# HG changeset patch
# User Julien Cristau <julien.cristau@logilab.fr>
# Date 1394470442 -3600
# Node ID e8b9a3d23ad93e47391fe566012812245f2a751b
# Parent  b87c09f853d3cfe13174fb23f58960f45ac17e2c
[web/request] deprecate user_callback

Storing closures in session data considered harmful.  Closes #3567793

diff -r b87c09f853d3 -r e8b9a3d23ad9 doc/3.19.rst
--- a/doc/3.19.rst	Fri Mar 07 10:27:14 2014 +0100
+++ b/doc/3.19.rst	Mon Mar 10 17:54:02 2014 +0100
@@ -143,6 +143,10 @@
   a composite relation does not entail any more the deletion of the
   component side of the relation.
 
+* ``_cw.user_callback`` and ``_cw.user_rql_callback`` are deprecated.  Users
+  are encouraged to write an actual controller (e.g. using ``ajaxfunc``)
+  instead of storing a closure in the session data.
+
 
 Deprecated Code Drops
 ----------------------
diff -r b87c09f853d3 -r e8b9a3d23ad9 web/request.py
--- a/web/request.py	Fri Mar 07 10:27:14 2014 +0100
+++ b/web/request.py	Mon Mar 10 17:54:02 2014 +0100
@@ -416,6 +416,7 @@
             req.execute(rql, args, key)
         return self.user_callback(rqlexec, rqlargs, *args, **kwargs)
 
+    @deprecated('[3.19] use a traditional ajaxfunc / controller')
     def user_callback(self, cb, cbargs, *args, **kwargs):
         """register the given user callback and return a URL which can
         be inserted in an HTML view. When the URL is accessed, the