From 0337deefb3b725c55cef5c2b2eed99e8b8de3836 Mon Sep 17 00:00:00 2001 From: Gael Pasgrimaud Date: Mon, 20 Jun 2011 22:22:43 +0200 Subject: [PATCH] basic template now use new UIButtons. add security check to actions. fix tests --- pyramid_formalchemy/actions.py | 21 ++- pyramid_formalchemy/templates/admin/edit.pt | 14 +- .../templates/admin/edit.pt.py | 103 +++------------ .../templates/admin/listing.pt | 7 +- .../templates/admin/listing.pt.py | 93 +++----------- pyramid_formalchemy/templates/admin/master.pt | 1 + .../templates/admin/master.pt.py | 53 ++++---- pyramid_formalchemy/templates/admin/new.pt | 10 +- pyramid_formalchemy/templates/admin/new.pt.py | 95 +++----------- pyramid_formalchemy/templates/admin/show.pt | 13 +- .../templates/admin/show.pt.py | 121 +++--------------- pyramidapp/pyramidapp/models.py | 2 +- pyramidapp/pyramidapp/templates/foolisting.pt | 9 +- .../pyramidapp/templates/foolisting.pt.py | 95 +++----------- pyramidapp/pyramidapp/tests.py | 12 +- 15 files changed, 147 insertions(+), 502 deletions(-) diff --git a/pyramid_formalchemy/actions.py b/pyramid_formalchemy/actions.py index 97f830a..fa6264e 100644 --- a/pyramid_formalchemy/actions.py +++ b/pyramid_formalchemy/actions.py @@ -1,6 +1,7 @@ # -*- coding: utf-8 -*- from chameleon.zpt.template import PageTemplate from pyramid.util import DottedNameResolver +from pyramid.security import has_permission from pyramid_formalchemy.i18n import TranslationString from pyramid_formalchemy.i18n import get_localizer from pyramid_formalchemy.i18n import _ @@ -95,9 +96,10 @@ class Action(object): """ - def __init__(self, id, content="", alt="", attrs=None, **rcontext): + def __init__(self, id, content="", alt="", permission=None, attrs=None, **rcontext): self.id = id self.attrs = attrs or {} + self.permission = permission self.rcontext = rcontext if 'id' not in self.attrs: self.attrs['id'] = repr(id) @@ -275,7 +277,11 @@ class Actions(list): list.__init__(self, [res.maybe_resolve(a) for a in args]) def render(self, request, **kwargs): - return self.sep.join([a.render(request, **kwargs) for a in self]) + allowed_permissions = [] + for a in self: + if a.permission is None or has_permission(a.permission, request.context, request): + allowed_permissions.append(a) + return self.sep.join([a.render(request, **kwargs) for a in allowed_permissions]) def __add__(self, other): actions = list(self)+list(other) @@ -317,7 +323,7 @@ class Languages(Actions): } def __init__(self, *args, **kwargs): - list.__init__(self) + Actions.__init__(self) klass=kwargs.get('class_', ListItem) for l in args: self.append( @@ -331,6 +337,7 @@ class Languages(Actions): new = UIButton( id='new', content=_('New ${model_label}'), + permission='new', icon='ui-icon-circle-plus', attrs=dict(href="request.fa_url(request.model_name, 'new')"), ) @@ -339,6 +346,7 @@ new = UIButton( save = UIButton( id='save', content=_('Save'), + permission='edit', icon='ui-icon-check', attrs=dict(onclick="jQuery(this).parents('form').submit();"), ) @@ -346,6 +354,7 @@ save = UIButton( save_and_add_another = UIButton( id='save_and_add_another', content=_('Save and add another'), + permission='edit', icon='ui-icon-check', attrs=dict(onclick=("var f = jQuery(this).parents('form');" "jQuery('#next', f).val(window.location.href);" @@ -355,6 +364,7 @@ save_and_add_another = UIButton( edit = UIButton( id='edit', content=_('Edit'), + permission='edit', icon='ui-icon-check', attrs=dict(href="request.fa_url(request.model_name, request.model_id, 'edit')"), ) @@ -368,18 +378,17 @@ back = UIButton( delete = UIButton( id='delete', - views='edit', content=_('Delete'), + permission='delete', state='ui-state-error', icon='ui-icon-trash', - attrs=dict(onclick=("string:var f = jQuery(this).parents('form');" + attrs=dict(onclick=("var f = jQuery(this).parents('form');" "f.attr('action', window.location.href.replace('/edit', '/delete'));" "f.submit();")), ) cancel = UIButton( id='cancel', - views='edit', content=_('Cancel'), icon='ui-icon-circle-arrow-w', attrs=dict(href="request.fa_url(request.model_name)"), diff --git a/pyramid_formalchemy/templates/admin/edit.pt b/pyramid_formalchemy/templates/admin/edit.pt index 23faf45..17a4d9a 100644 --- a/pyramid_formalchemy/templates/admin/edit.pt +++ b/pyramid_formalchemy/templates/admin/edit.pt @@ -4,18 +4,8 @@
-
-

- - - - - - ${F_('Cancel')} - -

-
+

+

diff --git a/pyramid_formalchemy/templates/admin/edit.pt.py b/pyramid_formalchemy/templates/admin/edit.pt.py index b1843d5..7adcccc 100644 --- a/pyramid_formalchemy/templates/admin/edit.pt.py +++ b/pyramid_formalchemy/templates/admin/edit.pt.py @@ -3,19 +3,13 @@ def bind(): from cPickle import loads as _loads _lookup_attr = _loads('cchameleon.core.codegen\nlookup_attr\np1\n.') _init_scope = _loads('cchameleon.core.utils\necontext\np1\n.') - _re_amp = _loads("cre\n_compile\np1\n(S'&(?!([A-Za-z]+|#[0-9]+);)'\np2\nI0\ntRp3\n.") - _attrs_4359005584 = _loads('(dp1\n.') - _attrs_4359005840 = _loads('(dp1\nVname\np2\nV_method\np3\nsVtype\np4\nVhidden\np5\nsVvalue\np6\nVPUT\np7\ns.') - _attrs_4359006416 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') - _attrs_4359006672 = _loads('(dp1\nVclass\np2\nVui-widget-header ui-widget-link ui-corner-all\np3\ns.') - _attrs_4359005008 = _loads('(dp1\nVclass\np2\nVui-icon ui-icon-circle-arrow-w\np3\ns.') + _attrs_4356242384 = _loads('(dp1\n.') + _attrs_4356371600 = _loads('(dp1\n.') _init_stream = _loads('cchameleon.core.generation\ninitialize_stream\np1\n.') - _attrs_4359005968 = _loads('(dp1\n.') + _attrs_4356243152 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') _init_default = _loads('cchameleon.core.generation\ninitialize_default\np1\n.') - _attrs_4359006544 = _loads('(dp1\nVhref\np2\nV#\nsVclass\np3\nVui-widget-header ui-widget-link ui-widget-button ui-corner-all\np4\ns.') - _attrs_4359005520 = _loads('(dp1\nVaction\np2\nV\nsVmethod\np3\nVPOST\np4\nsVenctype\np5\nVmultipart/form-data\np6\ns.') - _attrs_4359006736 = _loads("(dp1\nVtype\np2\nVsubmit\np3\nsVvalue\np4\nV${F_('Save')}\np5\ns.") - _attrs_4359005776 = _loads('(dp1\n.') + _attrs_4356370704 = _loads('(dp1\nVaction\np2\nV\nsVmethod\np3\nVPOST\np4\nsVenctype\np5\nVmultipart/form-data\np6\ns.') + _attrs_4356239504 = _loads('(dp1\nVname\np2\nV_method\np3\nsVtype\np4\nVhidden\np5\nsVvalue\np6\nVPUT\np7\ns.') _init_tal = _loads('cchameleon.core.generation\ninitialize_tal\np1\n.') def render(econtext, rcontext=None): macros = econtext.get('macros') @@ -37,15 +31,15 @@ def bind(): def _callback_main(econtext, _repeat, _out=_out, _write=_write, _domain=_domain, **_ignored): if _repeat: repeat.update(_repeat) - attrs = _attrs_4359005584 + attrs = _attrs_4356371600 _write(u'
\n ') - attrs = _attrs_4359005520 + attrs = _attrs_4356370704 u"''" _write(u'
\n ') _default.value = default = '' u'fs.render()' _content = _lookup_attr(econtext['fs'], 'render')() - attrs = _attrs_4359005776 + attrs = _attrs_4356242384 u'_content' _write(u'
') _tmp1 = _content @@ -64,68 +58,16 @@ def bind(): _tmp = str(_tmp) _write(_tmp) _write(u'
\n ') - attrs = _attrs_4359005840 + attrs = _attrs_4356239504 + u"u'\\n '" _write(u'\n ') - attrs = _attrs_4359005968 - _write(u'
\n ') - attrs = _attrs_4359006416 - _write(u'

\n ') - attrs = _attrs_4359006544 - _write(u'\n ') - attrs = _attrs_4359006736 - 'join(value("F_(\'Save\')"),)' - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' value="' + _tmp1) + '"')) - _write(u' />\n \n ') - attrs = _attrs_4359006672 - u'request.fa_url(request.model_name)' - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' href="' + _tmp1) + '"')) - _write(u'>\n ') - attrs = _attrs_4359005008 - u"F_('Cancel')" - _write(u'\n ') - _tmp1 = econtext['F_']('Cancel') + _default.value = default = u'\n ' + u'actions.buttons(request)' + _content = _lookup_attr(econtext['actions'], 'buttons')(econtext['request']) + attrs = _attrs_4356243152 + u'_content' + _write(u'

') + _tmp1 = _content _tmp = _tmp1 if (_tmp.__class__ not in (str, unicode, int, float, )): try: @@ -139,17 +81,8 @@ def bind(): if (_tmp is not None): if not isinstance(_tmp, unicode): _tmp = str(_tmp) - if ('&' in _tmp): - if (';' in _tmp): - _tmp = _re_amp.sub('&', _tmp) - else: - _tmp = _tmp.replace('&', '&') - if ('<' in _tmp): - _tmp = _tmp.replace('<', '<') - if ('>' in _tmp): - _tmp = _tmp.replace('>', '>') _write(_tmp) - _write(u'\n \n

\n
\n
\n
\n') + _write(u'

\n \n \n') u"{'main': _callback_main}" _tmp = {'main': _callback_main, } u"main.macros['master']" diff --git a/pyramid_formalchemy/templates/admin/listing.pt b/pyramid_formalchemy/templates/admin/listing.pt index 66f66dd..e0bf70d 100644 --- a/pyramid_formalchemy/templates/admin/listing.pt +++ b/pyramid_formalchemy/templates/admin/listing.pt @@ -3,12 +3,7 @@
-

- - - ${F_('New')} ${model_name} - +

diff --git a/pyramid_formalchemy/templates/admin/listing.pt.py b/pyramid_formalchemy/templates/admin/listing.pt.py index 6a5a24a..173f22a 100644 --- a/pyramid_formalchemy/templates/admin/listing.pt.py +++ b/pyramid_formalchemy/templates/admin/listing.pt.py @@ -3,16 +3,13 @@ def bind(): from cPickle import loads as _loads _lookup_attr = _loads('cchameleon.core.codegen\nlookup_attr\np1\n.') _init_scope = _loads('cchameleon.core.utils\necontext\np1\n.') - _re_amp = _loads("cre\n_compile\np1\n(S'&(?!([A-Za-z]+|#[0-9]+);)'\np2\nI0\ntRp3\n.") - _attrs_4359083472 = _loads('(dp1\nVclass\np2\nVui-widget-header ui-widget-link ui-corner-all\np3\ns.') - _attrs_4359083344 = _loads('(dp1\n.') - _attrs_4359083216 = _loads('(dp1\nVclass\np2\nVui-pager\np3\ns.') + _attrs_4353960208 = _loads('(dp1\nVclass\np2\nVlayout-grid\np3\ns.') + _attrs_4353960144 = _loads('(dp1\nVclass\np2\nVui-pager\np3\ns.') _init_stream = _loads('cchameleon.core.generation\ninitialize_stream\np1\n.') - _attrs_4359083600 = _loads('(dp1\nVclass\np2\nVui-icon ui-icon-circle-plus\np3\ns.') - _attrs_4359083088 = _loads('(dp1\n.') + _attrs_4353960272 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') _init_default = _loads('cchameleon.core.generation\ninitialize_default\np1\n.') + _attrs_4353960016 = _loads('(dp1\n.') _init_tal = _loads('cchameleon.core.generation\ninitialize_tal\np1\n.') - _attrs_4359083280 = _loads('(dp1\nVclass\np2\nVlayout-grid\np3\ns.') def render(econtext, rcontext=None): macros = econtext.get('macros') _translate = econtext.get('_translate') @@ -33,13 +30,13 @@ def bind(): def _callback_main(econtext, _repeat, _out=_out, _write=_write, _domain=_domain, **_ignored): if _repeat: repeat.update(_repeat) - attrs = _attrs_4359083088 + attrs = _attrs_4353960016 u"''" _write(u'
\n ') _default.value = default = '' u'pager' _content = econtext['pager'] - attrs = _attrs_4359083216 + attrs = _attrs_4353960144 u'_content' _write(u'
') _tmp1 = _content @@ -62,7 +59,7 @@ def bind(): _default.value = default = '' u'fs.render()' _content = _lookup_attr(econtext['fs'], 'render')() - attrs = _attrs_4359083280 + attrs = _attrs_4353960208 u'_content' _write(u'
') _tmp1 = _content @@ -80,38 +77,15 @@ def bind(): if not isinstance(_tmp, unicode): _tmp = str(_tmp) _write(_tmp) + u"u'\\n '" _write(u'
\n ') - attrs = _attrs_4359083344 - _write(u'

\n ') - attrs = _attrs_4359083472 - u"request.fa_url(request.model_name, 'new')" - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' href="' + _tmp1) + '"')) - _write(u'>\n ') - attrs = _attrs_4359083600 - u"F_('New')" - _write(u'\n ') - _tmp1 = econtext['F_']('New') + _default.value = default = u'\n ' + u'actions.buttons(request)' + _content = _lookup_attr(econtext['actions'], 'buttons')(econtext['request']) + attrs = _attrs_4353960272 + u'_content' + _write(u'

') + _tmp1 = _content _tmp = _tmp1 if (_tmp.__class__ not in (str, unicode, int, float, )): try: @@ -125,43 +99,8 @@ def bind(): if (_tmp is not None): if not isinstance(_tmp, unicode): _tmp = str(_tmp) - if ('&' in _tmp): - if (';' in _tmp): - _tmp = _re_amp.sub('&', _tmp) - else: - _tmp = _tmp.replace('&', '&') - if ('<' in _tmp): - _tmp = _tmp.replace('<', '<') - if ('>' in _tmp): - _tmp = _tmp.replace('>', '>') _write(_tmp) - u'model_name' - _write(u' ') - _tmp1 = econtext['model_name'] - _tmp = _tmp1 - if (_tmp.__class__ not in (str, unicode, int, float, )): - try: - _tmp = _tmp.__html__ - except: - _tmp = _translate(_tmp, domain=_domain, mapping=None, target_language=target_language, default=None) - else: - _tmp = _tmp() - _write(_tmp) - _tmp = None - if (_tmp is not None): - if not isinstance(_tmp, unicode): - _tmp = str(_tmp) - if ('&' in _tmp): - if (';' in _tmp): - _tmp = _re_amp.sub('&', _tmp) - else: - _tmp = _tmp.replace('&', '&') - if ('<' in _tmp): - _tmp = _tmp.replace('<', '<') - if ('>' in _tmp): - _tmp = _tmp.replace('>', '>') - _write(_tmp) - _write(u'\n \n

\n
\n') + _write(u'

\n
\n') u"{'main': _callback_main}" _tmp = {'main': _callback_main, } u"main.macros['master']" diff --git a/pyramid_formalchemy/templates/admin/master.pt b/pyramid_formalchemy/templates/admin/master.pt index f0d5d49..cec236a 100644 --- a/pyramid_formalchemy/templates/admin/master.pt +++ b/pyramid_formalchemy/templates/admin/master.pt @@ -2,6 +2,7 @@ +
diff --git a/pyramid_formalchemy/templates/admin/master.pt.py b/pyramid_formalchemy/templates/admin/master.pt.py index 37543a5..46eb61b 100644 --- a/pyramid_formalchemy/templates/admin/master.pt.py +++ b/pyramid_formalchemy/templates/admin/master.pt.py @@ -1,24 +1,25 @@ registry = dict(version=0) def bind(): from cPickle import loads as _loads + _attrs_4353373456 = _loads('(dp1\nVrel\np2\nVstylesheet\np3\ns.') _lookup_attr = _loads('cchameleon.core.codegen\nlookup_attr\np1\n.') _init_scope = _loads('cchameleon.core.utils\necontext\np1\n.') _re_amp = _loads("cre\n_compile\np1\n(S'&(?!([A-Za-z]+|#[0-9]+);)'\np2\nI0\ntRp3\n.") - _attrs_4358968400 = _loads('(dp1\n.') - _attrs_4358849552 = _loads('(dp1\n.') - _attrs_4358967760 = _loads('(dp1\nVid\np2\nVheader\np3\nsVclass\np4\nVui-widget-header ui-corner-all\np5\ns.') - _attrs_4358720592 = _loads('(dp1\nVrel\np2\nVstylesheet\np3\ns.') - _attrs_4358967504 = _loads('(dp1\nVid\np2\nVcontent\np3\nsVclass\np4\nVui-admin ui-widget\np5\ns.') - _attrs_4358967888 = _loads('(dp1\nVclass\np2\nVbreadcrumb\np3\ns.') + _attrs_4353342480 = _loads('(dp1\n.') + _attrs_4345507344 = _loads('(dp1\nVid\np2\nVheader\np3\nsVclass\np4\nVui-widget-header ui-corner-all\np5\ns.') + _attrs_4353343184 = _loads('(dp1\nVclass\np2\nVbreadcrumb\np3\ns.') + _attrs_4353342544 = _loads('(dp1\n.') + _attrs_4353376016 = _loads('(dp1\n.') _init_stream = _loads('cchameleon.core.generation\ninitialize_stream\np1\n.') - _attrs_4358968272 = _loads('(dp1\n.') - _attrs_4358721104 = _loads('(dp1\n.') - _attrs_4358721040 = _loads('(dp1\n.') + _attrs_4353376144 = _loads('(dp1\n.') + _attrs_4353376208 = _loads('(dp1\n.') + _attrs_4353372432 = _loads('(dp1\nVsrc\np2\nVhttps://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js\np3\ns.') _init_default = _loads('cchameleon.core.generation\ninitialize_default\np1\n.') - _attrs_4358721232 = _loads('(dp1\n.') - _attrs_4358967696 = _loads('(dp1\n.') + _attrs_4353372560 = _loads('(dp1\nVid\np2\nVcontent\np3\nsVclass\np4\nVui-admin ui-widget\np5\ns.') + _attrs_4345507600 = _loads('(dp1\n.') + _attrs_4353342352 = _loads('(dp1\n.') + _attrs_4353413200 = _loads('(dp1\n.') _init_tal = _loads('cchameleon.core.generation\ninitialize_tal\np1\n.') - _attrs_4358967952 = _loads('(dp1\n.') def render(econtext, rcontext=None): macros = econtext.get('macros') _translate = econtext.get('_translate') @@ -34,15 +35,15 @@ def bind(): default = None u'None' _domain = None - attrs = _attrs_4358849552 + attrs = _attrs_4353376016 _write(u'\n ') - attrs = _attrs_4358721040 + attrs = _attrs_4353376144 u"''" _write(u'\n ') _default.value = default = '' u"request.model_name or 'root'" _content = (_lookup_attr(econtext['request'], 'model_name') or 'root') - attrs = _attrs_4358721104 + attrs = _attrs_4353413200 u'_content' _write(u'') _tmp1 = _content @@ -70,7 +71,7 @@ def bind(): _tmp = _tmp.replace('>', '>') _write(_tmp) _write(u'\n ') - attrs = _attrs_4358720592 + attrs = _attrs_4353373456 u"request.static_url('pyramid_formalchemy:static/admin.css')" _write(u'\n \n ') - attrs = _attrs_4358721232 + _write(u'>\n ') + attrs = _attrs_4353372432 + _write(u'\n \n ') + attrs = _attrs_4353376208 _write(u'\n ') - attrs = _attrs_4358967504 + attrs = _attrs_4353372560 _write(u'
\n ') - attrs = _attrs_4358967760 + attrs = _attrs_4345507344 _write(u'

\n ') - attrs = _attrs_4358967888 + attrs = _attrs_4353343184 u'breadcrumb' _write(u'
\n ') _tmp1 = econtext['breadcrumb'] @@ -114,7 +117,7 @@ def bind(): _default.value = default = '' u'item[1]' _content = item[1] - attrs = _attrs_4358968400 + attrs = _attrs_4353342480 u'item[0]' _write(u'/') _write(u'\n ') if (_tmp2 == 0): @@ -180,7 +183,7 @@ def bind(): _default.value = default = '' u"request.model_name or 'root'" _content = (_lookup_attr(econtext['request'], 'model_name') or 'root') - attrs = _attrs_4358967952 + attrs = _attrs_4353342352 u'_content' _write(u'
') _tmp1 = _content @@ -240,7 +243,7 @@ def bind(): _write(_tmp) else: pass - attrs = _attrs_4358967696 + attrs = _attrs_4345507600 _write(u'
\n
') _write(u'\n
\n \n') return diff --git a/pyramid_formalchemy/templates/admin/new.pt b/pyramid_formalchemy/templates/admin/new.pt index 6f1c30e..2f48fbb 100644 --- a/pyramid_formalchemy/templates/admin/new.pt +++ b/pyramid_formalchemy/templates/admin/new.pt @@ -5,15 +5,7 @@ tal:attributes="action request.fa_url(request.model_name)" > diff --git a/pyramid_formalchemy/templates/admin/new.pt.py b/pyramid_formalchemy/templates/admin/new.pt.py index 7bc4dee..24edbbe 100644 --- a/pyramid_formalchemy/templates/admin/new.pt.py +++ b/pyramid_formalchemy/templates/admin/new.pt.py @@ -4,16 +4,12 @@ def bind(): _lookup_attr = _loads('cchameleon.core.codegen\nlookup_attr\np1\n.') _init_scope = _loads('cchameleon.core.utils\necontext\np1\n.') _re_amp = _loads("cre\n_compile\np1\n(S'&(?!([A-Za-z]+|#[0-9]+);)'\np2\nI0\ntRp3\n.") - _attrs_4358301712 = _loads('(dp1\n.') - _attrs_4358301840 = _loads('(dp1\nVmethod\np2\nVPOST\np3\nsVenctype\np4\nVmultipart/form-data\np5\ns.') + _attrs_4356178128 = _loads('(dp1\n.') + _attrs_4356132752 = _loads('(dp1\n.') _init_stream = _loads('cchameleon.core.generation\ninitialize_stream\np1\n.') - _attrs_4358302288 = _loads("(dp1\nVtype\np2\nVsubmit\np3\nsVvalue\np4\nV${F_('Save')}\np5\ns.") - _attrs_4358302160 = _loads('(dp1\nVhref\np2\nV#\nsVclass\np3\nVui-widget-header ui-widget-link ui-widget-button ui-corner-all\np4\ns.') + _attrs_4356178000 = _loads('(dp1\nVmethod\np2\nVPOST\np3\nsVenctype\np4\nVmultipart/form-data\np5\ns.') _init_default = _loads('cchameleon.core.generation\ninitialize_default\np1\n.') - _attrs_4358302416 = _loads('(dp1\nVclass\np2\nVui-icon ui-icon-circle-arrow-w\np3\ns.') - _attrs_4358302032 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') - _attrs_4358302224 = _loads('(dp1\nVclass\np2\nVui-widget-header ui-widget-link ui-corner-all\np3\ns.') - _attrs_4358301968 = _loads('(dp1\n.') + _attrs_4356178192 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') _init_tal = _loads('cchameleon.core.generation\ninitialize_tal\np1\n.') def render(econtext, rcontext=None): macros = econtext.get('macros') @@ -35,9 +31,9 @@ def bind(): def _callback_main(econtext, _repeat, _out=_out, _write=_write, _domain=_domain, **_ignored): if _repeat: repeat.update(_repeat) - attrs = _attrs_4358301712 + attrs = _attrs_4356132752 _write(u'
\n ') - attrs = _attrs_4358301840 + attrs = _attrs_4356178000 u'request.fa_url(request.model_name)' _write(u'
') _tmp1 = _content @@ -84,65 +80,15 @@ def bind(): if not isinstance(_tmp, unicode): _tmp = str(_tmp) _write(_tmp) + u"u'\\n '" _write(u'
\n ') - attrs = _attrs_4358302032 - _write(u'

\n ') - attrs = _attrs_4358302160 - _write(u'\n ') - attrs = _attrs_4358302288 - 'join(value("F_(\'Save\')"),)' - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' value="' + _tmp1) + '"')) - _write(u' />\n \n ') - attrs = _attrs_4358302224 - u'request.fa_url(request.model_name)' - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' href="' + _tmp1) + '"')) - _write(u'>\n ') - attrs = _attrs_4358302416 - u"'Cancel'" - _write(u'\n ') - _tmp1 = 'Cancel' + _default.value = default = u'\n ' + u'actions.buttons(request)' + _content = _lookup_attr(econtext['actions'], 'buttons')(econtext['request']) + attrs = _attrs_4356178192 + u'_content' + _write(u'

') + _tmp1 = _content _tmp = _tmp1 if (_tmp.__class__ not in (str, unicode, int, float, )): try: @@ -156,17 +102,8 @@ def bind(): if (_tmp is not None): if not isinstance(_tmp, unicode): _tmp = str(_tmp) - if ('&' in _tmp): - if (';' in _tmp): - _tmp = _re_amp.sub('&', _tmp) - else: - _tmp = _tmp.replace('&', '&') - if ('<' in _tmp): - _tmp = _tmp.replace('<', '<') - if ('>' in _tmp): - _tmp = _tmp.replace('>', '>') _write(_tmp) - _write(u'\n \n

\n \n
\n') + _write(u'

\n \n

\n') u"{'main': _callback_main}" _tmp = {'main': _callback_main, } u"main.macros['master']" diff --git a/pyramid_formalchemy/templates/admin/show.pt b/pyramid_formalchemy/templates/admin/show.pt index 59767f0..fb618c9 100644 --- a/pyramid_formalchemy/templates/admin/show.pt +++ b/pyramid_formalchemy/templates/admin/show.pt @@ -3,17 +3,8 @@
-

- - - - - - ${F_('Back')} - -

+

+

diff --git a/pyramid_formalchemy/templates/admin/show.pt.py b/pyramid_formalchemy/templates/admin/show.pt.py index 7b8d598..f6bfcd6 100644 --- a/pyramid_formalchemy/templates/admin/show.pt.py +++ b/pyramid_formalchemy/templates/admin/show.pt.py @@ -3,18 +3,13 @@ def bind(): from cPickle import loads as _loads _lookup_attr = _loads('cchameleon.core.codegen\nlookup_attr\np1\n.') _init_scope = _loads('cchameleon.core.utils\necontext\np1\n.') - _re_amp = _loads("cre\n_compile\np1\n(S'&(?!([A-Za-z]+|#[0-9]+);)'\np2\nI0\ntRp3\n.") - _attrs_4358950864 = _loads("(dp1\nVtype\np2\nVsubmit\np3\nsVvalue\np4\nV${F_('Edit')}\np5\ns.") - _attrs_4358949968 = _loads('(dp1\n.') - _attrs_4358950480 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') - _attrs_4358950672 = _loads('(dp1\nVhref\np2\nV#\nsVclass\np3\nVui-widget-header ui-widget-link ui-widget-button ui-corner-all\np4\ns.') + _attrs_4362312784 = _loads('(dp1\n.') _init_stream = _loads('cchameleon.core.generation\ninitialize_stream\np1\n.') - _attrs_4358950160 = _loads('(dp1\n.') + _attrs_4362313104 = _loads('(dp1\n.') _init_default = _loads('cchameleon.core.generation\ninitialize_default\np1\n.') - _attrs_4358950288 = _loads('(dp1\n.') - _attrs_4358988048 = _loads('(dp1\nVclass\np2\nVui-icon ui-icon-circle-arrow-w\np3\ns.') - _attrs_4358987856 = _loads('(dp1\nVclass\np2\nVui-widget-header ui-widget-link ui-corner-all\np3\ns.') + _attrs_4362312976 = _loads('(dp1\n.') _init_tal = _loads('cchameleon.core.generation\ninitialize_tal\np1\n.') + _attrs_4362313296 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') def render(econtext, rcontext=None): macros = econtext.get('macros') _translate = econtext.get('_translate') @@ -35,13 +30,13 @@ def bind(): def _callback_main(econtext, _repeat, _out=_out, _write=_write, _domain=_domain, **_ignored): if _repeat: repeat.update(_repeat) - attrs = _attrs_4358949968 + attrs = _attrs_4362312784 u"''" _write(u'
\n ') _default.value = default = '' u'fs.render()' _content = _lookup_attr(econtext['fs'], 'render')() - attrs = _attrs_4358950160 + attrs = _attrs_4362312976 u'_content' _write(u'
') _tmp1 = _content @@ -60,89 +55,16 @@ def bind(): _tmp = str(_tmp) _write(_tmp) _write(u'
\n ') - attrs = _attrs_4358950288 - _write(u'
\n ') - attrs = _attrs_4358950480 - _write(u'

\n ') - attrs = _attrs_4358950672 - u"request.fa_url(request.model_name, request.model_id, 'edit')" - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' href="' + _tmp1) + '"')) - _write(u'>\n ') - attrs = _attrs_4358950864 - 'join(value("F_(\'Edit\')"),)' - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' value="' + _tmp1) + '"')) - _write(u' />\n \n ') - attrs = _attrs_4358987856 - u'request.fa_url(request.model_name)' - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' href="' + _tmp1) + '"')) - _write(u'>\n ') - attrs = _attrs_4358988048 - u"F_('Back')" - _write(u'\n ') - _tmp1 = econtext['F_']('Back') + attrs = _attrs_4362313104 + u"u'\\n '" + _write(u'

\n
\n') + _write(u'

\n
\n
\n') u"{'main': _callback_main}" _tmp = {'main': _callback_main, } u"main.macros['master']" diff --git a/pyramidapp/pyramidapp/models.py b/pyramidapp/pyramidapp/models.py index b9a145d..87e1d62 100644 --- a/pyramidapp/pyramidapp/models.py +++ b/pyramidapp/pyramidapp/models.py @@ -41,7 +41,7 @@ class Bar(Base): __tablename__ = 'bar' __acl__ = [ (Allow, 'admin', ALL_PERMISSIONS), - (Allow, 'bar_manager', ('view', 'new', 'edit', 'delete')), + (Allow, 'bar_manager', ('view', 'new', 'edit')), ] id = Column(Integer, primary_key=True) foo = Column(Unicode(255)) diff --git a/pyramidapp/pyramidapp/templates/foolisting.pt b/pyramidapp/pyramidapp/templates/foolisting.pt index f3feb77..0da230b 100644 --- a/pyramidapp/pyramidapp/templates/foolisting.pt +++ b/pyramidapp/pyramidapp/templates/foolisting.pt @@ -1,15 +1,10 @@
- My Foo custom template + My Foo custom listing
-

- - - ${F_('New')} ${model_name} - +

diff --git a/pyramidapp/pyramidapp/templates/foolisting.pt.py b/pyramidapp/pyramidapp/templates/foolisting.pt.py index 0c4e479..79a05f8 100644 --- a/pyramidapp/pyramidapp/templates/foolisting.pt.py +++ b/pyramidapp/pyramidapp/templates/foolisting.pt.py @@ -3,15 +3,12 @@ def bind(): from cPickle import loads as _loads _lookup_attr = _loads('cchameleon.core.codegen\nlookup_attr\np1\n.') _init_scope = _loads('cchameleon.core.utils\necontext\np1\n.') - _attrs_4355972176 = _loads('(dp1\nVclass\np2\nVlayout-grid\np3\ns.') - _attrs_4355972112 = _loads('(dp1\nVclass\np2\nVui-pager\np3\ns.') - _attrs_4355971984 = _loads('(dp1\n.') + _attrs_4357125136 = _loads('(dp1\nVclass\np2\nVlayout-grid\np3\ns.') + _attrs_4357125072 = _loads('(dp1\nVclass\np2\nVui-pager\np3\ns.') + _attrs_4357124944 = _loads('(dp1\n.') _init_stream = _loads('cchameleon.core.generation\ninitialize_stream\np1\n.') - _attrs_4355972496 = _loads('(dp1\nVclass\np2\nVui-icon ui-icon-circle-plus\np3\ns.') - _attrs_4355972240 = _loads('(dp1\n.') + _attrs_4357125200 = _loads('(dp1\nVclass\np2\nVfa_field\np3\ns.') _init_default = _loads('cchameleon.core.generation\ninitialize_default\np1\n.') - _re_amp = _loads("cre\n_compile\np1\n(S'&(?!([A-Za-z]+|#[0-9]+);)'\np2\nI0\ntRp3\n.") - _attrs_4355972368 = _loads('(dp1\nVclass\np2\nVui-widget-header ui-widget-link ui-corner-all\np3\ns.') _init_tal = _loads('cchameleon.core.generation\ninitialize_tal\np1\n.') def render(econtext, rcontext=None): macros = econtext.get('macros') @@ -33,13 +30,13 @@ def bind(): def _callback_main(econtext, _repeat, _out=_out, _write=_write, _domain=_domain, **_ignored): if _repeat: repeat.update(_repeat) - attrs = _attrs_4355971984 + attrs = _attrs_4357124944 u"''" - _write(u'
\n My Foo custom template\n ') + _write(u'
\n My Foo custom listing\n ') _default.value = default = '' u'pager' _content = econtext['pager'] - attrs = _attrs_4355972112 + attrs = _attrs_4357125072 u'_content' _write(u'
') _tmp1 = _content @@ -62,7 +59,7 @@ def bind(): _default.value = default = '' u'fs.render()' _content = _lookup_attr(econtext['fs'], 'render')() - attrs = _attrs_4355972176 + attrs = _attrs_4357125136 u'_content' _write(u'
') _tmp1 = _content @@ -80,38 +77,15 @@ def bind(): if not isinstance(_tmp, unicode): _tmp = str(_tmp) _write(_tmp) + u"u'\\n '" _write(u'
\n ') - attrs = _attrs_4355972240 - _write(u'

\n ') - attrs = _attrs_4355972368 - u"request.fa_url(request.model_name, 'new')" - _write(u'' in _tmp1): - _tmp1 = _tmp1.replace('>', '>') - if ('"' in _tmp1): - _tmp1 = _tmp1.replace('"', '"') - _write(((' href="' + _tmp1) + '"')) - _write(u'>\n ') - attrs = _attrs_4355972496 - u"F_('New')" - _write(u'\n ') - _tmp1 = econtext['F_']('New') + _default.value = default = u'\n ' + u'actions.buttons(request)' + _content = _lookup_attr(econtext['actions'], 'buttons')(econtext['request']) + attrs = _attrs_4357125200 + u'_content' + _write(u'

') + _tmp1 = _content _tmp = _tmp1 if (_tmp.__class__ not in (str, unicode, int, float, )): try: @@ -125,43 +99,8 @@ def bind(): if (_tmp is not None): if not isinstance(_tmp, unicode): _tmp = str(_tmp) - if ('&' in _tmp): - if (';' in _tmp): - _tmp = _re_amp.sub('&', _tmp) - else: - _tmp = _tmp.replace('&', '&') - if ('<' in _tmp): - _tmp = _tmp.replace('<', '<') - if ('>' in _tmp): - _tmp = _tmp.replace('>', '>') _write(_tmp) - u'model_name' - _write(u' ') - _tmp1 = econtext['model_name'] - _tmp = _tmp1 - if (_tmp.__class__ not in (str, unicode, int, float, )): - try: - _tmp = _tmp.__html__ - except: - _tmp = _translate(_tmp, domain=_domain, mapping=None, target_language=target_language, default=None) - else: - _tmp = _tmp() - _write(_tmp) - _tmp = None - if (_tmp is not None): - if not isinstance(_tmp, unicode): - _tmp = str(_tmp) - if ('&' in _tmp): - if (';' in _tmp): - _tmp = _re_amp.sub('&', _tmp) - else: - _tmp = _tmp.replace('&', '&') - if ('<' in _tmp): - _tmp = _tmp.replace('<', '<') - if ('>' in _tmp): - _tmp = _tmp.replace('>', '>') - _write(_tmp) - _write(u'\n \n

\n
\n') + _write(u'

\n
\n') u"{'main': _callback_main}" _tmp = {'main': _callback_main, } u"main.macros['master']" diff --git a/pyramidapp/pyramidapp/tests.py b/pyramidapp/pyramidapp/tests.py index 989cef4..3f5fe6c 100644 --- a/pyramidapp/pyramidapp/tests.py +++ b/pyramidapp/pyramidapp/tests.py @@ -46,7 +46,7 @@ class Test_1_UI(unittest.TestCase): # add page resp.mustcontain('/admin/Foo/new') - resp = resp.click('New Foo') + resp = resp.click(linkid='new') resp.mustcontain('/admin/Foo"') form = resp.forms[0] form['Foo--bar'] = 'value' @@ -88,7 +88,7 @@ class Test_1_UI(unittest.TestCase): # add page resp.mustcontain('/foo/new') - resp = resp.click('New Foo') + resp = resp.click(linkid='new') resp.mustcontain('/foo') form = resp.forms[0] form['Foo--bar'] = 'value' @@ -184,6 +184,14 @@ class Test_2_Security(Test_1_UI): resp = self.app.get('/admin/Bar', extra_environ={'REMOTE_USER': 'bar_manager'}) self.assertEqual(resp.status_int, 200) + resp = self.app.post('/admin/Bar', {'Bar--foo':'bar'}, extra_environ={'REMOTE_USER': 'bar_manager'}) + resp = self.app.get('/admin/Bar/1/edit', extra_environ={'REMOTE_USER': 'admin'}) + self.assertEqual(resp.status_int, 200) + resp.mustcontain('Delete') + resp = self.app.get('/admin/Bar/1/edit', extra_environ={'REMOTE_USER': 'bar_manager'}) + self.assertEqual(resp.status_int, 200) + assert 'Delete' not in resp.body, resp.body + def test_2_model(self): pass