Re: [Zope3-Users] ForbiddenAttribute when adding to a folder
Dominique Lederer wrote: > Darryl Cousins schrieb: >> Hi Tim, >> >> On Sat, 2006-10-21 at 12:18 +0200, Tim Terlegård wrote: >>> Is there a way to add content without having @@+ in the URL? For >>> instance I'd like the url for adding events to be /addEvent. >>> >>> I get security problems when not having @@+ in the URL. I have this view: >>> >>> >> for="zope.app.container.interfaces.IWriteContainer" >>> name="addEvent" >>> class=".eventforms.EventAddForm" >>> permission="zope.ManageContent" >>> /> >>> >>> When I hit the submit button in this add form I get an error: >>> ForbiddenAttribute: ('add', >> 0xb6e65d2c>) >> Forbidden here in the sense that Folder does not have an 'add' >> attribute. >> >>> I realize IWriteContainer might not be the right interface, it doesn't >>> have any add method. >>> >>> Should I have for="zope.app.container.interfaces.IAdding" instead and >>> somehow add an adapter from IFolder to IAdding or how would I do this? >>> >>> Tim >> As you point out formlib.BaseAddForm calls the add method of the >> context: >> >> _finished_add = False >> >> def add(self, object): >> ob = self.context.add(object) >> self._finished_add = True >> return ob >> >> I (also a novice) always use formlib for adding. But I use my own base >> adding sub-class of BaseAddForm which has this add method: >> >> def add(self, obj): >> try: >> ob = self.container.add(obj) >> except: >> self.container.__setitem__(obj.__name__, obj) >> ob = self.container[obj.__name__] >> self._finished_add = True >> return ob >> >> I almost always use a NameChooser to choose the name for the object. So >> I can trust using __name__ as the dict key. >> >> I use self.container here that usually resolves to self.context but on >> some occassions the context is not the container I want to be adding to. >> >> Hopes this helps. >> >> Darryl > > yes, thanks, it helped me > > but what are we doing wrong here, that the base methods wont work? > > why should my container know about the add method? The context for AddForm normally isn't the container, it's the IAdding namespace adapter. This object implements the add method. The IAdding object interacts with the container (and name chooser). All this presumes you've registered your add form page accordingly: e.g. http://mail.zope.org/mailman/listinfo/zope3-users
Re: [Zope3-Users] ForbiddenAttribute when adding to a folder
Darryl Cousins schrieb: > Hi Tim, > > On Sat, 2006-10-21 at 12:18 +0200, Tim Terlegård wrote: >> Is there a way to add content without having @@+ in the URL? For >> instance I'd like the url for adding events to be /addEvent. >> >> I get security problems when not having @@+ in the URL. I have this view: >> >> > for="zope.app.container.interfaces.IWriteContainer" >> name="addEvent" >> class=".eventforms.EventAddForm" >> permission="zope.ManageContent" >> /> >> >> When I hit the submit button in this add form I get an error: >> ForbiddenAttribute: ('add', > 0xb6e65d2c>) > > Forbidden here in the sense that Folder does not have an 'add' > attribute. > >> I realize IWriteContainer might not be the right interface, it doesn't >> have any add method. >> >> Should I have for="zope.app.container.interfaces.IAdding" instead and >> somehow add an adapter from IFolder to IAdding or how would I do this? >> >> Tim > > As you point out formlib.BaseAddForm calls the add method of the > context: > > _finished_add = False > > def add(self, object): > ob = self.context.add(object) > self._finished_add = True > return ob > > I (also a novice) always use formlib for adding. But I use my own base > adding sub-class of BaseAddForm which has this add method: > > def add(self, obj): > try: > ob = self.container.add(obj) > except: > self.container.__setitem__(obj.__name__, obj) > ob = self.container[obj.__name__] > self._finished_add = True > return ob > > I almost always use a NameChooser to choose the name for the object. So > I can trust using __name__ as the dict key. > > I use self.container here that usually resolves to self.context but on > some occassions the context is not the container I want to be adding to. > > Hopes this helps. > > Darryl yes, thanks, it helped me but what are we doing wrong here, that the base methods wont work? why should my container know about the add method? any help welcome thanks Dom ___ Zope3-users mailing list Zope3-users@zope.org http://mail.zope.org/mailman/listinfo/zope3-users
Re: [Zope3-Users] ForbiddenAttribute when adding to a folder
Hi Tim, On Sat, 2006-10-21 at 12:18 +0200, Tim Terlegård wrote: > Is there a way to add content without having @@+ in the URL? For > instance I'd like the url for adding events to be /addEvent. > > I get security problems when not having @@+ in the URL. I have this view: > > for="zope.app.container.interfaces.IWriteContainer" > name="addEvent" > class=".eventforms.EventAddForm" > permission="zope.ManageContent" > /> > > When I hit the submit button in this add form I get an error: > ForbiddenAttribute: ('add', 0xb6e65d2c>) Forbidden here in the sense that Folder does not have an 'add' attribute. > > I realize IWriteContainer might not be the right interface, it doesn't > have any add method. > > Should I have for="zope.app.container.interfaces.IAdding" instead and > somehow add an adapter from IFolder to IAdding or how would I do this? > > Tim As you point out formlib.BaseAddForm calls the add method of the context: _finished_add = False def add(self, object): ob = self.context.add(object) self._finished_add = True return ob I (also a novice) always use formlib for adding. But I use my own base adding sub-class of BaseAddForm which has this add method: def add(self, obj): try: ob = self.container.add(obj) except: self.container.__setitem__(obj.__name__, obj) ob = self.container[obj.__name__] self._finished_add = True return ob I almost always use a NameChooser to choose the name for the object. So I can trust using __name__ as the dict key. I use self.container here that usually resolves to self.context but on some occassions the context is not the container I want to be adding to. Hopes this helps. Darryl ___ Zope3-users mailing list Zope3-users@zope.org http://mail.zope.org/mailman/listinfo/zope3-users