RedHatTraining/pyramid.git

Merge branch 'master' of github.com:Pylons/pyramid

Chris McDonough

2013-06-20 56511b0defbc4437a1e1d3b013c504886270d01b

commit \| author \| age
2d9314	1	next release
MM	2	============
	3
	4	Features
	5	--------
	6
9e6c8c	7	- ``scripts/prequest.py``: add support for submitting ``PUT`` and ``PATCH``
f0f92b	8	requests. See https://github.com/Pylons/pyramid/pull/1033.
TS	9
2d9314	10	- ``ACLAuthorizationPolicy`` supports ``__acl__`` as a callable. This
MM	11	removes the ambiguity between the potential ``AttributeError`` that would
	12	be raised on the ``context`` when the property was not defined and the
	13	``AttributeError`` that could be raised from any user-defined code within
	14	a dynamic property. It is recommended to define a dynamic ACL as a callable
	15	to avoid this ambiguity. See https://github.com/Pylons/pyramid/issues/735.
	16
ff41f8	17	- Allow a protocol-relative URL (e.g. ``//example.com/images``) to be passed to
WS	18	``pyramid.config.Configurator.add_static_view``. This allows
	19	externally-hosted static URLs to be generated based on the current protocol.
	20
23a7c6	21	- The ``AuthTktAuthenticationPolicy`` now supports IPv6 addresses when using
MM	22	the ``include_ip=True`` option. This is possibly incompatible with
	23	alternative ``auth_tkt`` implementations, as the specification does not
	24	define how to properly handle IPv6. See
	25	https://github.com/Pylons/pyramid/issues/831.
	26
38844f	27	- Make it possible to use variable arguments via
MM	28	``pyramid.paster.get_appsettings``. This also allowed the generated
	29	``initialize_db`` script from the ``alchemy`` scaffold to grow support
	30	for options in the form ``a=1 b=2`` so you can fill in
	31	values in a parameterized ``.ini`` file, e.g.
	32	``initialize_myapp_db etc/development.ini a=1 b=2``.
	33	See https://github.com/Pylons/pyramid/pull/911
	34
fab845	35	- The ``request.session.check_csrf_token()`` method and the ``check_csrf`` view
CM	36	predicate now take into account the value of the HTTP header named
	37	``X-CSRF-Token`` (as well as the ``csrf_token`` form parameter, which they
	38	always did). The header is tried when the form parameter does not exist.
	39
9e1e6d	40	Bug Fixes
AL	41	---------
	42
d4495e	43	- Make the ``pyramid.config.assets.PackageOverrides`` object implement the API
CM	44	for ``__loader__`` objects specified in PEP 302. Proxies to the
	45	``__loader__`` set by the importer, if present; otherwise, raises
	46	``NotImplementedError``. This makes Pyramid static view overrides work
	47	properly under Python 3.3 (previously they would not). See
	48	https://github.com/Pylons/pyramid/pull/1015 for more information.
	49
0fdb54	50	- ``mako_templating``: added defensive workaround for non-importability of
CM	51	``mako`` due to upstream ``markupsafe`` dropping Python 3.2 support. Mako
	52	templating will no longer work under the combination of MarkupSafe 0.17 and
	53	Python 3.2 (although the combination of MarkupSafe 0.17 and Python 3.3 or any
	54	supported Python 2 version will work OK).
45ef9a	55
b6a4d4	56	- View lookup will now search for valid views based on the inheritance
MM	57	hierarchy of the context. It tries to find views based on the most
	58	specific context first, and upon predicate failure, will move up the
	59	inheritance chain to test views found by the super-type of the context.
	60	In the past, only the most specific type containing views would be checked
	61	and if no matching view could be found then a PredicateMismatch would be
	62	raised. Now predicate mismatches don't hide valid views registered on
	63	super-types. Here's an example that now works::
9e1e6d	64
b6a4d4	65	.. code-block:: python
9e1e6d	66
b6a4d4	67	class IResource(Interface):
07c189	68
b6a4d4	69	...
9e1e6d	70
b6a4d4	71	@view_config(context=IResource)
MM	72	def get(context, request):
07c189	73
b6a4d4	74	...
9e1e6d	75
b6a4d4	76	@view_config(context=IResource, request_method='POST')
MM	77	def post(context, request):
07c189	78
b6a4d4	79	...
9e1e6d	80
b6a4d4	81	@view_config(context=IResource, request_method='DELETE')
MM	82	def delete(context, request):
07c189	83
b6a4d4	84	...
9e1e6d	85
b6a4d4	86	@implementor(IResource)
MM	87	class MyResource:
07c189	88
b6a4d4	89	...
MM	90
	91	@view_config(context=MyResource, request_method='POST')
	92	def override_post(context, request):
07c189	93
b6a4d4	94	...
9e1e6d	95
AL	96	Previously the override_post view registration would hide the get
	97	and delete views in the context of MyResource -- leading to a
	98	predicate mismatch error when trying to use GET or DELETE
	99	methods. Now the views are found and no predicate mismatch is
	100	raised.
3ae878	101	See https://github.com/Pylons/pyramid/pull/786
9e1e6d	102
ea278e	103	- Spaces and dots may now be in mako renderer template paths. This was
MM	104	broken when support for the new makodef syntax was added in 1.4a1.
	105	See https://github.com/Pylons/pyramid/issues/950
	106
20c57e	107	- ``pyramid.debug_authorization=true`` will now correctly print out
MM	108	``Allowed`` for views registered with ``NO_PERMISSION_REQUIRED`` instead
	109	of invoking the ``permits`` method of the authorization policy.
	110	See https://github.com/Pylons/pyramid/issues/954
	111
c35b29	112	- Pyramid failed to install on some systems due to being packaged with
MM	113	some test files containing higher order characters in their names. These
	114	files have now been removed. See
	115	https://github.com/Pylons/pyramid/issues/981
	116
050b71	117	- ``pyramid.testing.DummyResource`` didn't define ``__bool__``, so code under
CM	118	Python 3 would use ``__len__`` to find truthiness; this usually caused an
	119	instance of DummyResource to be "falsy" instead of "truthy". See
	120	https://github.com/Pylons/pyramid/pull/1032
	121
96ab9f	122	1.4 (2012-12-18)
CM	123	================
758fa2	124
CM	125	Docs
	126	----
	127
	128	- Fix functional tests in the ZODB tutorial
	129
e609e1	130	1.4b3 (2012-12-10)
CM	131	==================
	132
	133	- Packaging release only, no code changes. 1.4b2 was a brownbag release due to
	134	missing directories in the tarball.
	135
a7e0e6	136	1.4b2 (2012-12-10)
CM	137	==================
	138
	139	Docs
	140	----
	141
	142	- Scaffolding is now PEP-8 compliant (at least for a brief shining moment).
	143
	144	- Tutorial improvements.
ed1419	145
MM	146	Backwards Incompatibilities
	147	---------------------------
	148
	149	- Modified the ``_depth`` argument to ``pyramid.view.view_config`` to accept
	150	a value relative to the invocation of ``view_config`` itself. Thus, when it
	151	was previously expecting a value of ``1`` or greater, to reflect that
	152	the caller of ``view_config`` is 1 stack frame away from ``venusian.attach``,
	153	this implementation detail is now hidden.
	154
a078e1	155	- Modified the ``_backframes`` argument to ``pyramid.util.action_method`` in a
CM	156	similar way to the changes described to ``_depth`` above. This argument
	157	remains undocumented, but might be used in the wild by some insane person.
	158
1608b2	159	1.4b1 (2012-11-21)
CM	160	==================
0ccdc2	161
71cd93	162	Features
CM	163	--------
	164
	165	- Small microspeed enhancement which anticipates that a
	166	``pyramid.response.Response`` object is likely to be returned from a view.
	167	Some code is shortcut if the class of the object returned by a view is this
	168	class. A similar microoptimization was done to
	169	``pyramid.request.Request.is_response``.
	170
9132f6	171	- Make it possible to use variable arguments on ``p*`` commands (``pserve``,
CM	172	``pshell``, ``pviews``, etc) in the form ``a=1 b=2`` so you can fill in
	173	values in parameterized ``.ini`` file, e.g. ``pshell etc/development.ini
6ba0fc	174	http_port=8080``. See https://github.com/Pylons/pyramid/pull/714
9132f6	175
f700d3	176	- A somewhat advanced and obscure feature of Pyramid event handlers is their
CM	177	ability to handle "multi-interface" notifications. These notifications have
	178	traditionally presented multiple objects to the subscriber callable. For
	179	instance, if an event was sent by code like this::
28fc3d	180
CM	181	registry.notify(event, context)
	182
	183	In the past, in order to catch such an event, you were obligated to write and
	184	register an event subscriber that mentioned both the event and the context in
	185	its argument list::
	186
	187	@subscriber([SomeEvent, SomeContextType])
f700d3	188	def asubscriber(event, context):
28fc3d	189	pass
CM	190
f700d3	191	In many subscriber callables registered this way, it was common for the logic
CM	192	in the subscriber callable to completely ignore the second and following
	193	arguments (e.g. ``context`` in the above example might be ignored), because
	194	they usually existed as attributes of the event anyway. You could usually
a3810e	195	get the same value by doing ``event.context`` or similar.
f700d3	196
CM	197	The fact that you needed to put an extra argument which you usually ignored
	198	in the subscriber callable body was only a minor annoyance until we added
a3810e	199	"subscriber predicates", used to narrow the set of circumstances under which
CM	200	a subscriber will be executed, in a prior 1.4 alpha release. Once those were
	201	added, the annoyance was escalated, because subscriber predicates needed to
	202	accept the same argument list and arity as the subscriber callables that they
	203	were configured against. So, for example, if you had these two subscriber
	204	registrations in your code::
28fc3d	205
CM	206	@subscriber([SomeEvent, SomeContextType])
f700d3	207	def asubscriber(event, context):
CM	208	pass
	209
	210	@subscriber(SomeOtherEvent)
	211	def asubscriber(event):
	212	pass
	213
	214	And you wanted to use a subscriber predicate::
	215
	216	@subscriber([SomeEvent, SomeContextType], mypredicate=True)
a3810e	217	def asubscriber1(event, context):
f700d3	218	pass
CM	219
	220	@subscriber(SomeOtherEvent, mypredicate=True)
a3810e	221	def asubscriber2(event):
f700d3	222	pass
CM	223
a3810e	224	If an existing ``mypredicate`` subscriber predicate had been written in such
CM	225	a way that it accepted only one argument in its ``__call__``, you could not
	226	use it against a subscription which named more than one interface in its
	227	subscriber interface list. Similarly, if you had written a subscriber
	228	predicate that accepted two arguments, you couldn't use it against a
	229	registration that named only a single interface type.
	230
	231	For example, if you created this predicate::
f700d3	232
CM	233	class MyPredicate(object):
	234	# portions elided...
	235	def __call__(self, event):
	236	return self.val == event.context.foo
	237
a3810e	238	It would not work against a multi-interface-registered subscription, so in
CM	239	the above example, when you attempted to use it against ``asubscriber1``, it
	240	would fail at runtime with a TypeError, claiming something was attempting to
	241	call it with too many arguments.
f700d3	242
a3810e	243	To hack around this limitation, you were obligated to design the
CM	244	``mypredicate`` predicate to expect to receive in its ``__call__`` either a
	245	single ``event`` argument (a SomeOtherEvent object) or a pair of arguments
	246	(a SomeEvent object and a SomeContextType object), presumably by doing
	247	something like this::
f700d3	248
CM	249	class MyPredicate(object):
	250	# portions elided...
	251	def __call__(self, event, context=None):
	252	return self.val == event.context.foo
	253
	254	This was confusing and bad.
	255
	256	In order to allow people to ignore unused arguments to subscriber callables
	257	and to normalize the relationship between event subscribers and subscriber
	258	predicates, we now allow both subscribers and subscriber predicates to accept
	259	only a single ``event`` argument even if they've been subscribed for
	260	notifications that involve multiple interfaces. Subscribers and subscriber
	261	predicates that accept only one argument will receive the first object passed
	262	to ``notify``; this is typically (but not always) the event object. The
	263	other objects involved in the subscription lookup will be discarded. You can
	264	now write an event subscriber that accepts only ``event`` even if it
	265	subscribes to multiple interfaces::
	266
	267	@subscriber([SomeEvent, SomeContextType])
	268	def asubscriber(event):
28fc3d	269	# this will work!
CM	270
f700d3	271	This prevents you from needing to match the subscriber callable parameters to
CM	272	the subscription type unnecessarily, especially when you don't make use of
	273	any argument in your subscribers except for the event object itself.
	274
	275	Note, however, that if the event object is not the first
	276	object in the call to ``notify``, you'll run into trouble. For example, if
	277	notify is called with the context argument first::
28fc3d	278
CM	279	registry.notify(context, event)
	280
f700d3	281	You won't be able to take advantage of the event-only feature. It will
CM	282	"work", but the object received by your event handler won't be the event
	283	object, it will be the context object, which won't be very useful::
28fc3d	284
CM	285	@subscriber([SomeContextType, SomeEvent])
f700d3	286	def asubscriber(event):
28fc3d	287	# bzzt! you'll be getting the context here as ``event``, and it'll
CM	288	# be useless
	289
	290	Existing multiple-argument subscribers continue to work without issue, so you
	291	should continue use those if your system notifies using multiple interfaces
	292	and the first interface is not the event interface. For example::
	293
	294	@subscriber([SomeContextType, SomeEvent])
f700d3	295	def asubscriber(context, event):
28fc3d	296	# this will still work!
CM	297
	298	The event-only feature makes it possible to use a subscriber predicate that
	299	accepts only a request argument within both multiple-interface subscriber
f700d3	300	registrations and single-interface subscriber registrations. You needn't
CM	301	make slightly different variations of predicates depending on the
	302	subscription type arguments. Instead, just write all your subscriber
	303	predicates so they only accept ``event`` in their ``__call__`` and they'll be
	304	useful across all registrations for subscriptions that use an event as their
	305	first argument, even ones which accept more than just ``event``.
28fc3d	306
f700d3	307	However, the same caveat applies to predicates as to subscriber callables: if
CM	308	you're subscribing to a multi-interface event, and the first interface is not
	309	the event interface, the predicate won't work properly. In such a case,
	310	you'll need to match the predicate ``__call__`` argument ordering and
	311	composition to the ordering of the interfaces. For example, if the
	312	registration for the subscription uses ``[SomeContext, SomeEvent]``, you'll
	313	need to reflect that in the ordering of the parameters of the predicate's
	314	``__call__`` method::
28fc3d	315
CM	316	def __call__(self, context, event):
	317	return event.request.path.startswith(self.val)
	318
f700d3	319	tl;dr: 1) When using multi-interface subscriptions, always use the event type
CM	320	as the first subscription registration argument and 2) When 1 is true, use
	321	only ``event`` in your subscriber and subscriber predicate parameter lists,
	322	no matter how many interfaces the subscriber is notified with. This
	323	combination will result in the maximum amount of reusability of subscriber
	324	predicates and the least amount of thought on your part. Drink responsibly.
28fc3d	325
0ccdc2	326	Bug Fixes
CM	327	---------
	328
	329	- A failure when trying to locate the attribute ``__text__`` on route and view
	330	predicates existed when the ``debug_routematch`` setting was true or when the
	331	``pviews`` command was used. See https://github.com/Pylons/pyramid/pull/727
	332
b5e444	333	Documentation
CM	334	-------------
	335
	336	- Sync up tutorial source files with the files that are rendered by the
	337	scaffold that each uses.
	338
948068	339	1.4a4 (2012-11-14)
CM	340	==================
c7337b	341
CM	342	Features
	343	--------
	344
19b820	345	- ``pyramid.authentication.AuthTktAuthenticationPolicy`` has been updated to
MM	346	support newer hashing algorithms such as ``sha512``. Existing applications
39ef68	347	should consider updating if possible for improved security over the default
CM	348	md5 hashing.
19b820	349
c7337b	350	- Added an ``effective_principals`` route and view predicate.
CM	351
07c9ee	352	- Do not allow the userid returned from the ``authenticated_userid`` or the
CM	353	userid that is one of the list of principals returned by
	354	``effective_principals`` to be either of the strings ``system.Everyone`` or
	355	``system.Authenticated`` when any of the built-in authorization policies that
	356	live in ``pyramid.authentication`` are in use. These two strings are
	357	reserved for internal usage by Pyramid and they will not be accepted as valid
	358	userids.
	359
ca4656	360	- Slightly better debug logging from
MM	361	``pyramid.authentication.RepozeWho1AuthenticationPolicy``.
47146e	362
39ef68	363	- ``pyramid.security.view_execution_permitted`` used to return ``True`` if no
926fb6	364	view could be found. It now raises a ``TypeError`` exception in that case, as
CM	365	it doesn't make sense to assert that a nonexistent view is
	366	execution-permitted. See https://github.com/Pylons/pyramid/issues/299.
cb745b	367
a8d71c	368	- Allow a ``_depth`` argument to ``pyramid.view.view_config``, which will
CM	369	permit limited composition reuse of the decorator by other software that
	370	wants to provide custom decorators that are much like view_config.
	371
170124	372	- Allow an iterable of decorators to be passed to
MM	373	``pyramid.config.Configurator.add_view``. This allows views to be wrapped
	374	by more than one decorator without requiring combining the decorators
	375	yourself.
	376
a007a4	377	Bug Fixes
CM	378	---------
	379
	380	- In the past if a renderer returned ``None``, the body of the resulting
	381	response would be set explicitly to the empty string. Instead, now, the body
	382	is left unchanged, which allows the renderer to set a body itself by using
	383	e.g. ``request.response.body = b'foo'``. The body set by the renderer will
	384	be unmolested on the way out. See
	385	https://github.com/Pylons/pyramid/issues/709
	386
34d4cd	387	- In uncommon cases, the ``pyramid_excview_tween_factory`` might have
CM	388	inadvertently raised a ``KeyError`` looking for ``request_iface`` as an
	389	attribute of the request. It no longer fails in this case. See
	390	https://github.com/Pylons/pyramid/issues/700
048754	391
267dbd	392	- Be more tolerant of potential error conditions in ``match_param`` and
CM	393	``physical_path`` predicate implementations; instead of raising an exception,
	394	return False.
	395
39ef68	396	- ``pyramid.view.render_view`` was not functioning properly under Python 3.x
CM	397	due to a byte/unicode discrepancy. See
cd8ac8	398	https://github.com/Pylons/pyramid/issues/721
f89cfc	399
ca3df8	400	Deprecations
MM	401	------------
	402
39ef68	403	- ``pyramid.authentication.AuthTktAuthenticationPolicy`` will emit a warning if
CM	404	an application is using the policy without explicitly passing a ``hashalg``
	405	argument. This is because the default is "md5" which is considered
	406	theoretically subject to collision attacks. If you really want "md5" then you
	407	must specify it explicitly to get rid of the warning.
	408
	409	Documentation
	410	-------------
	411
	412	- All of the tutorials that use
	413	``pyramid.authentication.AuthTktAuthenticationPolicy`` now explicitly pass
	414	``sha512`` as a ``hashalg`` argument.
	415
ca3df8	416
66fe1d	417	Internals
CM	418	---------
	419
	420	- Move ``TopologicalSorter`` from ``pyramid.config.util`` to ``pyramid.util``,
	421	move ``CyclicDependencyError`` from ``pyramid.config.util`` to
	422	``pyramid.exceptions``, rename ``Singleton`` to ``Sentinel`` and move from
ca4656	423	``pyramid.config.util`` to ``pyramid.util``; this is in an effort to
048754	424	move that stuff that may be an API one day out of ``pyramid.config.util``,
66fe1d	425	because that package should never be imported from non-Pyramid code.
CM	426	TopologicalSorter is still not an API, but may become one.
	427
39ef68	428	- Get rid of shady monkeypatching of ``pyramid.request.Request`` and
CM	429	``pyramid.response.Response`` done within the ``__init__.py`` of Pyramid.
	430	Webob no longer relies on this being done. Instead, the ResponseClass
	431	attribute of the Pyramid Request class is assigned to the Pyramid response
	432	class; that's enough to satisfy WebOb and behave as it did before with the
	433	monkeypatching.
	434
4a6cca	435	1.4a3 (2012-10-26)
CM	436	==================
d6fb00	437
CM	438	Bug Fixes
	439	---------
	440
06a904	441	- The match_param predicate's text method was fixed to sort its values.
CM	442	Part of https://github.com/Pylons/pyramid/pull/705
	443
d6fb00	444	- 1.4a ``pyramid.scripting.prepare`` behaved differently than 1.3 series
CM	445	function of same name. In particular, if passed a request, it would not
	446	set the ``registry`` attribute of the request like 1.3 did. A symptom
	447	would be that passing a request to ``pyramid.paster.bootstrap`` (which uses
	448	the function) that did not have a ``registry`` attribute could assume that
	449	the registry would be attached to the request by Pyramid. This assumption
	450	could be made in 1.3, but not in 1.4. The assumption can now be made in
	451	1.4 too (a registry is attached to a request passed to bootstrap or
	452	prepare).
	453
66d277	454	- When registering a view configuration that named a Chameleon ZPT renderer
CM	455	with a macro name in it (e.g. ``renderer='some/template#somemacro.pt``) as
043ccd	456	well as a view configuration without a macro name in it that pointed to the
9937a4	457	same template (e.g. ``renderer='some/template.pt'``), internal caching could
66d277	458	confuse the two, and your code might have rendered one instead of the
CM	459	other.
	460
1273d5	461	Features
CM	462	--------
	463
c25a8f	464	- Allow multiple values to be specified to the ``request_param`` view/route
CM	465	predicate as a sequence. Previously only a single string value was allowed.
	466	See https://github.com/Pylons/pyramid/pull/705
	467
	468	- Comments with references to documentation sections placed in scaffold
	469	``.ini`` files.
	470
	471	- Added an HTTP Basic authentication policy
	472	at ``pyramid.authentication.BasicAuthAuthenticationPolicy``.
	473
1273d5	474	- The Configurator ``testing_securitypolicy`` method now returns the policy
CM	475	object it creates.
	476
	477	- The Configurator ``testing_securitypolicy`` method accepts two new
	478	arguments: ``remember_result`` and ``forget_result``. If supplied, these
	479	values influence the result of the policy's ``remember`` and ``forget``
	480	methods, respectively.
	481
	482	- The DummySecurityPolicy created by ``testing_securitypolicy`` now sets a
	483	``forgotten`` value on the policy (the value ``True``) when its ``forget``
	484	method is called.
	485
	486	- The DummySecurityPolicy created by ``testing_securitypolicy`` now sets a
	487	``remembered`` value on the policy, which is the value of the ``principal``
	488	argument it's called with when its ``remember`` method is called.
	489
c25a8f	490	- New ``physical_path`` view predicate. If specified, this value should be a
CM	491	string or a tuple representing the physical traversal path of the context
	492	found via traversal for this predicate to match as true. For example:
	493	``physical_path='/'`` or ``physical_path='/a/b/c'`` or ``physical_path=('',
	494	'a', 'b', 'c')``. This is not a path prefix match or a regex, it's a
	495	whole-path match. It's useful when you want to always potentially show a
	496	view when some object is traversed to, but you can't be sure about what kind
	497	of object it will be, so you can't use the ``context`` predicate. The
	498	individual path elements inbetween slash characters or in tuple elements
	499	should be the Unicode representation of the name of the resource and should
	500	not be encoded in any way.
	501
072cbf	502	1.4a2 (2012-09-27)
CM	503	==================
68c25d	504
d27bc7	505	Bug Fixes
CM	506	---------
	507
4388d3	508	- When trying to determine Mako defnames and Chameleon macro names in asset
CM	509	specifications, take into account that the filename may have a hyphen in
	510	it. See https://github.com/Pylons/pyramid/pull/692
d27bc7	511
68c25d	512	Features
CM	513	--------
	514
	515	- A new ``pyramid.session.check_csrf_token`` convenience function was added.
	516
80cd0b	517	- A ``check_csrf`` view predicate was added. For example, you can now do
CM	518	``config.add_view(someview, check_csrf=True)``. When the predicate is
	519	checked, if the ``csrf_token`` value in ``request.params`` matches the CSRF
	520	token in the request's session, the view will be permitted to execute.
	521	Otherwise, it will not be permitted to execute.
68c25d	522
098599	523	- Add ``Base.metadata.bind = engine`` to alchemy template, so that tables
CM	524	defined imperatively will work.
	525
	526	Documentation
	527	-------------
	528
	529	- update wiki2 SQLA tutorial with the changes required after inserting
	530	``Base.metadata.bind = engine`` into the alchemy scaffold.
	531
ce1e86	532	1.4a1 (2012-09-16)
CM	533	==================
f6bd88	534
a39dd2	535	Bug Fixes
CM	536	---------
	537
1794b4	538	- Forward port from 1.3 branch: When no authentication policy was configured,
CM	539	a call to ``pyramid.security.effective_principals`` would unconditionally
	540	return the empty list. This was incorrect, it should have unconditionally
	541	returned ``[Everyone]``, and now does.
8782de	542
3074e7	543	- Explicit url dispatch regexes can now contain colons.
CM	544	https://github.com/Pylons/pyramid/issues/629
	545
e65251	546	- On at least one 64-bit Ubuntu system under Python 3.2, using the
CM	547	``view_config`` decorator caused a ``RuntimeError: dictionary changed size
	548	during iteration`` exception. It no longer does. See
	549	https://github.com/Pylons/pyramid/issues/635 for more information.
	550
8b2675	551	- In Mako Templates lookup, check if the uri is already adjusted and bring
BL	552	it back to an asset spec. Normally occurs with inherited templates or
	553	included components.
	554	https://github.com/Pylons/pyramid/issues/606
	555	https://github.com/Pylons/pyramid/issues/607
	556
7853bc	557	- In Mako Templates lookup, check for absolute uri (using mako directories)
BL	558	when mixing up inheritance with asset specs.
	559	https://github.com/Pylons/pyramid/issues/662
	560
75a8ff	561	- HTTP Accept headers were not being normalized causing potentially
MM	562	conflicting view registrations to go unnoticed. Two views that only
	563	differ in the case ('text/html' vs. 'text/HTML') will now raise an error.
	564	https://github.com/Pylons/pyramid/pull/620
	565
a9289d	566	- Forward-port from 1.3 branch: when registering multiple views with an
CM	567	``accept`` predicate in a Pyramid application runing under Python 3, you
	568	might have received a ``TypeError: unorderable types: function() <
	569	function()`` exception.
	570
de797c	571	Features
CM	572	--------
a39dd2	573
d24659	574	- Configurator.add_directive now accepts arbitrary callables like partials or
CM	575	objects implementing ``__call__`` which dont have ``__name__`` and
	576	``__doc__`` attributes. See https://github.com/Pylons/pyramid/issues/621
	577	and https://github.com/Pylons/pyramid/pull/647.
	578
95f766	579	- Third-party custom view, route, and subscriber predicates can now be added
CM	580	for use by view authors via
	581	``pyramid.config.Configurator.add_view_predicate``,
	582	``pyramid.config.Configurator.add_route_predicate`` and
	583	``pyramid.config.Configurator.add_subscriber_predicate``. So, for example,
0196b2	584	doing this::
CM	585
	586	config.add_view_predicate('abc', my.package.ABCPredicate)
	587
	588	Might allow a view author to do this in an application that configured that
	589	predicate::
	590
	591	@view_config(abc=1)
	592
95f766	593	Similar features exist for ``add_route``, and ``add_subscriber``. See
CM	594	"Adding A Third Party View, Route, or Subscriber Predicate" in the Hooks
	595	chapter for more information.
0196b2	596
735abf	597	Note that changes made to support the above feature now means that only
CM	598	actions registered using the same "order" can conflict with one another.
	599	It used to be the case that actions registered at different orders could
	600	potentially conflict, but to my knowledge nothing ever depended on this
	601	behavior (it was a bit silly).
	602
de797c	603	- Custom objects can be made easily JSON-serializable in Pyramid by defining
CM	604	a ``__json__`` method on the object's class. This method should return
	605	values natively serializable by ``json.dumps`` (such as ints, lists,
	606	dictionaries, strings, and so forth).
077fa3	607
e012aa	608	- The JSON renderer now allows for the definition of custom type adapters to
CM	609	convert unknown objects to JSON serializations.
	610
360f25	611	- As of this release, the ``request_method`` predicate, when used, will also
CM	612	imply that ``HEAD`` is implied when you use ``GET``. For example, using
	613	``@view_config(request_method='GET')`` is equivalent to using
561a44	614	``@view_config(request_method=('GET', 'HEAD'))``. Using
360f25	615	``@view_config(request_method=('GET', 'POST')`` is equivalent to using
CM	616	``@view_config(request_method=('GET', 'HEAD', 'POST')``. This is because
	617	HEAD is a variant of GET that omits the body, and WebOb has special support
	618	to return an empty body when a HEAD is used.
15c40a	619
023c88	620	- ``config.add_request_method`` has been introduced to support extending
2c2534	621	request objects with arbitrary callables. This method expands on the
MM	622	previous ``config.set_request_property`` by supporting methods as well as
	623	properties. This method now causes less code to be executed at
	624	request construction time than ``config.set_request_property`` in
	625	version 1.3.
fcb209	626
2c2534	627	- Don't add a ``?`` to URLs generated by ``request.resource_url`` if the
fcb209	628	``query`` argument is provided but empty.
CM	629
2c2534	630	- Don't add a ``?`` to URLs generated by ``request.route_url`` if the
fcb209	631	``_query`` argument is provided but empty.
988035	632
CM	633	- The static view machinery now raises (rather than returns) ``HTTPNotFound``
	634	and ``HTTPMovedPermanently`` exceptions, so these can be caught by the
cec2b0	635	Not Found View (and other exception views).
ea009a	636
54d3e3	637	- The Mako renderer now supports a def name in an asset spec. When the def
8b55a6	638	name is present in the asset spec, the system will render the template def
CM	639	within the template and will return the result. An example asset spec is
	640	``package:path/to/template#defname.mako``. This will render the def named
54d3e3	641	``defname`` inside the ``template.mako`` template instead of rendering the
CM	642	entire template. The old way of returning a tuple in the form
	643	``('defname', {})`` from the view is supported for backward compatibility,
8b55a6	644
CM	645	- The Chameleon ZPT renderer now accepts a macro name in an asset spec. When
	646	the macro name is present in the asset spec, the system will render the
	647	macro listed as a ``define-macro`` and return the result instead of
	648	rendering the entire template. An example asset spec:
	649	``package:path/to/template#macroname.pt``. This will render the macro
	650	defined as ``macroname`` within the ``template.pt`` template instead of the
	651	entire templae.
61a57e	652
CM	653	- When there is a predicate mismatch exception (seen when no view matches for
	654	a given request due to predicates not working), the exception now contains
	655	a textual description of the predicate which didn't match.
6b180c	656
CM	657	- An ``add_permission`` directive method was added to the Configurator. This
	658	directive registers a free-standing permission introspectable into the
	659	Pyramid introspection system. Frameworks built atop Pyramid can thus use
08c221	660	the ``permissions`` introspectable category data to build a
6b180c	661	comprehensive list of permissions supported by a running system. Before
CM	662	this method was added, permissions were already registered in this
	663	introspectable category as a side effect of naming them in an ``add_view``
	664	call, this method just makes it possible to arrange for a permission to be
	665	put into the ``permissions`` introspectable category without naming it
	666	along with an associated view. Here's an example of usage of
	667	``add_permission``::
	668
	669	config = Configurator()
	670	config.add_permission('view')
2c2534	671
45b6e1	672	- The ``UnencryptedCookieSessionFactoryConfig`` now accepts
MM	673	``signed_serialize`` and ``signed_deserialize`` hooks which may be used
	674	to influence how the sessions are marshalled (by default this is done
	675	with HMAC+pickle).
	676
28dba0	677	- ``pyramid.testing.DummyRequest`` now supports methods supplied by the
CM	678	``pyramid.util.InstancePropertyMixin`` class such as ``set_property``.
735987	679
CM	680	- Request properties and methods added via ``config.set_request_property`` or
	681	``config.add_request_method`` are now available to tweens.
	682
	683	- Request properties and methods added via ``config.set_request_property`` or
	684	``config.add_request_method`` are now available in the request object
	685	returned from ``pyramid.paster.bootstrap``.
	686
dc8b49	687	- ``request.context`` of environment request during ``bootstrap`` is now the
CM	688	root object if a context isn't already set on a provided request.
	689
07cb8f	690	- The ``pyramid.decorator.reify`` function is now an API, and was added to
CM	691	the API documentation.
	692
97150c	693	- Added the ``pyramid.testing.testConfig`` context manager, which can be used
CM	694	to generate a configurator in a test, e.g. ``with testing.testConfig(...):``.
	695
64452e	696	- Users can now invoke a subrequest from within view code using a new
CM	697	``request.invoke_subrequest`` API.
37d2c2	698
2c2534	699	Deprecations
MM	700	------------
	701
9cdb28	702	- The ``pyramid.config.Configurator.set_request_property`` has been
CM	703	documentation-deprecated. The method remains usable but the more
023c88	704	featureful ``pyramid.config.Configurator.add_request_method`` should be
9cdb28	705	used in its place (it has all of the same capabilities but can also extend
CM	706	the request object with methods).
ebcdc7	707
CM	708	Backwards Incompatibilities
	709	---------------------------
	710
25d3dd	711	- The Pyramid router no longer adds the values ``bfg.routes.route`` or
ebcdc7	712	``bfg.routes.matchdict`` to the request's WSGI environment dictionary.
CM	713	These values were docs-deprecated in ``repoze.bfg`` 1.0 (effectively seven
	714	minor releases ago). If your code depended on these values, use
	715	request.matched_route and request.matchdict instead.
	716
	717	- It is no longer possible to pass an environ dictionary directly to
	718	``pyramid.traversal.ResourceTreeTraverser.__call__`` (aka
	719	``ModelGraphTraverser.__call__``). Instead, you must pass a request
	720	object. Passing an environment instead of a request has generated a
	721	deprecation warning since Pyramid 1.1.
	722
	723	- Pyramid will no longer work properly if you use the
	724	``webob.request.LegacyRequest`` as a request factory. Instances of the
	725	LegacyRequest class have a ``request.path_info`` which return a string.
	726	This Pyramid release assumes that ``request.path_info`` will
	727	unconditionally be Unicode.
	728
3d4272	729	- The functions from ``pyramid.chameleon_zpt`` and ``pyramid.chameleon_text``
CM	730	named ``get_renderer``, ``get_template``, ``render_template``, and
	731	``render_template_to_response`` have been removed. These have issued a
	732	deprecation warning upon import since Pyramid 1.0. Use
	733	``pyramid.renderers.get_renderer()``,
	734	``pyramid.renderers.get_renderer().implementation()``,
	735	``pyramid.renderers.render()`` or ``pyramid.renderers.render_to_response``
	736	respectively instead of these functions.
	737
94a6f3	738	- The ``pyramid.configuration`` module was removed. It had been deprecated
CM	739	since Pyramid 1.0 and printed a deprecation warning upon its use. Use
	740	``pyramid.config`` instead.
	741
b274d0	742	- The ``pyramid.paster.PyramidTemplate`` API was removed. It had been
CM	743	deprecated since Pyramid 1.1 and issued a warning on import. If your code
	744	depended on this, adjust your code to import
	745	``pyramid.scaffolds.PyramidTemplate`` instead.
	746
ef2e51	747	- The ``pyramid.settings.get_settings()`` API was removed. It had been
CM	748	printing a deprecation warning since Pyramid 1.0. If your code depended on
	749	this API, use ``pyramid.threadlocal.get_current_registry().settings``
	750	instead or use the ``settings`` attribute of the registry available from
	751	the request (``request.registry.settings``).
	752
69e0aa	753	- These APIs from the ``pyramid.testing`` module were removed. They have
CM	754	been printing deprecation warnings since Pyramid 1.0:
	755
	756	* ``registerDummySecurityPolicy``, use
	757	``pyramid.config.Configurator.testing_securitypolicy`` instead.
	758
	759	* ``registerResources`` (aka ``registerModels``, use
	760	``pyramid.config.Configurator.testing_resources`` instead.
	761
	762	* ``registerEventListener``, use
	763	``pyramid.config.Configurator.testing_add_subscriber`` instead.
	764
	765	* ``registerTemplateRenderer`` (aka `registerDummyRenderer``), use
	766	``pyramid.config.Configurator.testing_add_template`` instead.
	767
	768	* ``registerView``, use ``pyramid.config.Configurator.add_view`` instead.
	769
	770	* ``registerUtility``, use
	771	``pyramid.config.Configurator.registry.registerUtility`` instead.
	772
	773	* ``registerAdapter``, use
	774	``pyramid.config.Configurator.registry.registerAdapter`` instead.
	775
	776	* ``registerSubscriber``, use
	777	``pyramid.config.Configurator.add_subscriber`` instead.
	778
	779	* ``registerRoute``, use
	780	``pyramid.config.Configurator.add_route`` instead.
	781
	782	* ``registerSettings``, use
	783	``pyramid.config.Configurator.add_settings`` instead.
	784
64452e	785	- In Pyramid 1.3 and previous, the ``__call__`` method of a Response object
CM	786	was invoked before any finished callbacks were executed. As of this
	787	release, the ``__call__`` method of a Response object is invoked after
	788	finished callbacks are executed. This is in support of the
	789	``request.invoke_subrequest`` feature.
	790
b72ba1	791	Documentation
CM	792	-------------
	793
	794	- Added an "Upgrading Pyramid" chapter to the narrative documentation. It
07cb8f	795	describes how to cope with deprecations and removals of Pyramid APIs and
CM	796	how to show Pyramid-generated deprecation warnings while running tests and
	797	while running a server.
b72ba1	798
37d2c2	799	- Added a "Invoking a Subrequest" chapter to the documentation. It describes
64452e	800	how to use the new ``request.invoke_subrequest`` API.
37d2c2	801
ebcdc7	802	Dependencies
CM	803	------------
	804
	805	- Pyramid now requires WebOb 1.2b3+ (the prior Pyramid release only relied on
	806	1.2dev+). This is to ensure that we obtain a version of WebOb that returns
	807	``request.path_info`` as text.
	808