[javascript] asURL now escapes request arguments
I can't see no good reason for not escaping parameters. The two main
locations where asURL is used are :
- edition view: here, the change should have no effect
- facets: escaping is clearly needed in that case
# permissions for "meta" entity type (readable by anyone, can only be
# added/deleted by managers)
META_ETYPE_PERMS = {
'read': ('managers', 'users', 'guests',),
'add': ('managers',),
'delete': ('managers',),
'update': ('managers', 'owners',),
}
# permissions for "meta" relation type (readable by anyone, can only be
# added/deleted by managers)
META_RTYPE_PERMS = {
'read': ('managers', 'users', 'guests',),
'add': ('managers',),
'delete': ('managers',),
}
# permissions for relation type that should only set by hooks using unsafe
# execute, readable by anyone
HOOKS_RTYPE_PERMS = {
'read': ('managers', 'users', 'guests',),
'add': (),
'delete': (),
}