Paul Everitt wrote:
Martin Dougiamas wrote:
The funny thing is that
<!--#var "myapp.myfunction"-->
correctly returns all the raw content of the DTML document, so it *can* find it OK.
Any ideas?
The quotes switch DTML into "expr" (expression) mode. Outside of expressions, DTML is limited to very safe operations. Getting attributes (the dot) is an operation that requires the security machinery to get involved, to make sure that you have permission.
Dot notation and expressions have nothing to do with security. The difference is really about language. <!--#var foo--> is a short-hand for <!--#var name="foo"--> while: <!--#var "foo"--> is a short-hand for: <!--#var expr="foo"--> The argument to the name attribute is a DTML name, where there is no restrictions on characters in the name and no special interpretation has been given to any characters. Further, when a name is looked up, and the value is a document template or a callable object that requires no arguments, it is called. The argument for the expr attribute is a Python expression. The semantics for this value are defined by the Python language and any special objects, like '_'. In Python, objects are not called unless you supply the call operator. If you have a function, foo, the expression "foo" returns the function, not the result of calling the function.
I agree that this inconsistency
I don't agree that this is an inconsistency. An expression attribute always takes a Python expression with Python expression semantics. A name attribute always takes a DTML name, with DTML name lookup semantics.
is confusing,
The confusomg part is that: <!--#var "foo"--> looks so much like: <!--#var foo--> Perhaps this shorthand notation (which was added by popular demand) should be discouraged.
as are things like sequence-item outside an expression and sequence_item inside an expression.
"sequence_item" is not a special spelling for "sequence-item". When used as a name, you say: <!--#var sequence-item--> This is consistent with rules for DTML names. The dash was used in this (and similar names) to avoid conflicts with other names. In expressions, you say: <!--#var "_['sequence-item']--> Because "sequence-item" is not a legal Python name, we have to quote the name and do an explicit lookup from the namespace object, '_'. This seems very consistent to me.
Perhaps if we do a major overhaul of DTML (e.g. changing it to an XML-ish syntax) we'll look for ways to make it more consistent.
I don't expect adding an XML-compliant format to DTML to cause a major overhaul. XML *is* far more explicit that current DTML (and HTML) formats, so confusing short-hands will not be an option. You will *have* to name the attributes explicitly. Of course, people will still have to know the semantics for the various attributes. Jim -- Jim Fulton mailto:jim@digicool.com Python Powered! Technical Director (888) 344-4332 http://www.python.org Digital Creations http://www.digicool.com http://www.zope.org Under US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B) This email address may not be added to any commercial mail list with out my permission. Violation of my privacy with advertising or SPAM will result in a suit for a MINIMUM of $500 damages/incident, $1500 for repeats.