![[tokkee]](http://tokkee.org/images/avatar.png){kind=avatar}
index 797cd1370622ee3c900d8cf6d87c80cc1b429e11..3cb9780c909f94bb833018cce663673f09ec2971 100644 (file)
from roundup import i18n
from roundup.i18n import _
+from KeywordsExpr import render_keywords_expression_editor
+
try:
import cPickle as pickle
except ImportError:
if os.path.exists(src):
return (src, generic)
- raise NoTemplate, 'No template file exists for templating "%s" '\
+ raise NoTemplate('No template file exists for templating "%s" '
'with template "%s" (neither "%s" nor "%s")'%(name, view,
- filename, generic)
+ filename, generic))
class Templates:
templates = {}
return self.templates[src]
# compile the template
- self.templates[src] = pt = RoundupPageTemplate()
+ pt = RoundupPageTemplate()
# use pt_edit so we can pass the content_type guess too
content_type = mimetypes.guess_type(filename)[0] or 'text/html'
pt.pt_edit(open(src).read(), content_type)
pt.id = filename
pt.mtime = stime
+ # Add it to the cache. We cannot do this until the template
+ # is fully initialized, as we could otherwise have a race
+ # condition when running with multiple threads:
+ #
+ # 1. Thread A notices the template is not in the cache,
+ # adds it, but has not yet set "mtime".
+ #
+ # 2. Thread B notices the template is in the cache, checks
+ # "mtime" (above) and crashes.
+ #
+ # Since Python dictionary access is atomic, as long as we
+ # insert "pt" only after it is fully initialized, we avoid
+ # this race condition. It's possible that two separate
+ # threads will both do the work of initializing the template,
+ # but the risk of wasted work is offset by avoiding a lock.
+ self.templates[src] = pt
return pt
def __getitem__(self, name):
def is_edit_ok(self):
""" Is the user allowed to Create the current class?
"""
- return self._db.security.hasPermission('Create', self._client.userid,
- self._classname)
+ perm = self._db.security.hasPermission
+ return perm('Web Access', self._client.userid) and perm('Create',
+ self._client.userid, self._classname)
def is_retire_ok(self):
""" Is the user allowed to retire items of the current class?
"""
- return self._db.security.hasPermission('Retire', self._client.userid,
- self._classname)
+ perm = self._db.security.hasPermission
+ return perm('Web Access', self._client.userid) and perm('Retire',
+ self._client.userid, self._classname)
def is_view_ok(self):
""" Is the user allowed to View the current class?
"""
- return self._db.security.hasPermission('View', self._client.userid,
- self._classname)
+ perm = self._db.security.hasPermission
+ return perm('Web Access', self._client.userid) and perm('View',
+ self._client.userid, self._classname)
def is_only_view_ok(self):
""" Is the user only allowed to View (ie. not Create) the current class?
for klass, htmlklass in propclasses:
if not isinstance(prop, klass):
continue
- if isinstance(prop, hyperdb.Multilink):
- value = []
- else:
- value = None
+ value = prop.get_default_value()
return htmlklass(self._client, self._classname, None, prop, item,
value, self._anonymous)
l = []
for name, prop in self._props.items():
for klass, htmlklass in propclasses:
- if isinstance(prop, hyperdb.Multilink):
- value = []
- else:
- value = None
if isinstance(prop, klass):
+ value = prop.get_default_value()
l.append(htmlklass(self._client, self._classname, '',
- prop, name, value, self._anonymous))
+ prop, name, value, self._anonymous))
if sort:
l.sort(lambda a,b:cmp(a._name, b._name))
return l
# check perms
check = self._client.db.security.hasPermission
userid = self._client.userid
+ if not check('Web Access', userid):
+ return []
l = [HTMLItem(self._client, self._classname, id) for id in l
if check('View', userid, self._classname, itemid=id)]
writer = csv.writer(s)
writer.writerow(props)
check = self._client.db.security.hasPermission
+ userid = self._client.userid
+ if not check('Web Access', userid):
+ return ''
for nodeid in self._klass.list():
l = []
for name in props:
# check permission to view this property on this item
- if not check('View', self._client.userid, itemid=nodeid,
+ if not check('View', userid, itemid=nodeid,
classname=self._klass.classname, property=name):
raise Unauthorised('view', self._klass.classname,
translator=self._client.translator)
"request" takes precedence over the other three arguments.
"""
+ security = self._db.security
+ userid = self._client.userid
if request is not None:
+ # for a request we asume it has already been
+ # security-filtered
filterspec = request.filterspec
sort = request.sort
group = request.group
+ else:
+ cn = self.classname
+ filterspec = security.filterFilterspec(userid, cn, filterspec)
+ sort = security.filterSortspec(userid, cn, sort)
+ group = security.filterSortspec(userid, cn, group)
- check = self._db.security.hasPermission
- userid = self._client.userid
+ check = security.hasPermission
+ if not check('Web Access', userid):
+ return []
l = [HTMLItem(self._client, self.classname, id)
for id in self._klass.filter(None, filterspec, sort, group)
def is_edit_ok(self):
""" Is the user allowed to Edit this item?
"""
- return self._db.security.hasPermission('Edit', self._client.userid,
- self._classname, itemid=self._nodeid)
+ perm = self._db.security.hasPermission
+ return perm('Web Access', self._client.userid) and perm('Edit',
+ self._client.userid, self._classname, itemid=self._nodeid)
def is_retire_ok(self):
""" Is the user allowed to Reture this item?
"""
- return self._db.security.hasPermission('Retire', self._client.userid,
- self._classname, itemid=self._nodeid)
+ perm = self._db.security.hasPermission
+ return perm('Web Access', self._client.userid) and perm('Retire',
+ self._client.userid, self._classname, itemid=self._nodeid)
def is_view_ok(self):
""" Is the user allowed to View this item?
"""
- if self._db.security.hasPermission('View', self._client.userid,
- self._classname, itemid=self._nodeid):
+ perm = self._db.security.hasPermission
+ if perm('Web Access', self._client.userid) and perm('View',
+ self._client.userid, self._classname, itemid=self._nodeid):
return 1
return self.is_edit_ok()
cell[-1] += ' -> %s'%current[k]
current[k] = val
+ elif isinstance(prop, hyperdb.Password) and args[k] is not None:
+ val = args[k].dummystr()
+ cell.append('%s: %s'%(self._(k), val))
+ if current.has_key(k):
+ cell[-1] += ' -> %s'%current[k]
+ current[k] = val
+
elif not args[k]:
if current.has_key(k):
cell.append('%s: %s'%(self._(k), current[k]))
return self._db.security.hasPermission(permission,
self._nodeid, classname, property, itemid)
- def hasRole(self, rolename):
- """Determine whether the user has the Role."""
- roles = self._db.user.get(self._nodeid, 'roles').split(',')
- for role in roles:
- if role.strip() == rolename: return True
- return False
+ def hasRole(self, *rolenames):
+ """Determine whether the user has any role in rolenames."""
+ return self._db.user.has_role(self._nodeid, *rolenames)
def HTMLItem(client, classname, nodeid, anonymous=0):
if classname == 'user':
self._anonymous = anonymous
self._name = name
if not anonymous:
- self._formname = '%s%s@%s'%(classname, nodeid, name)
+ if nodeid:
+ self._formname = '%s%s@%s'%(classname, nodeid, name)
+ else:
+ # This case occurs when creating a property for a
+ # non-anonymous class.
+ self._formname = '%s@%s'%(classname, name)
else:
self._formname = name
HTMLInputMixin.__init__(self)
def __repr__(self):
- return '<HTMLProperty(0x%x) %s %r %r>'%(id(self), self._formname,
- self._prop, self._value)
+ classname = self.__class__.__name__
+ return '<%s(0x%x) %s %r %r>'%(classname, id(self), self._formname,
+ self._prop, self._value)
def __str__(self):
return self.plain()
def __cmp__(self, other):
property. Check "Create" for new items, or "Edit" for existing
ones.
"""
+ perm = self._db.security.hasPermission
+ userid = self._client.userid
if self._nodeid:
- return self._db.security.hasPermission('Edit', self._client.userid,
- self._classname, self._name, self._nodeid)
- return self._db.security.hasPermission('Create', self._client.userid,
- self._classname, self._name) or \
- self._db.security.hasPermission('Register', self._client.userid,
- self._classname, self._name)
+ if not perm('Web Access', userid):
+ return False
+ return perm('Edit', userid, self._classname, self._name,
+ self._nodeid)
+ return perm('Create', userid, self._classname, self._name) or \
+ perm('Register', userid, self._classname, self._name)
def is_view_ok(self):
""" Is the user allowed to View the current class?
"""
- if self._db.security.hasPermission('View', self._client.userid,
- self._classname, self._name, self._nodeid):
+ perm = self._db.security.hasPermission
+ if perm('Web Access', self._client.userid) and perm('View',
+ self._client.userid, self._classname, self._name, self._nodeid):
return 1
return self.is_edit_ok()
)''', re.X | re.I)
protocol_re = re.compile('^(ht|f)tp(s?)://', re.I)
- def _hyper_repl_item(self,match,replacement):
+
+
+ def _hyper_repl(self, match):
+ if match.group('url'):
+ return self._hyper_repl_url(match, '<a href="%s">%s</a>%s')
+ elif match.group('email'):
+ return self._hyper_repl_email(match, '<a href="mailto:%s">%s</a>')
+ elif len(match.group('id')) < 10:
+ return self._hyper_repl_item(match,
+ '<a href="%(cls)s%(id)s">%(item)s</a>')
+ else:
+ # just return the matched text
+ return match.group(0)
+
+ def _hyper_repl_url(self, match, replacement):
+ u = s = match.group('url')
+ if not self.protocol_re.search(s):
+ u = 'http://' + s
+ end = ''
+ if '>' in s:
+ # catch an escaped ">" in the URL
+ pos = s.find('>')
+ end = s[pos:]
+ u = s = s[:pos]
+ if ')' in s and s.count('(') != s.count(')'):
+ # don't include extraneous ')' in the link
+ pos = s.rfind(')')
+ end = s[pos:] + end
+ u = s = s[:pos]
+ return replacement % (u, s, end)
+
+ def _hyper_repl_email(self, match, replacement):
+ s = match.group('email')
+ return replacement % (s, s)
+
+ def _hyper_repl_item(self, match, replacement):
item = match.group('item')
cls = match.group('class').lower()
id = match.group('id')
except KeyError:
return item
- def _hyper_repl(self, match):
- if match.group('url'):
- u = s = match.group('url')
- if not self.protocol_re.search(s):
- u = 'http://' + s
- # catch an escaped ">" at the end of the URL
- if s.endswith('>'):
- u = s = s[:-4]
- e = '>'
- else:
- e = ''
- return '<a href="%s">%s</a>%s'%(u, s, e)
- elif match.group('email'):
- s = match.group('email')
- return '<a href="mailto:%s">%s</a>'%(s, s)
- else:
- return self._hyper_repl_item(match,
- '<a href="%(cls)s%(id)s">%(item)s</a>')
def _hyper_repl_rst(self, match):
if match.group('url'):
elif match.group('email'):
s = match.group('email')
return '`%s <mailto:%s>`_'%(s, s)
- else:
+ elif len(match.group('id')) < 10:
return self._hyper_repl_item(match,'`%(item)s <%(cls)s%(id)s>`_')
+ else:
+ # just return the matched text
+ return match.group(0)
def hyperlinked(self):
""" Render a "hyperlinked" version of the text """
if self._value is None:
return ''
- return self._('*encrypted*')
+ value = self._value.dummystr()
+ if escape:
+ value = cgi.escape(value)
+ return value
def field(self, size=30, **kwargs):
""" Render a form edit field for the property.
**kwargs)
def menu(self, size=None, height=None, showid=0, additional=[], value=None,
- sort_on=None, html_kwargs = {}, **conditions):
+ sort_on=None, html_kwargs={}, translate=True, **conditions):
""" Render a form select list for this property
"size" is used to limit the length of the list labels
(direction, property) where direction is '+' or '-'. A
single string with the direction prepended may be used.
For example: ('-', 'order'), '+name'.
+ "html_kwargs" specified additional html args for the
+ generated html <select>
+ "translate" indicates if we should do translation of labels
+ using gettext -- this is often desired (e.g. for status
+ labels) but sometimes not.
The remaining keyword arguments are used as conditions for
filtering the items in the list - they're passed as the
lab = lab + ' (%s)'%', '.join(m)
# and generate
- lab = cgi.escape(self._(lab))
+ tr = str
+ if translate:
+ tr = self._
+ lab = cgi.escape(tr(lab))
l.append('<option %svalue="%s">%s</option>'%(s, optionid, lab))
l.append('</select>')
return '\n'.join(l)
check = self._db.security.hasPermission
userid = self._client.userid
classname = self._prop.classname
- for value in values:
- if check('View', userid, classname, itemid=value):
- yield HTMLItem(self._client, classname, value)
+ if check('Web Access', userid):
+ for value in values:
+ if check('View', userid, classname, itemid=value):
+ yield HTMLItem(self._client, classname, value)
def __iter__(self):
""" iterate and return a new HTMLItem
return self.plain(escape=1)
linkcl = self._db.getclass(self._prop.classname)
- value = self._value[:]
- # map the id to the label property
- if not linkcl.getkey():
- showid=1
- if not showid:
- k = linkcl.labelprop(1)
- value = lookupKeys(linkcl, k, value)
- value = ','.join(value)
- return self.input(name=self._formname, size=size, value=value,
- **kwargs)
+
+ if 'value' not in kwargs:
+ value = self._value[:]
+ # map the id to the label property
+ if not linkcl.getkey():
+ showid=1
+ if not showid:
+ k = linkcl.labelprop(1)
+ value = lookupKeys(linkcl, k, value)
+ value = ','.join(value)
+ kwargs["value"] = value
+
+ return self.input(name=self._formname, size=size, **kwargs)
def menu(self, size=None, height=None, showid=0, additional=[],
- value=None, sort_on=None, html_kwargs = {}, **conditions):
+ value=None, sort_on=None, html_kwargs={}, translate=True,
+ **conditions):
""" Render a form <select> list for this property.
"size" is used to limit the length of the list labels
lab = lab + ' (%s)'%', '.join(m)
# and generate
- lab = cgi.escape(self._(lab))
+ tr = str
+ if translate:
+ tr = self._
+ lab = cgi.escape(tr(lab))
l.append('<option %svalue="%s">%s</option>'%(s, optionid,
lab))
l.append('</select>')
return '\n'.join(l)
+
# set the propclasses for HTMLItem
-propclasses = (
+propclasses = [
(hyperdb.String, StringHTMLProperty),
(hyperdb.Number, NumberHTMLProperty),
(hyperdb.Boolean, BooleanHTMLProperty),
(hyperdb.Password, PasswordHTMLProperty),
(hyperdb.Link, LinkHTMLProperty),
(hyperdb.Multilink, MultilinkHTMLProperty),
-)
+]
+
+def register_propclass(prop, cls):
+ for index,propclass in enumerate(propclasses):
+ p, c = propclass
+ if prop == p:
+ propclasses[index] = (prop, cls)
+ break
+ else:
+ propclasses.append((prop, cls))
+
def make_sort_function(db, classname, sort_on=None):
- """Make a sort function for a given class
+ """Make a sort function for a given class.
+
+ The list being sorted may contain mixed ids and labels.
"""
linkcl = db.getclass(classname)
if sort_on is None:
sort_on = linkcl.orderprop()
def sortfunc(a, b):
- return cmp(linkcl.get(a, sort_on), linkcl.get(b, sort_on))
+ if num_re.match(a):
+ a = linkcl.get(a, sort_on)
+ if num_re.match(b):
+ b = linkcl.get(b, sort_on)
+ return cmp(a, b)
return sortfunc
def handleListCGIValue(value):
self.columns = handleListCGIValue(self.form[name])
break
self.show = support.TruthDict(self.columns)
+ security = self._client.db.security
+ userid = self._client.userid
# sorting and grouping
self.sort = []
self.group = []
self._parse_sort(self.sort, 'sort')
self._parse_sort(self.group, 'group')
+ self.sort = security.filterSortspec(userid, self.classname, self.sort)
+ self.group = security.filterSortspec(userid, self.classname, self.group)
# filtering
self.filter = []
self.filterspec[name] = handleListCGIValue(fv)
else:
self.filterspec[name] = fv.value
+ self.filterspec = security.filterFilterspec(userid, self.classname,
+ self.filterspec)
# full-text search argument
self.search_text = None
</script>
"""%self.base
- def batch(self):
+ def batch(self, permission='View'):
""" Return a batch object for results from the "current search"
"""
+ check = self._client.db.security.hasPermission
+ userid = self._client.userid
+ if not check('Web Access', userid):
+ return Batch(self.client, [], self.pagesize, self.startwith,
+ classname=self.classname)
+
filterspec = self.filterspec
sort = self.sort
group = self.group
matches = None
# filter for visibility
- check = self._client.db.security.hasPermission
- userid = self._client.userid
l = [id for id in klass.filter(matches, filterspec, sort, group)
- if check('View', userid, self.classname, itemid=id)]
+ if check(permission, userid, self.classname, itemid=id)]
# return the batch object, using IDs only
return Batch(self.client, l, self.pagesize, self.startwith,
raise AttributeError, name
return self.client.instance.templating_utils[name]
+ def keywords_expressions(self, request):
+ return render_keywords_expression_editor(request)
+
def html_calendar(self, request):
"""Generate a HTML calendar.
html will simply be a table.
"""
- date_str = request.form.getfirst("date", ".")
+ tz = request.client.db.getUserTimezone()
+ current_date = date.Date(".").local(tz)
+ date_str = request.form.getfirst("date", current_date)
display = request.form.getfirst("display", date_str)
template = request.form.getfirst("@template", "calendar")
form = request.form.getfirst("form")