Need to update the doc for firsof and cycle tag behaviour with autoescaping on

[krystal]

When you use {% firstof var1 var2 %}, output is not magically escaped as filter is a tag, which can lead to XSS vulnerability.

The "core" issue has been reported on #10834 ; it seems like everyone is ok to say that something needs to be done, but it won't be immediate.

I think that the current documentation is missleading as we don't say explicitly that var won't be escaped, and I think it the doc should be corrected for 1.1.

Here is a patch, written with my poor english, to help people don't fall in the trap.

[krystal]

Oups, bad cut&paste, I mean ticket #10912

[Alex Gaynor]

Fixed in r11163

[Jacob]

Milestone 1.1 deleted