[hal_json] Introspection is unrestricted and used everywhere via selectKwargsForCallable

bt5/erp5_hal_json_style/SkinTemplateItem/portal_skins/erp5_hal_json_style/ERP5Document_getHateoas.py

@@ -250,7 +250,9 @@ def selectKwargsForCallable(func, initial_kwargs, kwargs_dict):
 
   if hasattr(func, 'params'):
     # In case the func is actualy Script (Python) or ERP5 Python Script
-    func_param_list = [tuple(map(lambda x: x.strip(), func_param.split('='))) for func_param in func.params().split(",")]
+    func_param_list = [tuple(map(lambda x: x.strip(), func_param.split('=')))
+                       for func_param in func.Script_getParams().split(",")
+                       if func_param.strip()]
 
   elif hasattr(func, "func_args"):
     # In case the func is an External Method
@@ -274,7 +276,7 @@ def selectKwargsForCallable(func, initial_kwargs, kwargs_dict):
     # move necessary parameters from kwargs_dict to initial_kwargs
     if func_param_name not in initial_kwargs and func_param_name in kwargs_dict:
       func_param_value = kwargs_dict.get(func_param_name)
-      if callable(func_param_value):
+      if hasattr(func_param_value, "__call__"):
         initial_kwargs[func_param_name] = func_param_value()  # evaluate lazy attributes
       else:
         initial_kwargs[func_param_name] = func_param_value
@@ -426,21 +428,13 @@ def getAttrFromAnything(search_result, select, search_property_getter, kwargs):
       pass
 
   if callable(contents_value):
-    has_mandatory_param = False
-    has_brain_param = False
-    if hasattr(contents_value, "params"):
-      has_mandatory_param = any(map(lambda param: '=' not in param and '*' not in param,
-                                    contents_value.params().split(","))) \
-                            if contents_value.params() \
-                            else False # because any([]) == True
-      has_brain_param = "brain" in contents_value.params()
+    callable_args = selectKwargsForCallable(contents_value, {}, {'brain': search_result})
     try:
-      if has_mandatory_param:
+      if len(callable_args) == 1 and 'brain' not in callable_args:
+        # function has one mandatory parameter
         contents_value = contents_value(search_result)
-      elif has_brain_param:
-        contents_value = contents_value(brain=search_result)
       else:
-        contents_value = contents_value()
+        contents_value = contents_value(**callable_args)
     except (AttributeError, KeyError, Unauthorized) as error:
       log("Could not evaluate {} on {} with error {!s}".format(
         contents_value, search_result, error), level=200)  # ERROR

bt5/erp5_hal_json_style/SkinTemplateItem/portal_skins/erp5_hal_json_style/Script_getParams.py

+return context.params()

bt5/erp5_hal_json_style/SkinTemplateItem/portal_skins/erp5_hal_json_style/Script_getParams.xml

+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>Script_magic</string> </key>
+            <value> <int>3</int> </value>
+        </item>
+        <item>
+            <key> <string>_bind_names</string> </key>
+            <value>
+              <object>
+                <klass>
+                  <global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
+                </klass>
+                <tuple/>
+                <state>
+                  <dictionary>
+                    <item>
+                        <key> <string>_asgns</string> </key>
+                        <value>
+                          <dictionary>
+                            <item>
+                                <key> <string>name_container</string> </key>
+                                <value> <string>container</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_context</string> </key>
+                                <value> <string>context</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_m_self</string> </key>
+                                <value> <string>script</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_subpath</string> </key>
+                                <value> <string>traverse_subpath</string> </value>
+                            </item>
+                          </dictionary>
+                        </value>
+                    </item>
+                  </dictionary>
+                </state>
+              </object>
+            </value>
+        </item>
+        <item>
+            <key> <string>_params</string> </key>
+            <value> <string></string> </value>
+        </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>Script_getParams</string> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>