[ZCM] [ZC] 1169/ 8 Comment "DTML misses new builtins"

[Collector: Zope Bugs, Features, and Patches ...]

Issue #1169 Update (Comment) "DTML misses new builtins"
 Status Accepted, Zope/bug+solution medium
To followup, visit:
  http://zope.org/Collectors/Zope/1169

==============================================================
= Comment - Entry #8 by Dirk.Datzert on Jan 10, 2004 11:10 am

Hi all,

Zope 2.6.3 itself is broken as it is not possible to rename objects via ZMI. 

lib/python/OFS/dtml/renameForm.dtml:27:   "_.max(40,_.len(getId())+4)">" value="&dtml-id;" />  

I get an AttributeError for max !

Regards,
Dirk
________________________________________
= Comment - Entry #7 by ctheune on Jan 9, 2004 6:18 pm

Btw: I think Tres' mentioned second solution is better,
but maybe somebody can tell me if it's not. 
________________________________________
= Comment - Entry #6 by ctheune on Jan 9, 2004 6:17 pm

Yuppie: Isn't that because OOM became integral part of ZOpe 2.7? Zope 2.6 actually does not.

Anyway. Zope-2_6-branch returns this for me:

<TemplateDict object at 0x94e4388>

when I use the earlier mentioned DTML code with _.min


________________________________________
= Comment - Entry #5 by yuppie on Jan 9, 2004 6:11 pm

FYI: Zope-2_7-branch and HEAD use the same dtml line as OrderedObjectManager. You can see the Zope 2.7 main.dtml is broken if you add more than one item to an OrderedFolder.
________________________________________
= Comment - Entry #4 by ctheune on Jan 9, 2004 2:56 pm

I checked the smallest possible case:

do

<dtml-var "_.min([1,2])">

in a Zope 2.6.3 of your choice in a dtml-Method. This should break at   /Zope-2.6-CVS/lib/python/DocumentTemplate/DT_Util.py(205)eval()

________________________________________
= Assign - Entry #3 by ctheune on Jan 9, 2004 2:40 pm

Well, one thing I found is this:

_.range(1,_.min(5,_.len(objectIds())))

which is from the OrderedObjectManager that monkeypatches
ObjectManager.manage_main

OOM is available from http://zope.org/Members/mjablonski/OrderedObjectManager/1.4.1/OrderedObjectManager-1.4.1.tar.gz

I would like to see those very widely used Products not to be broken by a bugfix release.


________________________________________
= Accept - Entry #2 by tseaver on Jan 9, 2004 1:03 pm

 Status: Pending => Accepted

 Supporters added: tseaver

I see two issues here:

 1. Because DocumentTemplate is not supposed to depend on
    AccessControl, DT_Utils does its own dance with the
    RestrictedPython version of 'safe_builtins'.
    AccessControl.DTML already stomps on
    DT_Util.TemplateDict, adding the various 'Security*'
    names.  We should just make it stomp the "correct"
    'safe_builtins' as well.

 2. AccessControl.ZopeGuards makes a copy of
    RestrictedPythonGuards.safe_builtins, and then
    morphs it.  Given that we expect other packages
    (e.g., page templates, python scripts) to depend
    on the "abstract" RestrictedPython, rather than the
    "concrete" AccessControl, we should perhaps be
    morphing the RestrictedPython version in place.
________________________________________
= Request - Entry #1 by tseaver on Jan 9, 2004 12:56 pm

Christian Theune asked:

> I have the strange feeling that somebody forgot to include the
> AccessControl.ZopeGuard.safe_builtins for DTML.
>
> See DT_Utils.py around line 56 and the corresponding imports as well
> as the definition of safe_builtins in ZopeGuard.py.
>
> Could someone verify this?


==============================================================