{ "info": { "author": "Tommy Yu", "author_email": "tommy.yu@auckland.ac.nz", "bugtrack_url": null, "classifiers": [ "Programming Language :: Python", "Topic :: Software Development :: Libraries :: Python Modules" ], "description": "Introduction\n============\n\nThis package extends z3c.form and plone.z3cform for usage within PMR2\nand related libraries. Problems this package attempt to tackle are:\n\n - Ensure the correct root template is adapted when forms (and views/\n pages) are rendered, such that there will only be one class used for\n testing and production, without having to subclass for specific uses\n or make use of wrapper classes/methods. It may be possible to\n support other frameworks by registering the root view to the desired\n layer.\n - CSRF (Cross-Site Request Forgery) prevention via the use of\n appropriate form authenticators, e.g. plone.protect for Plone.\n - Offer the same adaptable browser class (pages) to standard non-form\n views.\n - Forms with traversal subpaths.\n\nInstallation and usage\n----------------------\n\nJust add or modified the ``install_requires`` option into the setup\nfunction in a typical ``setup.py``. Example::\n\n from setuptools import setup\n \n setup(\n ...\n install_requires=[\n ...\n 'pmr2.z3cform',\n ]\n )\n\nForms\n=====\n\nForms in PMR2 are built on top of z3c.forms. There are certain changes\nwe made to allow this library to better fit into our use cases. There\nare a couple modifications, the first being the enforcement of request\nmethod, and the other is CSRF (Cross-site Request Forgery) protection.\n\nFirst we import some base classes and create a test form class::\n\n >>> import zope.interface\n >>> import zope.schema\n >>> import z3c.form.field\n >>> from pmr2.z3cform.testing import BaseTestRequest as TestRequest\n >>> from pmr2.z3cform.tests import base\n >>> from pmr2.z3cform.form import AddForm\n >>>\n >>> class IDummy(zope.interface.Interface):\n ... id = zope.schema.DottedName(title=u'id')\n ...\n >>> class Dummy(object):\n ... zope.interface.implements(IDummy)\n ... def __init__(self, id_):\n ... self.id = id_\n ...\n >>> class TestAddForm(AddForm):\n ... fields = z3c.form.field.Fields(IDummy)\n ... def create(self, data):\n ... return Dummy(data['id'])\n ... def add_data(self, ctxobject):\n ... ctxobject.id = self._data['id']\n ... def add(self, obj):\n ... self.context.append(obj)\n ... def nextURL(self):\n ... return '' # unnecessary.\n\nFirst thing to demonstrate is is the request method verification. Forms\nthat manipulate data must not be activated by a simple GET request::\n\n >>> context = []\n >>> request = TestRequest(form={\n ... 'form.widgets.id': 'test',\n ... 'form.buttons.add': '1',\n ... })\n >>> request.method = 'GET'\n >>> form = TestAddForm(context, request)\n >>> result = form()\n Traceback (most recent call last):\n ...\n Unauthorized: Unauthorized()\n >>> context == []\n True\n\nOn the other hand, POST requests will not trigger the permission error::\n\n >>> request.method = 'POST'\n >>> form = TestAddForm(context, request)\n >>> form.disableAuthenticator = True\n >>> result = form()\n >>> print context[0].id\n test\n\nHowever, notice that the security authenticator is disabled. What this\nprovide is the check for a CSRF prevention token that must be part of a\nrequest. Now try the above with the check enabled, as it will be by\ndefault::\n\n >>> context = []\n >>> request.method = 'POST'\n >>> form = TestAddForm(context, request)\n >>> result = form()\n Traceback (most recent call last):\n ...\n Unauthorized: Unauthorized()\n >>> context == []\n True\n\nIf the token is provided, as part of a normal form submission process\nusing a form rendered by this site, the token will be included within\na hidden input field. In the case of Plone, this token is provided by\nan authenticator view. If we include the generated token the form\nwill be submitted properly::\n\n >>> context = []\n >>> authed_request = base.TestRequest(form=request.form)\n >>> authed_request.method = 'POST'\n >>> '_authenticator' in authed_request.form\n True\n >>> form = TestAddForm(context, authed_request)\n >>> result = form()\n >>> print context[0].id\n test\n\nPages\n=====\n\nThese were just simple rendering pages meant for wrapping by the layout\nclasses to be replaced by more standard Plone way of rendering \ntemplates.\n\nLet's subclass one::\n\n >>> from pmr2.z3cform.tests.base import TestRequest\n >>> from pmr2.z3cform.page import SimplePage\n >>>\n >>> class TestPage(SimplePage):\n ... template = lambda x: 'Hello'\n\nThen render it::\n\n >>> context = self.portal\n >>> request = TestRequest()\n >>> page = TestPage(context, request)\n >>> print page()\n