Package: pyramid
PyramidPyramid is a small, fast, down-to-earth, open source Python web framework.
It makes real-world web application development
and deployment more fun, more predictable, and more productive.Try Pyramid, browse its add-ons and documentation, and get an overview.fromwsgiref.simple_serverimportmake_serverfrompyramid.configimportConfiguratorfrompyramid.responseimportResponsedefhello_world(request):returnResponse('Hello World!')if__name__=='__main__':withConfigurator()asconfig:config.add_route('hello','/')config.add_view(hello_world,route_name='hello')app=config.make_wsgi_app()server=make_server('0.0.0.0',6543,app)server.serve_forever()Pyramid is a project of thePylons Project.Support and DocumentationSeePyramid Support and Developmentfor documentation, reporting bugs, and getting support.Developing and ContributingSeeHACKING.txtandcontributing.mdfor guidelines on running tests, adding features, coding style, and updating
documentation when developing in or contributing to Pyramid.LicensePyramid is offered under the BSD-derivedRepoze Public License.AuthorsPyramid is made available byAgendaless Consultingand a team ofcontributors.2.0.2 (2023-08-25)Bug FixesRemoved support for null-bytes in the path when making a request for a file
against a static_view. Whille null-bytes are allowed by the HTTP
specification, due to the handling of null-bytes potentially leading to
security vulnerabilities it is no longer supported.This fixes a security vulnerability that is present due to a bug in Python
3.11.0 through 3.11.4, thereby allowing the unintended disclosure of anindex.htmlone directory up from the static views path.Thanks to Masashi Yamane of LAC Co., Ltd for reporting this issue.Backward IncompatibilitiesRequests to a static_view are no longer allowed to contain a null-byte in any
part of the path segment.2.0.1 (2023-01-29)Add support for Python 3.10 and 3.11.Copy__name__from decorated attribute when usingpyramid.decorator.reify.
Seehttps://github.com/Pylons/pyramid/pull/3660Fix method signatures in docs forpyramid.config.Configurator.add_static_viewandpyramid.config.Configurator.override_asset.
Seehttps://github.com/Pylons/pyramid/pull/3699Remove obsolete stackframe hack used in Python 3.5.0 when showing
configurator conflict errors.
Seehttps://github.com/Pylons/pyramid/pull/3700Fix an error when injecting certain objects into thepshellenv due to
the use of!=.
Seehttps://github.com/Pylons/pyramid/pull/3704Pyramid drops support forl*gettext()methods in the i18n module.
These have been deprecated in Python’s gettext module since 3.8, and
removed in Python 3.11. They also shouldn’t be used at all on Python 3.
Seehttps://github.com/Pylons/pyramid/pull/3717AvoidsetDaemon(True)deprecation warning by updating threading API usage
to.daemon = True.2.0 (2021-02-28)No changes from 2.0b1.2.0b1 (2021-02-20)Break potential reference cycle betweenrequestandcontext.
Seehttps://github.com/Pylons/pyramid/pull/3649Removeupdate_wrapperfrompyramid.decorator.reify.
Seehttps://github.com/Pylons/pyramid/pull/36572.0b0 (2020-12-15)Overhaul tutorials and update cookiecutter to de-emphasizerequest.userin favor ofrequest.identityfor common use cases.
Seehttps://github.com/Pylons/pyramid/pull/3629Improve documentation and patterns with builtin fixtures shipped in the
cookiecutters.
Seehttps://github.com/Pylons/pyramid/pull/36292.0a0 (2020-11-29)FeaturesAdd support for Python 3.9.
Seehttps://github.com/Pylons/pyramid/issues/3622Theaslistmethod now handles non-string objects when flattening.
Seehttps://github.com/Pylons/pyramid/pull/3594It is now possible to pass multiple values to theheaderpredicate
for route and view configuration.
Seehttps://github.com/Pylons/pyramid/pull/3576Add support for Python 3.8.
Seehttps://github.com/Pylons/pyramid/pull/3547New security APIs have been added to support a massive overhaul of the
authentication and authorization system. Read
“Upgrading Authentication/Authorization” in the “What’s New in Pyramid 2.0”
chapter of the documentation for information about using this new system.pyramid.config.Configurator.set_security_policy.pyramid.interfaces.ISecurityPolicypyramid.request.Request.identity.pyramid.request.Request.is_authenticatedpyramid.authentication.SessionAuthenticationHelperpyramid.authorization.ACLHelperis_authenticated=True/Falsepredicate for route and view configsSeehttps://github.com/Pylons/pyramid/pull/3465andhttps://github.com/Pylons/pyramid/pull/3598Changed the defaultserializeronpyramid.session.SignedCookieSessionFactoryto usepyramid.session.JSONSerializerinstead ofpyramid.session.PickleSerializer. Read
“Upgrading Session Serialization” in the “What’s New in Pyramid 2.0” chapter
of the documentation for more information about why this change was made.
Seehttps://github.com/Pylons/pyramid/pull/3413It is now possible to control whether a route pattern contains a trailing
slash when it is composed with a route prefix usingconfig.include(...,route_prefix=...)orwithconfig.route_prefix_context(...). This can be done by specifying
an empty pattern and setting the new argumentinherit_slash=True. For example:withconfig.route_prefix_context('/users'):config.add_route('users','',inherit_slash=True)In the example, the resulting pattern will be/users. Similarly, if the
route prefix were/users/then the final pattern would be/users/.
If thepatternwas'/', then the final pattern would always be/users/. This new setting is only available if the pattern supplied
toadd_routeis the empty string ('').
Seehttps://github.com/Pylons/pyramid/pull/3420No longer definepyramid.request.Request.json_bodywhich is already
provided by WebOb. This allows the attribute to now be settable.
Seehttps://github.com/Pylons/pyramid/pull/3447Improve debugging info frompyramid.view.view_configdecorator.
Seehttps://github.com/Pylons/pyramid/pull/3483A new parameter,allow_no_origin, was added topyramid.config.Configurator.set_default_csrf_optionsas well aspyramid.csrf.check_csrf_origin. This option controls whether a
request is rejected if it has noOriginorRefererheader -
often the result of a user configuring their browser not to send aRefererheader for privacy reasons even on same-domain requests.
The default is to reject requests without a known origin. It is also
possible to allow the specialOrigin: nullheader by adding it to thepyramid.csrf_trusted_originslist in the settings.
Seehttps://github.com/Pylons/pyramid/pull/3512andhttps://github.com/Pylons/pyramid/pull/3518A new parameter,check_origin, was added topyramid.config.Configurator.set_default_csrf_optionswhich disables
origin checking entirely.
Seehttps://github.com/Pylons/pyramid/pull/3518Addedpyramid.interfaces.IPredicateInfowhich defines the object passed
to predicate factories as their second argument.
Seehttps://github.com/Pylons/pyramid/pull/3514Added support for serving pre-compressed static assets by using thecontent_encodingsargument ofpyramid.config.Configurator.add_static_viewandpyramid.static.static_view.
Seehttps://github.com/Pylons/pyramid/pull/3537FixDeprecationWarningemitted by using theimpmodule.
Seehttps://github.com/Pylons/pyramid/pull/3553Properties created viaconfig.add_request_method(...,property=True)orrequest.set_propertyused to be readonly. They can now be overridden
viarequest.foo = ...and until the value is deleted it will return
the overridden value. This is most useful when mocking request properties
in testing.
Seehttps://github.com/Pylons/pyramid/pull/3559Finished callbacks are now executed as part of thecloserthat is
invoked as part ofpyramid.scripting.prepareandpyramid.paster.bootstrap.
Seehttps://github.com/Pylons/pyramid/pull/3561Addedpyramid.request.RequestLocalCachewhich can be used to create
simple objects that are shared across requests and can be used to store
per-request data. This is useful when the source of data is external to
the request itself. Often a reified property is used on a request viapyramid.config.Configurator.add_request_method, orpyramid.decorator.reify, and these work great when the data is
generated on-demand when accessing the request property. However, often
the case is that the data is generated when accessing some other system
and then we want to cache the data for the duration of the request.
Seehttps://github.com/Pylons/pyramid/pull/3561Exposedpyramid.authorization.ALL_PERMISSIONSandpyramid.authorization.DENY_ALLsuch that all of the ACL-related constants
are now importable from thepyramid.authorizationnamespace.
Seehttps://github.com/Pylons/pyramid/pull/3563pservenow outputs verbose messaging tostderrinstead ofstdoutto circumvent buffering issues that exist by default onstdout.
Seehttps://github.com/Pylons/pyramid/pull/3593DeprecationsDeprecated the authentication and authorization interfaces and
principal-based support. See “Upgrading Authentication/Authorization” in
the “What’s New in Pyramid 2.0” chapter of the documentation for information
on equivalent APIs and notes on upgrading. The following APIs are deprecated
as a result of this change:pyramid.config.Configurator.set_authentication_policypyramid.config.Configurator.set_authorization_policypyramid.interfaces.IAuthenticationPolicypyramid.interfaces.IAuthorizationPolicypyramid.request.Request.effective_principalspyramid.request.Request.unauthenticated_useridpyramid.authentication.AuthTktAuthenticationPolicypyramid.authentication.RemoteUserAuthenticationPolicypyramid.authentication.RepozeWho1AuthenticationPolicypyramid.authentication.SessionAuthenticationPolicypyramid.authentication.BasicAuthAuthenticationPolicypyramid.authorization.ACLAuthorizationPolicyTheeffective_principalsview and route predicates.Seehttps://github.com/Pylons/pyramid/pull/3465Deprecatedpyramid.security.principals_allowed_by_permission. This
method continues to work with the deprecatedpyramid.interfaces.IAuthorizationPolicyinterface but will not work with
the newpyramid.interfaces.ISecurityPolicy.
Seehttps://github.com/Pylons/pyramid/pull/3465Deprecated several ACL-related aspects ofpyramid.security. Equivalent
objects should now be imported from thepyramid.authorizationnamespace.
This includes:pyramid.security.Everyonepyramid.security.Authenticatedpyramid.security.ALL_PERMISSIONSpyramid.security.DENY_ALLpyramid.security.ACLAllowedpyramid.security.ACLDeniedSeehttps://github.com/Pylons/pyramid/pull/3563Deprecatedpyramid.session.PickleSerializer.
Seehttps://github.com/pylons/pyramid/issues/2709,
andhttps://github.com/pylons/pyramid/pull/3353,
andhttps://github.com/pylons/pyramid/pull/3413Backward IncompatibilitiesDrop support for Python 2.7, 3.4, and 3.5.
Seehttps://github.com/Pylons/pyramid/pull/3421,
andhttps://github.com/Pylons/pyramid/pull/3547,
andhttps://github.com/Pylons/pyramid/pull/3634Removed thepyramid.compatmodule. Integrators should use thesixmodule or vendor shims they are using into their own codebases going forward.https://github.com/Pylons/pyramid/pull/3421pcreateand the builtin scaffolds have been removed in favor of
using thecookiecuttertool and thepyramid-cookiecutter-startercookiecutter. The script and scaffolds were deprecated in Pyramid 1.8.
Seehttps://github.com/Pylons/pyramid/pull/3406Changed the defaulthashalgonpyramid.authentication.AuthTktCookieHelpertosha512.
Seehttps://github.com/Pylons/pyramid/pull/3557Removedpyramid.interfaces.ITemplateRenderer. This interface was
deprecated since Pyramid 1.5 and was an interface
used by libraries likepyramid_makoandpyramid_chameleonbut
provided no functionality within Pyramid itself.
Seehttps://github.com/Pylons/pyramid/pull/3409Removedpyramid.security.has_permission,pyramid.security.authenticated_userid,pyramid.security.unauthenticated_userid, andpyramid.security.effective_principals. These methods were deprecated
in Pyramid 1.5 and all have equivalents available as properties on the
request. For example,request.authenticated_userid.
Seehttps://github.com/Pylons/pyramid/pull/3410Removed support for supplying a media range to theacceptpredicate of
bothpyramid.config.Configurator.add_viewandpyramid.config.Configurator.add_route. These options were deprecated
in Pyramid 1.10 and WebOb 1.8 because they resulted in uncontrollable
matching that was not compliant with the RFC.
Seehttps://github.com/Pylons/pyramid/pull/3411Removedpyramid.session.UnencryptedCookieSessionFactoryConfig. This
session factory was replaced withpyramid.session.SignedCookieSessionFactoryin Pyramid 1.5 and has been
deprecated since then.
Seehttps://github.com/Pylons/pyramid/pull/3412Removedpyramid.session.signed_serialize, andpyramid.session.signed_deserialize. These methods were only used by
the now-removedpyramid.session.UnencryptedCookieSessionFactoryConfigand were coupled to the vulnerable pickle serialization format which could
lead to remove code execution if the secret key is compromised.
Seehttps://github.com/Pylons/pyramid/pull/3412Changed the defaultserializeronpyramid.session.SignedCookieSessionFactoryto usepyramid.session.JSONSerializerinstead ofpyramid.session.PickleSerializer. Read “Upgrading Session Serialization”
in the “What’s New in Pyramid 2.0” chapter of the documentation for more
information about why this change was made.
Seehttps://github.com/Pylons/pyramid/pull/3413pyramid.request.Request.invoke_exception_viewwill no longer be called
by the default execution policy.
Seehttps://github.com/Pylons/pyramid/pull/3496pyramid.config.Configurator.scanwill no longer, by default, execute
Venusian decorator callbacks registered for categories other than'pyramid'. To find any decorator regardless of category, specifyconfig.scan(...,categories=None).
Seehttps://github.com/Pylons/pyramid/pull/3510The second argument to predicate factories has been changed fromconfigtoinfo, an instance ofpyramid.interfaces.IPredicateInfo. This
limits the data available to predicates but still provides the package,
registry, settings and dotted-name resolver which should cover most use
cases and is largely backward compatible.
Seehttps://github.com/Pylons/pyramid/pull/3514Removed thecheck_csrfpredicate. Instead, usepyramid.config.Configurator.set_default_csrf_optionsand therequire_csrfview option to enable automatic CSRF checking.
Seehttps://github.com/Pylons/pyramid/pull/3521Update the default behavior ofpyramid.authenticationAuthTktAuthenticationPolicyandpyramid.authentication.AuthTktCookieHelperto only set a single cookie
without a domain parameter when no other domain constraints are specified.
Prior to this change,wild_domain=False(the default) was effectively
treated the same aswild_domain=True, in which a cookie was defined
such that browsers would use it both for the request’s domain, as well as
any subdomain. In the new behavior, cookies will only affect the current
domain, and not subdomains, by default.
Seehttps://github.com/Pylons/pyramid/pull/3587Documentation ChangesRestore build of PDF on Read The Docs.
Seehttps://github.com/Pylons/pyramid/issues/3290Fix docs build for Sphinx 2.0.
Seehttps://github.com/Pylons/pyramid/pull/3480Significant updates to the wiki, wiki2 tutorials to demonstrate the new
security policy usage as well as a much more production-ready test harness.
Seehttps://github.com/Pylons/pyramid/pull/3557