# web.py changelog

## 2023-10-02 0.70

* Remove the cgi module which will be removed in Python 3.13 #773
* Add support for current versions of CPython
* Upgrade testing and linting tools

## 2020-11-09 0.62

* Fixed: application.load() assumes ctx.path will be a latin1 string #687
* Fixed: can not reset session data to same value as initialized. #683
* Fixed: can not set session expire time. #655
* Fixed: not export session store `MemoryStore`.

## 2020-06-23 0.61

* setup.py: Add python_requires='>=3.5' #662

## 2020-06-23 0.60

* Python-2 support has been completely dropped. Welcome to Python 3.
* Fixed: session store `DiskStore` doesn't return correctly if session
  directory doesn't exist. #652
* Fixed: incorrect str/bytes type of session data. #644 #645
* Fixed: `db.query("insert... returning")` fails to commit. #648 #649

## 2020-03-20 0.50

* New session store `MemoryStore`, used to save a session in memory.
  Should be useful where there are limited fs writes to the disk, like
  flash memories. #174
* Fixed: not support `samesite=none`. #592
* Fixed Python-3 compatibility issues: #574, #576.
* Support tuple and set in `sqlquote()`.
* Drop support for SQL driver `pgdb`. It was dead, you cannot even find its
  website or download link.
* Drop support for SQL driver `psycopg`. The latest version was released in
  2006 (14 years ago), please use `psycopg2` instead.
* Removed function `web.safemarkdown`. if it's used in your application, you
  can install the `Markdown` module from pypi
  (https://pypi.org/project/Markdown/), then replace `web.safemarkdown()` by
  `markdown.markdown()`.

## 2019-09-25 0.40

Note: `0.40` is the last release which supports Python 2. Future releases will
drop support for Python 2.

Broken backward compatibilities:

- `web.utils.utf8` and `web.utf8` (it's an alias of `web.utils.utf8`) were
  removed. Please replace them by `web.safestr` instead.
- `db.select()` doesn't support specifying offset in `limit` like this:
  `db.select(..., limit="2, 10", ...)` (equals to raw SQL statement
  `SELECT ... LIMIT 2, 10`). Please replace them by moving the offset to
  `offset` keyword like this: `db.select(..., offset=2, limit=10)`.

Major changes since 0.39:

* Fixed lots of Python-3 compatibility issues.
* Drop support for Python < 2.7.
* Allow to get form data from http PATCH request (fixes #259, tx @kufd)
* Only store new session data if the data is non-default (fixes #161, tx @shish)
* Supports `SameSite` cookie attribute (fixes #61 #99 #337)
* Cookie expire time is now set to same as session `timeout` (fixes #409 #410)
* Supports url for SQLite database like `sqlite:///mydb.sqlite`,
  `sqlite:////absolute/path/mydb.sqlite` (fixes #209, tx @iamFIREcracker)
* Allow HTML5 form input elements in `web.form.Input()` (fixes #440, tx @jimgregory)
* Add more form classes for different types: `Email`, `Url`, `Number`, `Range`,
  `Color`, `Search`, `Telephone` and `Datalist` (fixes #98 #497, tx @faruken @gjdv)
* Return body for `NoMethod` error handler (fixes #240, tx @waldhol)
* Directory `experimental/` has been removed, it's not used and out of date.
* Module `web/webopenid.py` has been removed, it uses old `python-openid`
  module which was released 9 years ago. If you need openid support, consider
  `python-openid2` or other packages available on https://pypi.org/.
* Fixed unicode in request url (fixes #461, tx @schneidersoft)
* Fixed inline comment in Templator which leads to unexpected behavior (fixes #432, tx @lucylqe)
* Fixed missing exception (ValueError) for socket.inet_pton to be compatible
  with twisted patched `socket.inet_pton` (fixes #464, tx @tclh123)
* Fixed incorrect order of arguments for sending email with boto (fixes #204, tx @asldevi)
* Fixed notfound message is not utf-8 charset (fixes #500, tx @by-z)
* Fixed error in creating pooled PostgresDB with pgdb driver (fixes #255, tx @PriceChild)
* Fixed IP address which contains space should not pass validation (fixes #140, tx @chuangbo)
* Fixed incorrect returned row ids with `multiple_insert()` (fixes #263 #447)
* Fixed not correctly render the `id` attribute after changed (fixes #339, tx @jimgregory)
* Fixed DiskStore concurrency issue (fixes Fixes #83 #182 #191 #289 #470, tx @skawouter)
* Fixed app module isn't picked up by `Reloader` for first code change (fixes #438, tx @jzellman)

## 2018-02-28 0.39

* Fixed a security issue with the form module (tx Orange Tsai)
* Fixed a security issue with the db module (tx Adrián Brav and Orange Tsai)

## 2016-07-08 0.38

* Fixed failing tests in test/session.py when postgres is not installed. (tx Michael Diamond)
* Fixed an error with Python 2.3 (tx Michael Diamond)
* web.database now accepts a URL, $DATABASE_URL (fixes #171) (tx Aaron Swartz, we miss you)
* support port use 'port' as keyword for postgres database with used with pgdb (tx Sandesh Singh)
* Fixes to FirebirdDB database (tx Ben Hanna)
* Added a gaerun method to start application for google app engine (tx Matt Habel)
* Better error message from `db.multiple_insert` when not all rows have the same keys (tx Ben Hoyt)
* Allow custom messages for most errors (tx Shaun Sharples)
* IPv6 support (tx Matthew of Boswell and zamabe)
* Fixed sending email using Amazon SES (tx asldevi)
* Fixed handling of long numbers in sqlify. closes #213. (tx cjrolo)
* Escape HTML characters when emitting API docs. (tx Jeff Zellman)
* Fixed an inconsistency in form.Dropdown when numbers are used for args and value. (tx Noprianto)
* Fixed a potential remote execution risk in `reparam` (tx Adrián Brav)
* The where clause in db queries can be a dict now
* Added `first` method to iterbetter
* Fix to unexpected session when used with MySQL (tx suhashpatil)
* Change dburl2dict to use urlparse and to support the simple case of just a database name. (tx Jeff Zellman)
* Support '204 No Content' status code (tx Matteo Landi)
* Support `451 Unavailable For Legal Reasons` status code(tx Yannik Robin Kettenbach)
* Updates to documentation (tx goodrone, asldevi)


## 2012-06-26 0.37

* Fixed datestr issue on Windows -- #155
* Fixed Python 2.4 compatibility issues (tx fredludlow)
* Fixed error in utils.safewrite (tx shuge) -- #95
* Allow use of web.data() with app.request() -- #105
* Fixed an issue with session initialization (tx beardedprojamz) -- #109
* Allow custom message on 400 Bad Request (tx patryk) -- #121
* Made djangoerror work on GAE. -- #80
* Handle malformatted data in the urls. -- #117
* Made it easier to stop the dev server -- #100, #122
* Added support for customizing cookie_path in session (tx larsga) -- #89
* Added exception for "415 Unsupported Media" (tx JirkaChadima) -- #145
* Added GroupedDropdown to support `<optgroup>` tag (tx jzellman) -- #152
* Fixed failure in embedded interpreter - #87
* Optimized web.cookies (tx benhoyt) - #148


## 2011-07-04 0.36

* Upgraded to CherryPy WSGIServer 3.2.0. -- #66
* Various Jython compatibility fixes (tx Ben Noordhuis)
* allow strips to accept lists -- #69
* Improvements to setcookie (tx lovelylain) -- #65
* Added __contains__ method to Session. (tx lovelylain) #65
* Added secure option to session. -- #38
* Fixed db.delete error with `using` clause (tx berndtj) -- #28
* Fixed the case of no where-clauses in db.where
* Fixed threadlocal error in python2.3 -- #77
* Fixed TemplateResult inconsistent behavior -- #78
* Fixed query execution issues with MSSQL -- #71

## 2011-05-15 0.35

* Better ThreaedDict implementation using threadlocal (tx Ben Hoyt)
* Make Form a new-style class -- #53
* Optimized SQLQuery.join and generation of multiple_insert query -- #58
* New: support for Amazon's Simple Email Service
* Added httponly keyword to setcookie (tx Justin Davis)
* Added httponly only option to sessions and enabled it by default (tx Justin Davis)
* made htmlquote and htmlunquote work with unicode
* Added doseq support for web.url
* New flag web.config.debug_sql to control printing of db queries (tx Nimrod S. Kerrett)
* Fixed inserting default values into MySQL -- #49
* Fixed rendering of Dropdown with multiple values (tx krowbar) -- #43
* Fixed multiple set-cookie header issue with session -- #45
* Fixed error in safeunicode when used with appengine datastore objects
* Fixed unicode error in generating debugerror -- #26
* Fixed GAE compilation issue -- #24
* Fixed unicode encoding issue in templates -- #17
* Fixed a bug in form.RadioButton when called with tuple options (tx fhsm) -- #13
* Fixed error in creating PostgresDB with pgdb driver (tx cninucci) -- #23
* Support auto conversion of timestamp/date datatypes in sqlite to datetime.data objects -- #22
* Fixed escaping issue on GAE -- #10
* fixed form.validates for checkbox (tx Justin Davis).
* fixed duplicate content-type in web.sendmail -- #20
* Fix: create session dirs if required (tx Martin Marcher)
* Fixed safestr to make use of encoding argument (tx s7v7nislands)
* Don't allow /static/../foo urls in dev webserver (tx Arnar Lundesgaard)
* Disabled debug mode in flup server (tx irrelative) -- #35
* And a lot of unicode fixes

## 2010-03-20 0.34

* fix: boolean test works even for sqlite results (tx Emyr Thomas for the idea)
* fix issue with loop.xx variables in templetor (Bug#476708)
* hide unwanted tracebacks in debugerror
* display correct template line numbers in debugerror
* new utilities: counter, safeiter, safewrite, requeue, restack (by Aaron Swartz)
* various form.py fixes and improvements
* automatically escape % characters in the db query (Bug#516516)
* fix non-deterministic template order (Bug#490209)
* attachment support for web.sendmail (tx gregglind)
* template.py optimizations and extension support

## 2009-10-28 0.33

* form.Button takes optional argument `html`
* remove obsolete write function in http.py (tx Justin) (Bug#315337)
* refactor httpserver.runsimple code
* improve form.py for customizability
* new: add background updating to memoize
* fix: use sendmail from web.config.sendmail_path (tx Daniel Schwartz)
* fix: make web.profiler work on Windows (tx asmo) (Bug#325139)
* fix changequery to make it work correctly even when the input has multi-valued fields (Bug#118229)
* fix: make sure sequence exists before queying for currval(seqname) when executing postgres insert query (Bug#268705)
* fix: raise web.notfound() instead of return in autodelegate (tx SeC)
* fix: raise NotSupportedError when len or bool is used on sqlite result (Bug#179644)
* fix: make db parameter optional for creating postgres DB to allow taking it from environ. (Bug#153491)
* fix unicode errors in db module
* fix: convert unicode strings to UTF8 before printing SQL queries
* fix unicode error in debugerror
* fix: don't convert file upload data to unicode even when file={} is not passed to web.input
* fix checkbox value/checked confusion (Bug#128233)
* fix: consider empty lines as part of the indented block in templetor
* fix: fix a bug in web.group

## 2009-06-04 0.32

* optional from_address to web.emailerrors
* upgrade wsgiserver to CherryPy/3.1.2
* support for extensions in Jinja2 templates (tx Zhang Huangbin)
* support web.datestr for datetime.date objects also
* support for lists in db queries
* new: uniq and iterview
* fix: set debug=False when application is run with mod_wsgi (tx Patrick Swieskowski) [Bug#370904](https://bugs.launchpad.net/webpy/+bug/370904)
* fix: make web.commify work  with decimals [Bug#317204](https://bugs.launchpad.net/webpy/+bug/317204)
* fix: unicode issues with sqlite database [Bug#373219](https://bugs.launchpad.net/webpy/+bug/373219)
* fix: urlquote url when the server is lighttpd [Bug#339858](https://bugs.launchpad.net/webpy/+bug/339858)
* fix: issue with using date.format in templates
* fix: use TOP instead of LIMIT in mssql database [Bug#324049](https://bugs.launchpad.net/webpy/+bug/324049)
* fix: make sessions work well with expirations
* fix: accept both list and tuple as arg values in form.Dropdown [Bug#314970](https://bugs.launchpad.net/webpy/+bug/314970)
* fix: match parenthesis when parsing `for` statement in templates
* fix: fix python 2.3 compatibility
* fix: ignore dot folders when compiling templates (tx Stuart Langridge)
* fix: don't consume KeyboardInterrupt and SystemExit errors
* fix: make application work well with iterators

## 2008-12-10: 0.31

* new: browser module
* new: test utilities
* new: ShelfStore
* fix: web.cookies error when default is None
* fix: paramstyle for OracleDB (tx kromakey)
* fix: performance issue in SQLQuery.join
* fix: use wsgi.url_scheme to find ctx.protocol

## 2008-12-06: 0.3

* new: replace print with return (<i>backward-incompatible</i>)
* new: application framework (<i>backward-incompatible</i>)
* new: modular database system (<i>backward-incompatible</i>)
* new: templetor reimplementation
* new: better unicode support
* new: debug mode (web.config.debug)
* new: better db pooling
* new: sessions
* new: support for GAE
* new: etag support
* new: web.openid module
* new: web.nthstr
* fix: various form.py fixes
* fix: python 2.6 compatibility
* fix: file uploads are not loaded into memory
* fix: SQLLiteral issue (Bug#180027)
* change: web.background is moved to experimental (<i>backward-incompatible</i>)
* improved API doc generation (tx Colin Rothwell)

## 2008-01-19: 0.23

* fix: for web.background gotcha ([133079](http://bugs.launchpad.net/webpy/+bug/133079))
* fix: for postgres unicode bug ([177265](http://bugs.launchpad.net/webpy/+bug/177265))
* fix: web.profile behavior in python 2.5 ([133080](http://bugs.launchpad.net/webpy/+bug/133080))
* fix: only uppercase HTTP methods are allowed. ([176415](http://bugs.launchpad.net/webpy/+bug/176415))
* fix: transaction error in with statement ([125118](http://bugs.launchpad.net/webpy/+bug/125118))
* fix: fix in web.reparam ([162085](http://bugs.launchpad.net/webpy/+bug/162085))
* fix: various unicode issues ([137042](http://bugs.launchpad.net/webpy/+bug/137042), [180510](http://bugs.launchpad.net/webpy/+bug/180510), [180549](http://bugs.launchpad.net/webpy/+bug/180549), [180653](http://bugs.launchpad.net/webpy/+bug/180653))
* new: support for https
* new: support for secure cookies
* new: sendmail
* new: htmlunquote

## 2007-08-23: 0.22

* compatibility with new DBUtils API ([122112](https://bugs.launchpad.net/webpy/+bug/122112))
* fix reloading ([118683](https://bugs.launchpad.net/webpy/+bug/118683))
* fix compatibility between `changequery` and `redirect` ([118234](https://bugs.launchpad.net/webpy/+bug/118234))
* fix relative URI in `web.redirect` ([118236](https://bugs.launchpad.net/webpy/+bug/118236))
* fix `ctx._write` support in built-in HTTP server ([121908](https://bugs.launchpad.net/webpy/+bug/121908))
* fix `numify` strips things after '.'s ([118644](https://bugs.launchpad.net/webpy/+bug/118644))
* fix various unicode issues ([114703](https://bugs.launchpad.net/webpy/+bug/114703), [120644](https://bugs.launchpad.net/webpy/+bug/120644), [124280](https://bugs.launchpad.net/webpy/+bug/124280))

## 2007-05-28: 0.21

* <strong>security fix:</strong> prevent bad characters in headers
* support for cheetah template reloading
* support for form validation
* new `form.File`
* new `web.url`
* fix rendering issues with hidden and button inputs
* fix 2.3 incompatibility with `numify`
* fix multiple headers with same name
* fix web.redirect issues when homepath is not /
* new CherryPy wsgi server
* new nested transactions
* new sqlliteral

## 2006-05-09: 0.138

* New function: `intget`
* New function: `datestr`
* New function: `validaddr`
* New function: `sqlwhere`
* New function: `background`, `backgrounder`
* New function: `changequery`
* New function: `flush`
* New function: `load`, `unload`
* New variable: `loadhooks`, `unloadhooks`
* Better docs; generating [docs](documentation) from web.py now
* global variable `REAL_SCRIPT_NAME` can now be used to work around lighttpd madness
* fastcgi/scgi servers now can listen on sockets
* `output` now encodes Unicode
* `input` now takes optional `_method` argument
* <strong>Potentially-incompatible change:</strong> `input` now returns `badrequest` automatically when `requireds` aren't found
* `storify` now takes lists and dictionaries as requests (see docs)
* `redirect` now blanks any existing output
* Quote SQL better when `db_printing` is on
* Fix delay in `nomethod`
* Fix `urlquote` to encode better.
* Fix 2.3 incompatibility with `iters` (tx ??)
* Fix duplicate headers
* Improve `storify` docs
* Fix `IterBetter` to raise IndexError, not KeyError

## 2006-03-27: 0.137

* Add function `dictfindall` (tx Steve Huffman)
* Add support to `autodelegate` for arguments
* Add functions `httpdate` and `parsehttpdate`
* Add function `modified`
* Add support for FastCGI server mode
* Clarify `dictadd` documentation (tx Steve Huffman)
* Changed license to public domain
* Clean up to use `ctx` and `env` instead of `context` and `environ`
* Improved support for PUT, DELETE, etc. (tx list)
* Fix `ctx.fullpath` (tx Jesir Vargas)
* Fix sqlite support (tx Dubhead)
* Fix documentation bug in `lstrips` (tx Gregory Petrosyan)
* Fix support for IPs and ports (1/2 tx Jesir Vargas)
* Fix `ctx.fullpath` (tx Jesir Vargas)
* Fix sqlite support (tx Dubhead)
* Fix documentation bug in `lstrips` (tx Gregory Petrosyan)
* Fix `iters` bug with sets
* Fix some breakage introduced by Vargas's patch
* Fix `sqlors` bug
* Fix various small style things (tx Jesir Vargas)
* Fix bug with `input` ignoring GET input

## 2006-02-22: 0.136 (svn)

* Major code cleanup (tx to Jesir Vargas for the patch).
* 2006-02-15: 0.135
* Really fix that mysql regression (tx Sean Leach).
* 2006-02-15: 0.134
* The `StopIteration` exception is now caught. This can be used by functions that do things like check to see if a user is logged in. If the user isn't, they can output a message with a login box and raise StopIteration, preventing the caller from executing.
* Fix some documentation bugs.
* Fix mysql regression (tx mrstone).

## 2006-02-12: 0.133

* Docstrings! (tx numerous, esp. Jonathan Mark (for the patch) and Guido van Rossum (for the prod))
* Add `set` to web.iters.
* Make the `len` returned by `query` an int (tx ??).
* <strong>Backwards-incompatible change:</strong> `base` now called `prefixurl`.
* <strong>Backwards-incompatible change:</strong> `autoassign` now takes `self` and `locals()` as arguments.

## 2006-02-07: 0.132

* New variable `iters` is now a listing of possible list-like types (currently list, tuple, and, if it exists, Set).
* New function `dictreverse` turns `{1:2}` into `{2:1}`.
* `Storage` now a dictionary subclass.
* `tryall` now takes an optional prefix of functions to run.
* `sqlors` has various improvements.
* Fix a bunch of DB API bugs.
* Fix bug with `storify` when it received multiple inputs (tx Ben Woosley).
* Fix bug with returning a generator (tx Zbynek Winkler).
* Fix bug where len returned a long on query results (tx F.S).


## 2006-01-31: 0.131 (not officially released)

* New function `_interpolate` used internally for interpolating strings.
* Redone database API. `select`, `insert`, `update`, and `delete` all made consistent. Database queries can now do more complicated expressions like `$foo.bar` and `${a+b}`. You now have to explicitly pass the dictionary to look up variables in. Pass `vars=locals()` to get the old functionality of looking up variables .
* New functions `sqllist` and `sqlors` generate certain kinds of SQL.

## 2006-01-30: 0.13

* New functions `found`, `seeother`, and `tempredirect` now let you do other kinds of redirects. `redirect` now also takes an optional status parameter. (tx many)
* New functions `expires` and `lastmodified` make it easy to send those headers.
* New function `gone` returns a 410 Gone (tx David Terrell).
* New function `urlquote` applies url encoding to a string.
* New function `iterbetter` wraps an iterator and allows you to do __getitem__s on it.
* Have `query` return an `iterbetter` instead of an iterator.
* Have `debugerror` show tracebacks with the innermost frame first.
* Add `__hash__` function to `threadeddict` (and thus, `ctx`).
* Add `context.host` value for the requested host name.
* Add option `db_printing` that prints database queries and the time they take.
* Add support for database pooling (tx Steve Huffman).
* Add support for passing values to functions called by `handle`. If you do `('foo', 'value')` it will add `'value'` as an argument when it calls `foo`.
* Add support for scgi (tx David Terrell for the patch).
* Add support for web.py functions that are iterators (tx Brendan O'Connor for the patch).
* Use new database cursors on each call instead of reusing one.
* `setcookie` now takes an optional `domain` argument.
* Fix bug in autoassign.
* Fix bug where `debugerror` would break on objects it couldn't display.
* Fix bug where you couldn't do `#include`s inline.
* Fix bug with `reloader` and database calls.
* Fix bug with `reloader` and base templates.
* Fix bug with CGI mode on certain operating systems.
* Fix bug where `debug` would crash if called outside a request.
* Fix bug with `context.ip` giving weird values with proxies.

## 2006-01-29: 0.129

* Add Python 2.2 support.

## 2006-01-28: 0.128

* Fix typo in `web.profile`.

## 2006-01-28: 0.127

* Fix bug in error message if invalid dbn is sent (tx Panos Laganakos).

## 2006-01-27: 0.126

* Fix typos in Content-Type headers (tx Beat Bolli for the prod).

## 2006-01-22: 0.125

* Support Cheetah 2.0.

## 2006-01-22: 0.124

* Fix spacing bug (tx Tommi Raivio for the prod).

## 2006-01-16: 0.123

* Fix bug with CGI usage (tx Eddie Sowden for the prod).

## 2006-01-14: 0.122

* Allow DELETEs from `web.query` (tx Joost Molenaar for the prod).

## 2006-01-08: 0.121

* Allow import of submodules like `pkg.mod.cn` (tx Sridhar Ratna).
* Fix a bug in `update` (tx Sergey Khenkin).

## 2006-01-05: 0.12

* <strong>Backwards-incompatible change:</strong> `db_parameters` is now a dictionary.
* <strong>Backwards-incompatible change:</strong> `sumdicts` is now `dictadd`.
* Add support for PyGreSQL, MySQL (tx Hallgrimur H. Gunnarsson).
* Use HTML for non-Cheetah error message.
* New function `htmlquote()`.
* New function `tryall()`.
* `ctx.output` can now be set to a generator. (tx Brendan O'Connor)

## 2006-01-04: 0.117

* Add support for psycopg 1.x. (tx Gregory Price)

## 2006-01-04: 0.116

* Add support for Python 2.3. (tx Evan Jones)

## 2006-01-04: 0.115

* Fix some bugs where database queries weren't reparameterized. Oops!
* Fix a bug where `run()` wasn't getting the right functions.
* Remove a debug statement accidentally left in.
* Allow `storify` to be used on dictionaries. (tx Joseph Trent)

## 2006-01-04: 0.114

* Make `reloader` work on Windows. (tx manatlan)
* Fix some small typos that affected colorization. (tx Gregory Price)

## 2006-01-03: 0.113

* Reorganize `run()` internals so mod_python can be used. (tx Nicholas Matsakis)

## 2006-01-03: 0.112

* Make `reloader` work when `code.py` is called with a full path. (tx David Terrell)

## 2006-01-03: 0.111

* Fixed bug in `strips()`. (tx Michael Josephson)

## 2006-01-03: 0.11

* First public version.