Re: do we need plone.app.customerize? was: [Plone-Users] Insufficient privileges on folder_contents

One beef I have with browser views is there is no way to add new ones TTW. It would be great if there were such a mechanism. 




Would it be possible to allow a site to run its customized viewlets in unrestricted Python?




Kim




—
920-292-0863 mobile/Google Voice

Sent from Mailbox for iPhone

On Thu, Dec 5, 2013 at 12:41 PM, David Glick (Plone)
<david.glick-z4DKO/[email protected]> wrote:

> On 12/5/13, 6:24 AM, Nathan Van Gheem wrote:
>> I think many problems can probably be solved with diazo these days and 
>> yes, customerize doesn't not consistently work.
>>
>> That being said, we do need a customization story for non-devs.
>>
>> How feasible would it be to make a TTW jbot?
>>
> Shouldn't be too hard. z3c.jbot already has the right hooks to look for 
> a template's source "somewhere else" when a template is rendered. We 
> would just need to add to the possible "somewhere else" locations, by 
> configuring it with a set of ZODB paths to search for templates.
> This only takes care of overriding existing templates though. In a world 
> without portal_skins and Acquisition, to add new templates we would need 
> a way to register new views TTW (stored in the persistent component 
> registry). There's no technical reason that can't be done, but no one 
> has built it yet.
> And even for the use case of overriding templates, security is a caveat. 
> Part of the problem with portal_view_customizations is that it takes a 
> template which was running as filesystem code (i.e. unrestricted) and, 
> once customized, runs it as restricted Python. That tends to lead to 
> authorization errors once things are customized if the template was/is 
> using things that aren't allowed in restricted code. For some sites 
> (i.e. most standalone sites) it would be fine to allow unrestricted 
> execution of TTW-edited code as long as only Managers are allowed to 
> edit that code. But for shared hosting (multiple Plone sites for 
> different clients in one Zope instance) that's not very safe. I'm not 
> sure how to solve this for those sites, short of maybe doing automated 
> testing of all templates to make sure they still execute successfully as 
> restricted Python.
> ------------------------------------------------------------------------------
> Sponsored by Intel(R) XDK 
> Develop, test and display web and hybrid apps with a single code base.
> Download it for free now!
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
> _______________________________________________
> Plone-developers mailing list
> Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/plone-developers

------------------------------------------------------------------------------
Sponsored by Intel(R) XDK 
Develop, test and display web and hybrid apps with a single code base.
Download it for free now!
http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk

_______________________________________________
Plone-developers mailing list
Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/plone-developers