[web/request] deprecate user_callback

Storing closures in session data considered harmful. Closes #3567793

authorJulien Cristau <julien.cristau@logilab.fr>
changesete8b9a3d23ad9
branchdefault
phasepublic
hiddenno
parent revision#b87c09f853d3 [doc] undocument user_callback
child revision#9f09c9c18cbb [web] Fix HEAD request handling (closes #3677949), #57dd73194dfe [web] Add asserts to the raw header conversion functions, #8a03e8d1e24f [web] Fix HEAD request handling, #b5abcda42163 [utils] the json module is always available, #ac0bc417b55f [web] Fix handling of some http headers, #146b492cead0 [devtools] add a 'method' argument to RepoAccess.web_request
files modified by this revision
doc/3.19.rst
web/request.py
# HG changeset patch
# User Julien Cristau <julien.cristau@logilab.fr>
# Date 1394470442 -3600
# Mon Mar 10 17:54:02 2014 +0100
# Node ID e8b9a3d23ad93e47391fe566012812245f2a751b
# Parent b87c09f853d3cfe13174fb23f58960f45ac17e2c
[web/request] deprecate user_callback

Storing closures in session data considered harmful. Closes #3567793

diff --git a/doc/3.19.rst b/doc/3.19.rst
@@ -141,10 +141,14 @@
1  * The implementation of cascading deletion when deleting `composite`
2    entities has changed. There comes a semantic change: merely deleting
3    a composite relation does not entail any more the deletion of the
4    component side of the relation.
5 
6 +* ``_cw.user_callback`` and ``_cw.user_rql_callback`` are deprecated.  Users
7 +  are encouraged to write an actual controller (e.g. using ``ajaxfunc``)
8 +  instead of storing a closure in the session data.
9 +
10 
11  Deprecated Code Drops
12  ----------------------
13 
14  * session.hijack_user mechanism has been dropped.
diff --git a/web/request.py b/web/request.py
@@ -414,10 +414,11 @@
15          """
16          def rqlexec(req, rql, args=None, key=None):
17              req.execute(rql, args, key)
18          return self.user_callback(rqlexec, rqlargs, *args, **kwargs)
19 
20 +    @deprecated('[3.19] use a traditional ajaxfunc / controller')
21      def user_callback(self, cb, cbargs, *args, **kwargs):
22          """register the given user callback and return a URL which can
23          be inserted in an HTML view. When the URL is accessed, the
24          callback function will be called (as 'cb(req, \*cbargs)', and a
25          message will be displayed in the web interface. The third