security: output_filter has no default value

[andyyyy]

In 1.0.1 there was no setting security.output_filter, yet the output was filtered with htmlentities by default. When migrating to 1.1/develop user has to specify this setting in app/config/config.php or the output will not be filtered.

This is not what user would expect and leads to possible security vulnerabilities. I suggest setting security.output_filter to array('Security::htmlentities') if it is not explicitly set in app/config/config.php,

[WanWizard]

@dhorrigan, @jschreuder: build this in, throw an exception (i.e. make the setting required), or just document it?

I would like to close this before thursday.

[jschreuder]

I agree with defaulting to Security::htmlentities() when it's not set

[WanWizard]

Ok, I'll pick this one up tonight...