[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/AccessControl - PermissionMapping.py:1.12 Role.py:1.54

[Florent Guillaume]

Martijn Pieters  <mj@zope.com> wrote:
> -        raise AttributeError, name
> +        raise AttributeError, escape(name)

I don't understand why the escaping is done at that place. Surely, it
should be the role of the stuff that displays the error to do the
escaping.

The only problems I see are stuff like:
>          raise 'Invalid Permission', (
> -            "The permission <em>%s</em> is invalid." % permission)
> +            "The permission <em>%s</em> is invalid." % escape(permission))

where I don't think we should put HTML at all in the raised message.

Florent
-- 
Florent Guillaume, Nuxeo (Paris, France)
+33 1 40 33 79 87  http://nuxeo.com  mailto:fg@nuxeo.com