Re: do we need plone.app.customerize? was: [Plone-Users] Insufficient privileges on folder_contents

Thanks Dylan - that does sound good.

My main point in this discussion is to emphasize that there are quite a few
(many?) of us who rely on doing a lot of TTW work, and to ask that before
those TTW mechanisms are removed entirely from Plone we have a chance to
work with whatever replaces those mechanisms.

    Kim



On Tue, Dec 10, 2013 at 12:54 AM, Dylan Jay <djay-n0pU0XVUApFWk0Htik3J/[email protected]> wrote:

>
> On 10 Dec 2013, at 5:30 pm, T. Kim Nguyen <[email protected]> wrote:
>
> > One beef I have with browser views is there is no way to add new ones
> TTW. It would be great if there were such a mechanism.
>
> Have a look at the mechanism outlined in my last email, suggested my
> Martin Aspeli . It works with diazo and is natural extension of it. Unlike
> overriding templates it doesn't have the problem of bringing in a lot of FS
> python that may not work TTW. It is more like patching your templates just
> with the parts you want to change. However it also allows you to completely
> replace any view or create new views that users can select via the display
> menu. All using the same technique so the learning curve isn't z-shaped.
>
> >
> > Would it be possible to allow a site to run its customized viewlets in
> unrestricted Python?
>
> Not if they can be written TTW. That would be a very bad idea. They are
> restricted for a good reason.
>
> >
> > Kim
> >
> > —
> > 920-292-0863 mobile/Google Voice
> >
> > Sent from Mailbox for iPhone
> >
> >
> > On Thu, Dec 5, 2013 at 12:41 PM, David Glick (Plone) <
> david.glick-z4DKO/[email protected]> wrote:
> >
> > On 12/5/13, 6:24 AM, Nathan Van Gheem wrote:
> > > I think many problems can probably be solved with diazo these days and
> > > yes, customerize doesn't not consistently work.
> > >
> > > That being said, we do need a customization story for non-devs.
> > >
> > > How feasible would it be to make a TTW jbot?
> > >
> > Shouldn't be too hard. z3c.jbot already has the right hooks to look for
> > a template's source "somewhere else" when a template is rendered. We
> > would just need to add to the possible "somewhere else" locations, by
> > configuring it with a set of ZODB paths to search for templates.
> >
> > This only takes care of overriding existing templates though. In a world
> > without portal_skins and Acquisition, to add new templates we would need
> > a way to register new views TTW (stored in the persistent component
> > registry). There's no technical reason that can't be done, but no one
> > has built it yet.
> >
> > And even for the use case of overriding templates, security is a caveat.
> > Part of the problem with portal_view_customizations is that it takes a
> > template which was running as filesystem code (i.e. unrestricted) and,
> > once customized, runs it as restricted Python. That tends to lead to
> > authorization errors once things are customized if the template was/is
> > using things that aren't allowed in restricted code. For some sites
> > (i.e. most standalone sites) it would be fine to allow unrestricted
> > execution of TTW-edited code as long as only Managers are allowed to
> > edit that code. But for shared hosting (multiple Plone sites for
> > different clients in one Zope instance) that's not very safe. I'm not
> > sure how to solve this for those sites, short of maybe doing automated
> > testing of all templates to make sure they still execute successfully as
> > restricted Python.
> >
> >
> ------------------------------------------------------------------------------
> > Sponsored by Intel(R) XDK
> > Develop, test and display web and hybrid apps with a single code base.
> > Download it for free now!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
> > _______________________________________________
> > Plone-developers mailing list
> > Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > https://lists.sourceforge.net/lists/listinfo/plone-developers
> >
> >
> >
> ------------------------------------------------------------------------------
> > Sponsored by Intel(R) XDK
> > Develop, test and display web and hybrid apps with a single code base.
> > Download it for free now!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk_______________________________________________
> > Plone-developers mailing list
> > Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > https://lists.sourceforge.net/lists/listinfo/plone-developers
>
>

------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk

_______________________________________________
Plone-developers mailing list
Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/plone-developers