I am writing a service for other pages to use as form action. How can I reference the caller object in DTML/python? I can only think of this: First use PARENTS[-1] to get to the root object of the site. Then split the PATH_INFO containing the caller's path, and go down from the root to every subfolder in PATH_INFO and then get to the caller object. But this is not very elegant. Can anyone give better solution to this?
On Fri, Sep 08, 2000 at 11:32:39AM +0800, Li Dongfeng wrote:
I am writing a service for other pages to use as form action. How can I reference the caller object in DTML/python?
I can only think of this: First use PARENTS[-1] to get to the root object of the site. Then split the PATH_INFO containing the caller's path, and go down from the root to every subfolder in PATH_INFO and then get to the caller object. But this is not very elegant.
Can anyone give better solution to this?
PATH_INFO only tells you something about the service object, not about the calling page. If you use this as a FORM action target, it's the browser that makes the call, not Zope. You can, in many cases, determine the browser URL by looking at HTTP_REFERER, but many people and companies use proxies and firewalls to filter this out nowadays; it is considered sensitive information. If this app is targeted at a intranet or other controlled environment, you could dictate the presence of HTTP_REFERER, and rely on that, otherwise you will have to add a reference as a hidden form field generated by the calling object. Once you have a URL of the calling object, you can use the Traversal interface to turn that URL into an object reference. -- Martijn Pieters | Software Engineer mailto:mj@digicool.com | Digital Creations http://www.digicool.com/ | Creators of Zope http://www.zope.org/ | ZopeStudio: http://www.zope.org/Products/ZopeStudio -----------------------------------------------------
Thanks for the correction. Now I see that PATH_INFO refers to the current page, not the calling page. I think the hidden input field solution is OK for me. What is the *Traversal interface*? Do you mean the PARENTS enviroment? ----- Original Message ----- From: "Martijn Pieters" <mj@digicool.com> To: "Li Dongfeng" <mavip1@inet.polyu.edu.hk> Cc: "Zope" <zope@zope.org> Sent: Friday, September 08, 2000 5:01 PM Subject: Re: [Zope] Help: PATH_INFO==>object
On Fri, Sep 08, 2000 at 11:32:39AM +0800, Li Dongfeng wrote:
I am writing a service for other pages to use as form action. How can I reference the caller object in DTML/python?
I can only think of this: First use PARENTS[-1] to get to the root object of the site. Then split the PATH_INFO containing the caller's path, and go down from the root to every subfolder in PATH_INFO and then get to the caller object. But this is not very elegant.
Can anyone give better solution to this?
PATH_INFO only tells you something about the service object, not about the calling page. If you use this as a FORM action target, it's the browser that makes the call, not Zope.
You can, in many cases, determine the browser URL by looking at HTTP_REFERER, but many people and companies use proxies and firewalls to filter this out nowadays; it is considered sensitive information.
If this app is targeted at a intranet or other controlled environment, you could dictate the presence of HTTP_REFERER, and rely on that, otherwise you will have to add a reference as a hidden form field generated by the calling object.
Once you have a URL of the calling object, you can use the Traversal interface to turn that URL into an object reference.
-- Martijn Pieters | Software Engineer mailto:mj@digicool.com | Digital Creations http://www.digicool.com/ | Creators of Zope http://www.zope.org/ | ZopeStudio: http://www.zope.org/Products/ZopeStudio -----------------------------------------------------
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
On Fri, Sep 08, 2000 at 08:01:58PM +0800, Li Dongfeng wrote:
Thanks for the correction. Now I see that PATH_INFO refers to the current page, not the calling page. I think the hidden input field solution is OK for me.
What is the *Traversal interface*? Do you mean the PARENTS enviroment?
The interface defines methods that let you convert a URL path into an object reference. It does the same thing as the ZPublisher does when processing a URL request. The PARENTS list is constructed during such traversal; it is a stack of references to objects that were 'traversed'; asked for a reference to an object given the name of the next URL element. The method you are looking for is restrictedTraverse: restrictedTraverse(path[, default]) where path is a object path seperated by '/' (no http://hostname part!). If the path starts with a '/' it is supposed to be an absolute URL from the site root, otherwise it is a relative path. Parent directory references ('../') are allowed. The method will check for the appropriate access along the way. The optional 'default' will be returned if the traversal fails. You should be able to use restrictedTraverse from DTML in Zope 2.2.1. In Zope 2.2.0 you will need an External Method to access it (this was a bug), and the method isn't implemented in any earlier versions of Zope. If you want to pass along a object reference as a hidden FORM variable, the you should use getPhysicalPath, and use _.string.join to turn the result of that into a useful string: <dtml-var "_.string.join(getPhysicalPath(), '/')"> -- Martijn Pieters | Software Engineer mailto:mj@digicool.com | Digital Creations http://www.digicool.com/ | Creators of Zope http://www.zope.org/ | ZopeStudio: http://www.zope.org/Products/ZopeStudio -----------------------------------------------------
participants (2)
-
Li Dongfeng -
Martijn Pieters