Controlling visibility of dtml methods/documents -- a newbie question
How do I stop direct access to a dtml method I've created in a folder? I don't mean specifying restricted access to it by modifying the security properties and specifying manager role access only -- this brings up a login screen -- what I want is an error screen that says that there is no such document. For a clearer example, the sample zope installation has the dtml methods standard_html_header and standard_html_footer defined. And the way these methods are used is that they are included in the index_html dtml method using <var> tags (i.e. they are not intended to be documents that are accessed directly). All this is clear to me -- the problem I have is that I can access those standard_html_header / footer methods directly -- by typing something like "http://mysite.com/standard_html_header" -- Is there any way of preventing this? One solution I tried was changing the security (BTW, I encountered some problems when trying to set values on this tab -- I kept getting errors -- has somebody reported this as a bug?) but what that did was restrict access to the dtml methods that used the standard_html_header (e.g. the index_html dtml method). I've read something about proxy roles and maybe this is the short term solution (I don't know -- I don't understand enough about it). But what I really want to do is to control visibility of an object -- something like a property I can switch on or off for each object so that when I try to access it directly (i.e. "http://mysite.com/folder/dtmlmethod" ) will display an error message saying that it doesn't exist -- but I can still access it by including it in my dtml code (e.g. "<!--#var dtmlmethod -->") and I'd also want it turned on for some dtml methods (e.g. for the index_html dtml method). Is there some Zope facility for doing this? _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com
Butch Landingin wrote:
But what I really want to do is to control visibility of an object -- something like a property I can switch on or off for each object so that when I try to access it directly (i.e. "http://mysite.com/folder/dtmlmethod" ) will display an error message saying that it doesn't exist -- but I can still access it by including it in my dtml code (e.g. "<!--#var dtmlmethod -->") and I'd also want it turned on for some dtml methods (e.g. for the index_html dtml method). Is there some Zope facility for doing this?
Boy this is an unusual one. Though I can't really think of a reason *why* you'd want this, I presume it's a good reason. I'm kind of against providing a general facility for this for the following reason. We've tried to make the security rules for accessing objects consistent from within DTML and from the web. My tip on how you could hack your own version would be to hack Folders to step into the publishing process. I believe you'd write a __bobo_before__ function that looked to see if the object being requested was marked as unpublishable. Unfortunately I'm not much of a programmer, as most here know, so this might all be Typical Paul Hogwash(tm). --Paul
participants (2)
-
Butch Landingin -
Paul Everitt