[Zope3-dev] Making a JobBoardEditView, issues

[Jeffrey P Shell]

So, I finally managed to smuggle some free time to myself to install 
Python from CVS and Zope 3, which I've found to still be quite rough.  
I installed the JobBoardEx product, played around, noticed that one 
couldn't actually edit jobs.  So, I thought "Hmmm, good chance to see 
how easy it is to write and register a new view for editing these 
things!", and went about and did it.

So, I put together a new simple component called JobBoardEditor, with 
the following configure.zcml::

<zopeConfigure
          xmlns='http://namespaces.zope.org/zope'
          xmlns:browser='http://namespaces.zope.org/browser'
 >
<browser:view
     for="ZopeProducts.JobBoardEx.IJob."
     factory=".EditJobView."
     permission="Zope.ManageContent">

   <browser:page name="edit.html"    attribute="edit_form" />
   <browser:page name="edit.method"  attribute="edit" />

</browser:view>
</zopeConfigure>

I then copied and modified the JobBoardEx/edit.pt to set the values on 
the edit fields from the context, and used the following class to be 
the actual editor::

class EditJobView(BrowserView):
     edit_form = ViewPageTemplateFile('edit.pt')

     def edit(self):
         form = self.request.form

         job = self.context

         ## Set attributes, defaulting to existing values
         job.submitter = form.get('submitter', job.submitter)
         job.summary = form.get('summary', job.summary)
         job.description = form.get('description', job.description)
         job.contact = form.get('contact', job.contact)

         response = self.request.response
         response.redirect('../')

And then I put this in products.zcml after JobBoardEx, and before long 
it was all working fine.  Brute, but fine.

Well, not all.  At this point, I get a security error for setting the 
attributes on
'job' from untrusted code.  What can be done at this point?  Is there a 
way to get an EditJobView to be trusted?  Or should JobBoardEx/Job.py 
be made to be a more fleshed out class with new-style properties (and 
thus setter methods), or Schema fields?  Or should I, as an author of 
an editor component for IJob subclass JobBoardEx.Job.Job, and register 
that to be the default IJob implementation for the Job Board?

I want to write up my experiences with this exercise as it's actually a 
pretty cool thing - being able to write a new Editor view/controller 
component for another component in the system.

---
Jeffrey P Shell
jeffrey@cuemedia.com