Re: do we need plone.app.customerize? was: [Plone-Users] Insufficient privileges on folder_contents

On 12/10/13, 10:22 AM, Nathan Van Gheem wrote:
>
>
>
> On Tue, Dec 10, 2013 at 12:11 PM, David Glick (Plone) 
> <david.glick-z4DKO/[email protected] <mailto:david.glick-z4DKO/[email protected]>> wrote:
>
>     On 12/9/13, 9:34 PM, Nathan Van Gheem wrote:
>
>         Playing with the idea of TTW jbot:
>         https://github.com/collective/collective.jbot
>
>         This approach isn't "safe." It actually creates temp files for
>         each template customization so templates aren't run in
>         restricted python.
>
>         I think this could hit most people's use-cases though.
>
>         Thoughts?
>
>
>     Well, not running restricted Python means it only hits the use
>     cases for standalone sites, or shared installations where a
>     Manager in one site is allowed access to other sites.
>
>     Looks like a good replacement for portal_view_customizations for
>     overriding templates in a standalone site, though.
>
> yes, right now that's how it works. I think we could change it to 
> eventually work with multiple sites. It'd just need to set the patched 
> template location every time so it can work with multiple sites 
> haven't different patches.

My concern is about the security of using it in a multi-site 
installation, not technical feasibility. An admin of one site can make a 
customized template that accesses another site's private data.

>
>
>     Code review: You should probably create one temp directory for the
>     process and hold a reference to it in a global, rather than
>     creating one for each file. Also, if I'm not mistaken it looks
>     like this takes precedence over the template manager from
>     z3c.jbot, and thus would prevent z3c.jbot from working?
>
> I haven't made sure but jbot goes through all the registered 
> TemplateManager adapters and checks to see if it has a customization. 
> However, the order these managers are called could be a problem.
>
> It likely needs some more thought and jbot might need some patches to 
> make it work correctly with typical package overrides but it was just 
> a quick try...
>

Ah, you're right, I missed that it checks all the adapters. We probably 
need to take some special care to make sure that the collective.jbot 
layer has highest precedence (similar to the way plone.theme applies the 
theme layer).

------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk

_______________________________________________
Plone-developers mailing list
Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/plone-developers