[Zope3-dev] Re: views/foo versus context/@@foo

[Martijn Faassen]

Jim Fulton wrote:
[snip snip snip]
>> disappear (or at least generate deprecation warnings), so that in
>> the future, only context/@@foo is possible for views.
> 
> 
> No, absolutely not. It is extremely important that the @@ isn't
> needed in URLs.

Agreed, though you take the possibility for namespace conflicts into
account then. It can still lead to subtle bugs if you just test it in a
shallow fashion and think it works, until someone finally adds an object 
causing it to break.

> I agree that it is probably poort practice to omit the @@ in zpt path
>  expressions.

Yes, it's definitely even worse here, as this can lead to all kinds of
breakages if someone adds an object with wrong name.

>> $ python -c "import this" | grep implicit Explicit is better than
>> implicit.
> 
> 
> We have to balence this against the fact that, in URLs, many people
> don't want to see @@ and, in fact, often don't need to.
> 
> Unfortunately, we don't have a good way to distinguish the different
> kinds of path traversal. In fact, there isn't agreement that we
> should.

As long as we currently realize that the Zope 3 page templates are full 
of potential namespace boobytraps and work towards a solution. One of 
the goals of Zope 3 is to avoid this problem by making the namespaces 
explicit, and we aren't quite there yet.

Somehow we need to fulfill the namespace requirement and satisfy the
'no weird characters in urls' requirement at the same time.

A step in the right direction would indeed be separating URL path 
traversal from ZPT path traversal, and mandating @@ in ZPT. I'd be in 
favor of that as at least we'd be tackling an important source of 
confusion and errors in *part* of the code.

Of course I can't help but say that if 'views/something' were the 
canonical way and not deprecated, we wouldn't have the problem now. Not 
that I don't fully accept that it is indeed deprecated. :)

Regards,

Martijn