[Zope3-dev] ILocation code in zope/app/form/editview.py

[Roger Ineichen]

Hi Gary

Behalf Of Gary Poster
> Sent: Tuesday, March 08, 2005 8:49 PM
> To: zope3-dev (E-mail)
> Subject: [Zope3-dev] ILocation code in zope/app/form/editview.py
> 
> Roger pointed out a problem with the new security checks in 
> zope/app/form/utility.py, setUpEditWidgets, when used in conjunction 
> with the LocationProxy.
> 
> I've looked at it a bit: it's a bit thorny, with proxies inside of 
> proxies and some odd code.  Jim's suggestion was to try and 
> bypass the 
> whole problem: get rid of the LocationProxy in editview.  I like this 
> idea, but we need to make sure that everyone agrees.  Here's the 
> current pertinent code.
> 
>      def _setUpWidgets(self):
>          adapted = self.schema(self.context)
>          if adapted is not self.context:
>              if not ILocation.providedBy(adapted):
>                  adapted = LocationProxy(adapted)
>              adapted.__parent__ = self.context
>          self.adapted = adapted
>          setUpEditWidgets(self, self.schema, source=self.adapted,
>                           names=self.fieldNames)
> 
> Jim's proposal is that this become the following:
> 
>      def _setUpWidgets(self):
>          self.adapted = self.schema(self.context)
>          setUpEditWidgets(self, self.schema, source=self.adapted,
>                           names=self.fieldNames)

Let's try it this way.
I'm not happy with the LocationProxy too. But I can't tell
it right now what this means to our framework right now.
I have to write more tests.

Right now I feel it's OK to remove the LocationProxy out
of the EditView.

CAn you do it right now? If not how can we check if we have 
a trusted adapter and just let this adapter pass the LocationProxy?

Let's do it and see whats next.

But I think that's just a workarround and I feel not 
very good about it.

btw.
We use a ContainerProxy adapter where we use as a 
additional IContainer implementation. This makes also 
use of LocationProxy for it's items.
Hm, I really have to add more tests for this and check
who the proxy/checker get's added.

I think theres a deeper problem in the proxy/checker and 
trusted adapter concept. I'm sure they don't work well
together in different combinations.

I have to take a look with Dominik at this part till
I can give the right answer.

> If the adapter is trusted and implements ILocation, the 
> trusted adapter 
> factory will set the __parent__ and __name__ itself.  Most or all 
> trusted adapters will want to do this.  If a normal adapter wants to 
> care about the location of its context, it receives it and 
> can do with 
> it what it wills.  This may also have been added before the 
> local site 
> was a thread global, so local component lookup was harder.
> 
> Roger, this would mean that my suggestion of having your adapters 
> implement ILocation would in fact be the proper thing to do.
> 
> Thoughts?
> 
> Gary
> 
> _______________________________________________
> Zope3-dev mailing list
> Zope3-dev at zope.org
> Unsub: 
> http://mail.zope.org/mailman/options/zope3-dev/dev%40projekt01.ch
> 
>