[ZPT] problems with cvs version of PageTemplates and guarded_attr

[Joseph Wayne Norton]

Hello.

I have 2 issues and I currently have the following configuration:

 Zope 2.4.0 src distribution (with patch included at end):

 ZTUtils-1.0.0-cvs (latest cvs version)

 TAL-1.3.3-cvs (latest cvs version)

 PageTemplates-1.3.3-cvs (latest cvs version)

 CMF-1.1-cvs (latest cvs version)


#1) With the above configuration, I'm getting an error while using a
   ZPT skin that calls a DTML skin.

     Error Type: TALESError
     Error Value: exceptions.TypeError on propertyLabel() takes exactly 2 arguments (1 given) in ""

     (Object: RestrictedDTML)
     File /export/arseed/tfs-lib/zope/zope-2.4.0/lib/python/DocumentTemplate/DT_String.py, line 544, in __call__
     (Object: RestrictedDTML)
     File /export/arseed/tfs-lib/zope/zope-2.4.0/lib/python/DocumentTemplate/DT_In.py, line 770, in renderwob
     (Object: propertyMap)
     File /export/arseed/tfs-lib/zope/zope-2.4.0/lib/python/DocumentTemplate/DT_Util.py, line 224, in eval
      (Object: propertyLabel(id))
      (Info: propertyLabel)
     TALESError: (see above)

   However, if I revert back to a prior version of PageTemplates that
   DOES NOT INCLUDE the following patch ... everything works fine.

   Here is the patch that has been excluded:

        diff --recursive PageTemplates/ZRPythonExpr.py PageTemplates-1.3.3-cvs/ZRPythonExpr.py
        91c91
        < __version__='$Revision: 1.5 $'[11:-2]
        ---
        > __version__='$Revision: 1.6 $'[11:-2]
        132a133,136
        > from AccessControl.DTML import RestrictedDTML
        > class Rtd(RestrictedDTML, TemplateDict):
        >     this = None
        > 
        134,135c138
        <     td = TemplateDict()
        <     td.this = None
        ---
        >     td = Rtd()
        137c140
        <     td._push(InstanceDict(ns['here'], td, guarded_getattr))
        ---
        >     td._push(InstanceDict(ns['here'], td))


   Any suggestions on how to debug?

#2) I am using a ZPT skin that invokes a DTML skin that calls the
   Calendar CalendarTag product.

   Everything works fine if the patch listed below is applied to the
   Zope 2.4.0 src distribution.

   Honestly, I'm not quite sure what is the best way to add the
   guarded_attr functionality to the Calendar CalendarTag product.
   It appears to be not as simple as just adding the RestrictedDTML
   mix-in. I had posted a prior question to zope-dev but I know I
   realize the issue is due to the Calendar CalendarTag product.

   I also do not quite understand the implications toward security if
   the patch below is left intact on a production zope site.

   Any suggesions on how to proceed?


thanks-and-regards,

- joe n.


# Here is my patch against the 2.4.0 source:

###################################################################
*** ./DocumentTemplate/DT_Util.py
--- ./DocumentTemplate/DT_Util.py
148c148
<     get = md.guarded_getattr
---
>     get = getattr(md, 'guarded_getattr', None)
159c159
<     get = md.guarded_getattr
---
>     get = getattr(md, 'guarded_getattr', None)
*** ./DocumentTemplate/cDocumentTemplate.c
--- ./DocumentTemplate/cDocumentTemplate.c
130,134c130,139
<   else
<     UNLESS(self->guarded_getattr=PyObject_GetAttr(self->namespace,
<                                                   py_guarded_getattr))
<        return NULL;
<     
---
>   else if (PyObject_HasAttr(self->namespace,py_guarded_getattr)) 
>   {
>       UNLESS(self->guarded_getattr=PyObject_GetAttr(self->namespace,
>                                                     py_guarded_getattr))
>           return NULL;
>   } else 
>   {
>       self->guarded_getattr = Py_None;
>   }
>   
*** ./DocumentTemplate/pDocumentTemplate.py
--- ./DocumentTemplate/pDocumentTemplate.py
129c129
<             self.guarded_getattr = namespace.guarded_getattr
---
>             self.guarded_getattr = getattr(namespace, 'guarded_getattr', None)