[z3-five] Adaptation in untrusted code

[Martin Aspeli]

Chris Withers <chris <at> simplistix.co.uk> writes:

> 
> Martin Aspeli wrote:
> >> Indeed. Can you give me a simple example of how you'd do this as a view?
> >> Philipp said that views adapt the request, whereas no request is
> >> involved here and nor do I want it do be...
> > 
> > Where are you doing this?
> 
> Why does it matter? What do you mean by "where"? I'm doing it wherever I 
> want a rendering of an object relative to another object and maybe with 
> a title override. This is primarily for creating internal linking around 
> a site but I want to re-use it for things like listing on a contents 
> view, etc.
> 
> > In general, if you register a view, you give it a name and you say
> > what interface it can be available on (or * for any type):
> > 
> > <browser:page
> 
> Why browser:page? I _only_ want to be able to do:

browser:view, then

> tal:content="structure obj/ <at>  <at> render"
> 
> ...and I think I can get away with not having an explicit context. I 
> certainly don't need the title override.

Every adapter has a context. A view also knows something about its request, 
which you can use or not use. This all comes from the fact that you are 
traversing to the view (foo/@@view) rather than looknig it up in code 
explicitly.

> >   name="foo"
> >   for=".interfaces.IMyType"
> >   template="some-template.pt"
> 
> I don't need a template here, I already have an set of adapters for my 
> objects which do what I want. I just want to be able to use them sanely 
> from inside ZPT's, see my other post.

Skip the template but then.

The point is that if you have a page template anyway, you could make the 
template be bound to a view, so that you could put all the rendering logic 
specific tot his template in the view class and access it in TAL via the 
implicit 'view' variable.

> > So, you traverse to /mytype/ <at>  <at> foo (the  <at>  <at>  is optional, 
but disambiguates).
> 
> I'd prefer these to be traversable inside a ZPT but not in a URL, but 
> I'd put up with them being url traversable if I really must.

If you use a view class for the template then you can restrict however you 
wish. Traversal in ZPT and in URLs are very tightly bound to one another, so 
I'm not sure how you could allow one but not the other. But if you had a view 
class that was preparing data, then it could use a regular adapter and not a 
view.

> > If your class derives from Products.Five.browser.BrowserView (I assume
> > you're on Zope 2 underneath, if not it's
> > zope.publisher.browser.BrowserView I think), you can override
> > __call__() to do whatever (using self.context and self.request as
> > appropriate).
> 
> Dammit, why can't I just use a simple adapter 

You can. You just can't traverse to an adapter using foo/@@adapter_name as you 
seem to want to do. You can either do it in a view class and return the 
rendered result for use in TAL, or you can have a view on foo that does 
whatever. See also my other reply to your post on z3-user.

Martin