Brian Lloyd wrote:
I noticed that the most recent hotfix completely denies access to the getClassAttr, setClassAttr and delClassAttr from DTML. Is this going to be the behavior for future Zope versions?
Yes - I think that manipulating actual class objects from DTML is a Bad Thing.
I know this will break code, so it might be prudent to alert people when the fix is rolled into the next Zope release.
I would like to argue for deprecating these functions in favor of making the ZClass act like a dictionary so that:
ZClass.set('name',value) ZClass.get('name'[,inherit]) ZClass['name']
could be called securely from scripts. I would be willing to write the code for this if you think it would be a good idea.
I'm not sure why you're wanting to do that, so it scares me :) I think that manipulation of class objects is beyond the scope of what "DTML scripters" should reasonably expect to be able to do.
Oh nothing too scary. Mostly I have used it to store a counter to automatically assign ids to new ZClass instances. I was really thinking of this as a way to store properties across all instances of a ZClass. I agree that manipulating objects from DTML is BAD. My intention was to just store a property value or three. -- | Casey Duncan | Kaivo, Inc. | cduncan@kaivo.com `------------------>