[Zope-Checkins] CVS: Zope3/lib/python/Zope/App/ZMI - TabsDirective.py:1.1.2.3 ZMIViewService.py:1.1.2.3

[Kapil]

Update of /cvs-repository/Zope3/lib/python/Zope/App/ZMI
In directory cvs.zope.org:/tmp/cvs-serv22274

Modified Files:
      Tag: Zope-3x-branch
	TabsDirective.py ZMIViewService.py 
Log Message:
added in zmi filters and security checks (via restrictedTraverse)



=== Zope3/lib/python/Zope/App/ZMI/TabsDirective.py 1.1.2.2 => 1.1.2.3 ===
         self._for_ = resolve(for_)
 
-    def tab(self, label, action):
+    def tab(self, label, action, filter='python: 1'):
         return [
             Action(
                discriminator =('tab', self._for_, label),
                callable = ZMIViews.registerView,
-               args = (self._for_, label, action)
+               args = (self._for_, label, action, filter)
                )
             ]
 


=== Zope3/lib/python/Zope/App/ZMI/ZMIViewService.py 1.1.2.2 => 1.1.2.3 ===
 from Interface.Util import objectImplements, flattenInterfaces
 
+
+from Zope.ContextWrapper import getinnercontext
+from Zope.ComponentArchitecture import getAdapter
+from Zope.App.Traversing.ITraverser import ITraverser
+from Zope.App.Security.SecurityManagement import getSecurityManager
+from Zope.PageTemplate.Expressions import getEngine
 class ZMIViewService:
     
     __implements__ = IZMIViewService
@@ -12,12 +18,13 @@
         """ for testing """
         self._reg = {}
 
-    def registerView(self, interface, label, action):
+    def registerView(self, interface, label, action, filter='python: 1'):
         """ register a zmi view """
+        
         views = self._reg.get(interface, [])
-        views.append((label,action))
+        views.append( ZMIViewDescriptor(label, action, filter) )
         self._reg[interface]=views
-        
+ 
     def getViews(self, object):
         """ see inteface docs. returns views in order defined
         with tabs from more general interfaces coming after
@@ -26,10 +33,55 @@
         res = []
         
         obj_interfaces = flattenInterfaces(objectImplements(object))
-        
+
         for interface in obj_interfaces:
-            res.extend(self._reg.get(interface, ()) )
+            
+            view_descriptors = self._reg.get(interface, ())
+
+            adaptor = getAdapter(object, ITraverser)
+            
+            for v in view_descriptors:
+                
+                view_value = (v.label, v.action)
+                
+                if view_value in res:
+                    continue
+                
+                ## security check
+                try: adaptor.restrictedTraverse(v.action)
+                except:
+                    continue
+
+                ## check filter, short circuit if default
+                if not v.filter_string == 'python: 1':
+
+                    if not v.filter( self._createContext(object)):
+                        continue
+                    
+                res.append( view_value )
+                
         return res
+
+    def _createContext(self, object):
+        '''
+        An expression context provides names for TALES expressions.
+        '''
+
+        data = {
+            'here':         object,
+            'container':    getinnercontext(object),
+            'nothing':      None,
+        #    'request':      getattr( object, 'REQUEST', None ),
+            'user':         getSecurityManager().getPrincipal(),
+            }
+        return getEngine().getContext(data)
+
+class ZMIViewDescriptor:
+    def __init__(self, label, action, filter_string):
+        self.label = label
+        self.action = action
+        self.filter_string = filter_string
+        self.filter = getEngine().compile(filter_string)
 
 ZMIViews = ZMIViewService()