Skip to content

erp5
erp5
Commit d8fb4c62 authored by Romain Courteaud's avatar Romain Courteaud
Browse files
Options

erp5_web_js_style: do not access web section using acquisition

parent b8ab0663
Show whitespace changes
Inline Side-by-side
Showing with 163 additions and 1 deletion
bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/view_main.zpt
View file @ d8fb4c62
......@@ -10,6 +10,7 @@
web_site python: here.getWebSiteValue();
web_section python: here.getWebSectionValue();
is_unexpected_reference_access python: '/' in here.getRelativeUrl()[len(web_section.getRelativeUrl()) + 1:];
is_unexpected_acquisition_access python: (web_section.getParentValue().getRelativeUrl() != web_section.aq_parent.getRelativeUrl()) or (web_site.getParentValue().getRelativeUrl() != web_site.aq_parent.getRelativeUrl());
relative_url_prefix python: web_section.WebSection_generateRelativeUrlPrefix();
no_style_gadget_url python: web_section.WebSection_generateLayoutPropertyUrl('configuration_style_gadget_url');
no_style_css_url python: relative_url_prefix + 'jsstyle.css';
......@@ -32,7 +33,15 @@
</metal:slot>
</tal:block>
</tal:block>
<tal:block tal:condition="python: not is_unexpected_reference_access">
<tal:block tal:condition="python: is_unexpected_acquisition_access">
<tal:block metal:use-macro="context/error_main/macros/master">
<metal:slot metal:fill-slot="main" i18n:domain="erp5_ui">
<h2 i18n:translate="" tal:define="dummy python: request.response.setStatus(404);">Unexpected URL</h2>
<p i18n:translate="">The URL should not rely on ID acquisition.</p>
</metal:slot>
</tal:block>
</tal:block>
<tal:block tal:condition="python: not (is_unexpected_reference_access or is_unexpected_acquisition_access)">
<tal:block metal:use-macro="global_definitions_macros/header_definitions" />
<!DOCTYPE html>
......
bt5/erp5_web_js_style_test/PathTemplateItem/portal_tests/js_style_zuite/testJsStyleWebSectionSiblingTraversal.xml 0 → 100644
View file @ d8fb4c62
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="ZopePageTemplate" module="Products.PageTemplates.ZopePageTemplate"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary>
<item>
<key> <string>name_subpath</string> </key>
<value> <string>traverse_subpath</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>content_type</string> </key>
<value> <string>text/html</string> </value>
</item>
<item>
<key> <string>expand</string> </key>
<value> <int>0</int> </value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>testJsStyleWebSectionSiblingTraversal</string> </value>
</item>
<item>
<key> <string>output_encoding</string> </key>
<value> <string>utf-8</string> </value>
</item>
<item>
<key> <string>title</string> </key>
<value> <unicode></unicode> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_web_js_style_test/PathTemplateItem/portal_tests/js_style_zuite/testJsStyleWebSectionSiblingTraversal.zpt 0 → 100644
View file @ d8fb4c62
<html xmlns:tal="http://xml.zope.org/namespaces/tal"
xmlns:metal="http://xml.zope.org/namespaces/metal">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Test JS Style No Style</title>
</head>
<body>
<table cellpadding="1" cellspacing="1" border="1">
<thead>
<tr><td rowspan="1" colspan="3">Test JS Style No Style</td></tr>
</thead><tbody>
<tal:block metal:use-macro="here/Zuite_CommonTemplate/macros/init" />
<tr>
<td>open</td>
<td>${base_url}/ERP5Site_createWebJSStyleZuiteTestData?configuration=nostyle</td>
<td></td>
</tr>
<tr>
<td>assertTextPresent</td>
<td>Web Site created.</td>
<td></td>
</tr>
<tal:block metal:use-macro="here/Zuite_CommonTemplate/macros/wait_for_activities" />
<!-- Initialize -->
<tr>
<td>open</td>
<td>${base_url}/web_site_module/erp5_web_js_style_test_site//erp5_web_js_style_test_section_1/erp5_web_js_style_test_section_2/</td>
<td></td>
</tr>
<tr>
<td>assertElementNotPresent</td>
<td>//head/link[@rel='prerender']</td>
<td></td>
</tr>
<tr>
<td>assertElementNotPresent</td>
<td>//head/link[@rel='alternate' and @type='application/rss+xml' and @href='feed.rss']</td>
<td></td>
</tr>
<tr>
<td>waitForElementPresent</td>
<td>//head/link[@rel='stylesheet' and @href='jsstyle.css']</td>
<td></td>
</tr>
<tr>
<td>assertElementPresent</td>
<td>//head/link[@rel='stylesheet' and @href='jsstyle.css']</td>
<td></td>
</tr>
<tr>
<td>assertElementPresent</td>
<td>//nav[@id='sitemap']/a[text()='No Style']</td>
<td></td>
</tr>
<tr>
<td>assertElementPresent</td>
<td>//nav[@id='language']//a[@hreflang='en']</td>
<td></td>
</tr>
<tr>
<td>assertElementNotPresent</td>
<td>//aside[@id='document_list']</td>
<td></td>
</tr>
<tr>
<td>assertElementNotPresent</td>
<td>//div[@class='input']</td>
<td></td>
</tr>
<tr>
<td>assertElementPresent</td>
<td>//main//h2[text()='Unexpected URL']</td>
<td></td>
</tr>
<tr>
<td>assertElementPresent</td>
<td>//main//p[text()='The URL should not rely on ID acquisition.']</td>
<td></td>
</tr>
</tbody></table>
</body>
</html>
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7