line_iterSecurity2
Fixes an XSS problem with redirect targets coming from untrusted sources.
Headers datastructure no longer allows newlines in values to avoid header injection attacks.
Platform1
Removes support for Python 2.4.