From tseaver at palladion.com  Tue Oct 11 11:00:37 2005
From: tseaver at palladion.com (Tres Seaver)
Date: Sun Aug 10 17:05:20 2008
Subject: [ZPT-CVS] CVS: Products/PageTemplates/tests -
	testZRPythonExpr.py:1.1.2.1
Message-ID: <20051011150037.5D9CD203474@mail.zope.org>

Update of /cvs-repository/Products/PageTemplates/tests
In directory cvs.zope.org:/tmp/cvs-serv30274/lib/python/Products/PageTemplates/tests

Added Files:
      Tag: Zope-2_7-branch
	testZRPythonExpr.py 
Log Message:


  - Collector #1914: Harden 'call_with_ns' (in
    'Products.PageTemplates.ZRPythonExpr') against namespaces from other
    callers than page templates.


=== Added File Products/PageTemplates/tests/testZRPythonExpr.py ===
""" Unit tests for Products.PageTemplates.ZRPythonExpr

$Id
"""
import unittest

class MiscTests(unittest.TestCase):

    def test_call_with_ns_prefer_context_to_here(self):
        from Products.PageTemplates.ZRPythonExpr import call_with_ns
        context = ['context']
        here = ['here']
        request = {'request': 1}
        names = {'context' : context, 'here': here, 'request' : request}
        result = call_with_ns(lambda td: td.this, names)
        self.failUnless(result is context, result)

    def test_call_with_ns_no_context_or_here(self):
        from Products.PageTemplates.ZRPythonExpr import call_with_ns
        request = {'request': 1}
        names = {'request' : request}
        result = call_with_ns(lambda td: td.this, names)
        self.failUnless(result is None, result)

    def test_call_with_ns_no_request(self):
        from Products.PageTemplates.ZRPythonExpr import call_with_ns
        context = ['context']
        here = ['here']
        names = {'context' : context, 'here': here}

        def _find_request(td):
            ns = td._pop()              # peel off 'ns'
            instance_dict = td._pop()   # peel off InstanceDict
            request = td._pop()
            td._push(request)
            td._push(instance_dict)
            td._push(ns)
            return request

        result = call_with_ns(_find_request, names)
        self.assertEqual(result, {})
 
def test_suite():
    return unittest.makeSuite(MiscTests)

if __name__ == '__main__':
    unittest.main(defaultTest='test_suite')



From tseaver at palladion.com  Tue Oct 11 11:01:07 2005
From: tseaver at palladion.com (Tres Seaver)
Date: Sun Aug 10 17:05:20 2008
Subject: [ZPT-CVS] CVS: Products/PageTemplates - ZRPythonExpr.py:1.10.68.2
Message-ID: <20051011150107.4DC52203473@mail.zope.org>

Update of /cvs-repository/Products/PageTemplates
In directory cvs.zope.org:/tmp/cvs-serv30274/lib/python/Products/PageTemplates

Modified Files:
      Tag: Zope-2_7-branch
	ZRPythonExpr.py 
Log Message:


  - Collector #1914: Harden 'call_with_ns' (in
    'Products.PageTemplates.ZRPythonExpr') against namespaces from other
    callers than page templates.


=== Products/PageTemplates/ZRPythonExpr.py 1.10.68.1 => 1.10.68.2 ===
--- Products/PageTemplates/ZRPythonExpr.py:1.10.68.1	Thu Jan  8 18:33:49 2004
+++ Products/PageTemplates/ZRPythonExpr.py	Tue Oct 11 11:00:36 2005
@@ -62,8 +62,11 @@
 
 def call_with_ns(f, ns, arg=1):
     td = Rtd()
-    td.this = ns['here']
-    td._push(ns['request'])
+    # prefer 'context' to 'here';  fall back to 'None'
+    this = ns.get('context', ns.get('here'))
+    td.this = this
+    request = ns.get('request', {})
+    td._push(request)
     td._push(InstanceDict(td.this, td))
     td._push(ns)
     try: