Mention SimpleXMLRPCServer change

1 files changed, 15 insertions, 0 deletions

diff --git a/Doc/whatsnew/whatsnew25.tex b/Doc/whatsnew/whatsnew25.tex
index b39d33b..5bee789 100644
--- a/Doc/whatsnew/whatsnew25.tex
+++ b/Doc/whatsnew/whatsnew25.tex
@@ -1508,6 +1508,14 @@ therefore now works on non-{\UNIX} platforms.
 (Patch from Robert Kiendl.)
 % Patch #1472854
 
+\item The \module{SimpleXMLRPCServer} and \module{DocXMLRPCServer} 
+classes now have a \member{rpc_paths} attribute that constrains
+XML-RPC operations to a limited set of URL paths; the default is
+to allow only \code{'/'} and \code{'/RPC2'}.  Setting 
+\member{rpc_paths} to \code{None} or an empty tuple disables 
+this path checking.
+% Bug #1473048
+
 \item The \module{socket} module now supports \constant{AF_NETLINK}
 sockets on Linux, thanks to a patch from Philippe Biondi.  
 Netlink sockets are a Linux-specific mechanism for communications
@@ -2163,6 +2171,13 @@ longer accept a return value of \code{None} from the
 arguments instead.  The modules also no longer accept the deprecated
 \var{bin} keyword parameter.
 
+\item Library: The \module{SimpleXMLRPCServer} and \module{DocXMLRPCServer} 
+classes now have a \member{rpc_paths} attribute that constrains
+XML-RPC operations to a limited set of URL paths; the default is
+to allow only \code{'/'} and \code{'/RPC2'}.  Setting 
+\member{rpc_paths} to \code{None} or an empty tuple disables 
+this path checking.
+
 \item C API: Many functions now use \ctype{Py_ssize_t} 
 instead of \ctype{int} to allow processing more data on 64-bit
 machines.  Extension code may need to make the same change to avoid