Time to start getting add-on products ready for Chameleon?

classic Classic list List threaded Threaded
17 messages Options
JonStahl JonStahl
Reply | Threaded
Open this post in threaded view
|

Time to start getting add-on products ready for Chameleon?

Hi all-

Last night I was dinking around with Chameleon in Plone 4 (by running
the coredev buildout with -c experimental/chameleon.cfg), and that got
me to thinking a little bit:

Is it time to start the process of encouraging add-on product authors
to identify and fix bits of invalid XHTML in their templates so that
their products don't break under Chameleon?  If we are planning to
ship Plone 5 with Chameleon enabled, it seems to me that we will need
quite a bit of time during the 4.x cycle for add-on product authors to
hold up their end of the bargain.

As a bonus, we might find ourselves in the happy position of having
large chunks of the Plone world be "safe for Chameleon" sometime later
in the 4.x cycle, allowing folks to feel comfortable enabling
Chameleon on Plone 4, giving us another ~25-50% speed boost. :-)
And we'd have helped folks learn the development practices necessary
for Plone 5, before Plone 5 is released!

If so, then that leads to a few questions:

- Is there an efficient way to scan code for Chameleon-breaking
errors?  (EAGER mode?)
- Can we document this and any tips for remediating errors it finds in
a FAQ for add-on product authors?
- Is anybody willing/able to champion the evangelism effort?  This
seems like a pretty low-effort/high-impact thing (for the right
person).

Just hoping to start some discussion, since this topic has been pretty
quiet for a while.

cheers,
:jon

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Jan Ulrich Hasecke-2 Jan Ulrich Hasecke-2
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

Am 27.08.10 18:23, schrieb Jon Stahl:
> Is it time to start the process of encouraging add-on product authors
> to identify and fix bits of invalid XHTML in their templates so that
> their products don't break under Chameleon?

Is it possible to i18nify Chameleon yet? I think without i18n there is
no sense to have add ons with Chameleon.

juh


------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
JonStahl JonStahl
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

On Fri, Aug 27, 2010 at 11:01 AM, Jan Ulrich Hasecke
<[hidden email]> wrote:
> Am 27.08.10 18:23, schrieb Jon Stahl:
>> Is it time to start the process of encouraging add-on product authors
>> to identify and fix bits of invalid XHTML in their templates so that
>> their products don't break under Chameleon?
>
> Is it possible to i18nify Chameleon yet? I think without i18n there is
> no sense to have add ons with Chameleon.

Great question!

http://chameleon.repoze.org/docs/latest/i18n.html suggests that it is,
but folks with greater i18n experience than me might be able to say
whether its i18n support is solid enough for us.

:Jon

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Hanno Schlichting-4 Hanno Schlichting-4
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by Jan Ulrich Hasecke-2
On Fri, Aug 27, 2010 at 8:01 PM, Jan Ulrich Hasecke
<[hidden email]> wrote:
> Am 27.08.10 18:23, schrieb Jon Stahl:
>> Is it time to start the process of encouraging add-on product authors
>> to identify and fix bits of invalid XHTML in their templates so that
>> their products don't break under Chameleon?
>
> Is it possible to i18nify Chameleon yet? I think without i18n there is
> no sense to have add ons with Chameleon.

Chameleon is a drop-in replacement for zope.pagetemplate. It is 99%
compatible, offers all the features of tal/tales/metal and of course
also supports the same i18n machinery we already use.

The most important difference is that Chameleon requires all templates
to be valid XHTML. One other difference is that Chameleon doesn't
automagically translate zope.i18nmessageid objects without the
presence of explicit i18n:translate markup. The implicit coupling to
zope.i18nmessageid was seen as a mis-feature.

There's been a number of other compatibility problems found over time,
which all have been classified as bugs and fixed. They tend to involve
rather obscure cases, like having custom C extension types without a
__class__, using nested list comprehensions inside templates,
injecting variables into templates by walking stack frames, ... and so
forth. The type of stuff we might find in dark corners of Zope and
Plone core, but is extremely unlikely to find anywhere else.

Hanno

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Hanno Schlichting-4 Hanno Schlichting-4
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by JonStahl
Hi Jon,

thanks for bringing this up.

On Fri, Aug 27, 2010 at 6:23 PM, Jon Stahl <[hidden email]> wrote:
> Is it time to start the process of encouraging add-on product authors
> to identify and fix bits of invalid XHTML in their templates so that
> their products don't break under Chameleon?  If we are planning to
> ship Plone 5 with Chameleon enabled, it seems to me that we will need
> quite a bit of time during the 4.x cycle for add-on product authors to
> hold up their end of the bargain.

I was meaning to PLIP Chameleon inclusion for a 4.x release, but don't
have the time to do this for 4.1.

So I'd like us to ship with Chameleon for 4.2, but disable it by
default. At that point we should make sure that all of Zope/Plone core
is compatible and it's easy to enable Chameleon (it basically already
is). A mixed-mode where you run some templates with the old and some
with the new engine is not possible. It's an either or choice, so we
need to make sure to be compatible and test things all the way.

> And we'd have helped folks learn the development practices necessary
> for Plone 5, before Plone 5 is released!

Plone 5 is still a long time off and Chameleon works today.
Withholding the speed benefit from our users for much longer doesn't
make a lot of sense to me. Since the only real difference developers
need to learn about is writing valid XHTML, I don't think there's much
of a learning burden for anyone. I doubt there's many web developers
who aren't able to write XHTML but only HTML.

> If so, then that leads to a few questions:
>
> - Is there an efficient way to scan code for Chameleon-breaking
> errors?  (EAGER mode?)

Indeed. When testing Chameleon compatibility you want to enable both
its eager and debug mode. This will validate all templates at Zope
startup letting you fix them one-by-one until Zope starts and you are
done.

> - Can we document this and any tips for remediating errors it finds in
> a FAQ for add-on product authors?
> - Is anybody willing/able to champion the evangelism effort?  This
> seems like a pretty low-effort/high-impact thing (for the right
> person).

We can probably do that. I'm not volunteering for it now, but will be
happy to help with things for Plone 4.2.

This shouldn't stop anyone else for moving forward with this.

Hanno

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
JonStahl JonStahl
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

On Fri, Aug 27, 2010 at 12:50 PM, Hanno Schlichting <[hidden email]> wrote:

> Hi Jon,
>
> thanks for bringing this up.
>
> On Fri, Aug 27, 2010 at 6:23 PM, Jon Stahl <[hidden email]> wrote:
>> Is it time to start the process of encouraging add-on product authors
>> to identify and fix bits of invalid XHTML in their templates so that
>> their products don't break under Chameleon?  If we are planning to
>> ship Plone 5 with Chameleon enabled, it seems to me that we will need
>> quite a bit of time during the 4.x cycle for add-on product authors to
>> hold up their end of the bargain.
>
> I was meaning to PLIP Chameleon inclusion for a 4.x release, but don't
> have the time to do this for 4.1.
>
> So I'd like us to ship with Chameleon for 4.2, but disable it by
> default. At that point we should make sure that all of Zope/Plone core
> is compatible and it's easy to enable Chameleon (it basically already
> is). A mixed-mode where you run some templates with the old and some
> with the new engine is not possible. It's an either or choice, so we
> need to make sure to be compatible and test things all the way.

Awesome, this is a great vision to have out there

>
>> And we'd have helped folks learn the development practices necessary
>> for Plone 5, before Plone 5 is released!
>
> Plone 5 is still a long time off and Chameleon works today.
> Withholding the speed benefit from our users for much longer doesn't
> make a lot of sense to me. Since the only real difference developers
> need to learn about is writing valid XHTML, I don't think there's much
> of a learning burden for anyone. I doubt there's many web developers
> who aren't able to write XHTML but only HTML.

Awesome, thanks for confirming.

>
>> If so, then that leads to a few questions:
>>
>> - Is there an efficient way to scan code for Chameleon-breaking
>> errors?  (EAGER mode?)
>
> Indeed. When testing Chameleon compatibility you want to enable both
> its eager and debug mode. This will validate all templates at Zope
> startup letting you fix them one-by-one until Zope starts and you are
> done.

>> - Can we document this and any tips for remediating errors it finds in
>> a FAQ for add-on product authors?
>> - Is anybody willing/able to champion the evangelism effort?  This
>> seems like a pretty low-effort/high-impact thing (for the right
>> person).
>
> We can probably do that. I'm not volunteering for it now, but will be
> happy to help with things for Plone 4.2.
>
> This shouldn't stop anyone else for moving forward with this.

I will take a stab at drafting the beginning of a FAQ for add-on
product authors, it will likely be too vague or inaccurate in places,
but it will serve as a 'home base' we can keep on pointing people back
at as we spread the word.  The reason I'm bringing this up now is
because we're going to be pushing product authors on Plone 4
compatibility, and we might as well push them on Chameleon/XHTML
compatibility as well.

Thanks, Hanno!

:jon

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
David Glick (GW) David Glick (GW)
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by Hanno Schlichting-4


On Aug 27, 2010, at 12:51 PM, "Hanno Schlichting" <[hidden email]> wrote:

> Hi Jon,
>
> thanks for bringing this up.
>
> On Fri, Aug 27, 2010 at 6:23 PM, Jon Stahl <[hidden email]> wrote:
>> Is it time to start the process of encouraging add-on product authors
>> to identify and fix bits of invalid XHTML in their templates so that
>> their products don't break under Chameleon?  If we are planning to
>> ship Plone 5 with Chameleon enabled, it seems to me that we will need
>> quite a bit of time during the 4.x cycle for add-on product authors to
>> hold up their end of the bargain.
>
> I was meaning to PLIP Chameleon inclusion for a 4.x release, but don't
> have the time to do this for 4.1.
>
> So I'd like us to ship with Chameleon for 4.2, but disable it by
> default. At that point we should make sure that all of Zope/Plone core
> is compatible and it's easy to enable Chameleon (it basically already
> is). A mixed-mode where you run some templates with the old and some
> with the new engine is not possible. It's an either or choice, so we
> need to make sure to be compatible and test things all the way.

Chameleon does not currently support RestrictedPython checks for TTW templates, right? So we would either need to disable TTW templates, or do a really good job of communicating that people can't rely on the security checks they're used to if they use Chameleon. (or add checks to Chameleon for TTW templates, but I fear that would counteract the performance gain).

>
----------
David Glick
 Web Developer
  [hidden email]
  206.286.1235x32

Groundwire: You Are Connected
 http://groundwire.org

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Hanno Schlichting-4 Hanno Schlichting-4
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

On Fri, Aug 27, 2010 at 10:00 PM, David Glick <[hidden email]> wrote:
> Chameleon does not currently support RestrictedPython checks for TTW templates, right? So we would either need to disable TTW templates, or do a really good job of communicating that people can't rely on the security checks they're used to if they use Chameleon. (or add checks to Chameleon for TTW templates, but I fear that would counteract the performance gain).

Ah right, forgot about that one. There's two options I can see:

- Sponsor Malthe to implement the support for this. He said at one
point that it should be "rather simple" and only cost him a couple
days. I'd take that as an over-optimistic developer estimate. I think
there's nobody else who could implement this in any reasonable amount
of time, as Chameleon internals aren't exactly easy to understand.

- Live without RestrictedPython for TTW templates and warn about this.
The important bit is that templates respect AccessControl security.
RestrictedPython is really a misfeature that needs to go away. It
promises to allow untrusted users to write templates TTW. But even
with all the checks we have in place, it's still easy to do simple
denial of service attacks this way or shutdown the Zope process. I'm
not aware of any ways to access file system contents, but I wouldn't
be surprised if that would be possible in some way. As soon as someone
is allowed to write Python code, it's likely that person can get a lot
of access.

With Zope 2.13 PythonScripts and ExternalMethods are already optional
and they won't be part of Zope2 core anymore in Zope 2.14. At some
point we just need to bite the bullet and get rid of RestrictedPython
wholesale.

Hanno

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Alan Runyan-3 Alan Runyan-3
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

> - Live without RestrictedPython for TTW templates and warn about this.
> The important bit is that templates respect AccessControl security.
> RestrictedPython is really a misfeature that needs to go away. It
> promises to allow untrusted users to write templates TTW. But even
> with all the checks we have in place, it's still easy to do simple
> denial of service attacks this way or shutdown the Zope process. I'm
> not aware of any ways to access file system contents, but I wouldn't
> be surprised if that would be possible in some way. As soon as someone
> is allowed to write Python code, it's likely that person can get a lot
> of access.
>
> With Zope 2.13 PythonScripts and ExternalMethods are already optional
> and they won't be part of Zope2 core anymore in Zope 2.14. At some
> point we just need to bite the bullet and get rid of RestrictedPython
> wholesale.
>

I agree with this.  If you are customizing templates in the web interface
*you damn well should be considered trusted*. I believe a reasonable
position is saying something
like.  In Zope 2.14 or Plone 5 - if you customize the template in the
web interface.  THERE ARE NO SECURITY checks.  So if you give someone
this ability we arent pretending that there is a sandbox
your templates will run in.  Also it means people can write code
however they want without having to whitelist python modules.

Maybe having ENV variable that enables/disables TTW templates.

great idea guys.

BTW is there a way ppl are testing Plone with Chameleon?  i.e. formal
test suite?  or right now its just fix brokeness as you find it?  i.e.
how to find a template regression?

alan

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
JonStahl JonStahl
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

> BTW is there a way ppl are testing Plone with Chameleon?  i.e. formal
> test suite?  or right now its just fix brokeness as you find it?  i.e.
> how to find a template regression?

I don't think there is a formal test suite (if there is, I'd love to
hear about it), but one can run the coredev buildout w bin/buildout -c
experimental/chameleon.cfg, then startup in debug mode, which will
throw Chameleon into "EAGER + DEBUG" mode, which will, as I understand
it, attempt to compile all of the templates at Zope startup, and throw
errors (failing to start zope) if it finds anything it doesn't like.
Right now, plone 4 coredev starts up great, but all of the add-on
products I tried had some minor errors.

Not sure if there's a way to use Hudson here.

:jon

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Wichert Akkerman Wichert Akkerman
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by Hanno Schlichting-4
On 2010-8-27 21:38, Hanno Schlichting wrote:
> There's been a number of other compatibility problems found over time,
> which all have been classified as bugs and fixed. They tend to involve
> rather obscure cases, like having custom C extension types without a
> __class__, using nested list comprehensions inside templates,
> injecting variables into templates by walking stack frames, ... and so
> forth. The type of stuff we might find in dark corners of Zope and
> Plone core, but is extremely unlikely to find anywhere else.

There is one jarring issue still: there is a strange acquisition
wrapping bug in five.pt which breaks URLs in some ZMI pages (most
noticably most of the GenericSetup pages). It would be very, very useful
if someone can take the time to write tests for all the various uses of
page templates.

Wichert.

--
Wichert Akkerman <[hidden email]>   It is simple to make things.
http://www.wiggy.net/                  It is hard to make things simple.

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Wichert Akkerman Wichert Akkerman
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by JonStahl
On 2010-8-27 18:23, Jon Stahl wrote:
> Hi all-
>
> Last night I was dinking around with Chameleon in Plone 4 (by running
> the coredev buildout with -c experimental/chameleon.cfg), and that got
> me to thinking a little bit:
>
> Is it time to start the process of encouraging add-on product authors
> to identify and fix bits of invalid XHTML in their templates so that
> their products don't break under Chameleon?

I think some of use have already been doing that for a while.

> - Is there an efficient way to scan code for Chameleon-breaking
> errors?  (EAGER mode?)

No need to start Zope even - you can quickly check XML validity with
xmllint (part of libxml2).

Wichert.

--
Wichert Akkerman <[hidden email]>   It is simple to make things.
http://www.wiggy.net/                  It is hard to make things simple.

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
JonStahl JonStahl
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

On Fri, Aug 27, 2010 at 7:13 PM, Wichert Akkerman <[hidden email]> wrote:
> On 2010-8-27 18:23, Jon Stahl wrote:

>> Is it time to start the process of encouraging add-on product authors
>> to identify and fix bits of invalid XHTML in their templates so that
>> their products don't break under Chameleon?
>
> I think some of use have already been doing that for a while.

Glad to hear it!  I'd like to increase that number. :-)

>> - Is there an efficient way to scan code for Chameleon-breaking
>> errors?  (EAGER mode?)
>
> No need to start Zope even - you can quickly check XML validity with
> xmllint (part of libxml2).

Ah, perfect!  I suspected there was something like that.  Thanks, Wichert!

:jon

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
JonStahl JonStahl
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

I've taken the bull by the horns here and written a short article in
the "Upgrading your add-on product" section of the Plone Upgrade
Guide.

http://plone.org/documentation/manual/upgrade-guide/version/upgrading-plone-3-x-to-4.0/updating-add-on-products-for-plone-4.0/make-sure-your-templates-are-xhtml-compliant

Comments, suggestions, corrections welcome.   If y'all think this is
good (or it soon becomes good), I'll publicize it a bit on the Product
Developers list.

:jon

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Jota Jota
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

This post has NOT been accepted by the mailing list yet.
In reply to this post by JonStahl
This is great news!!
If the promised speed boost cames true, and if Chameleon will be the default in Plone 5, then maybe the Plone 4 release that ships with Chameleon should not be called a "4.2" but a "4.5", to emphasize the importance of this improvement (and maybe others by then) ?
Jota
Alexander Limi Alexander Limi
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by Hanno Schlichting-4
On Fri, Aug 27, 2010 at 2:04 PM, Hanno Schlichting <[hidden email]> wrote:
On Fri, Aug 27, 2010 at 10:00 PM, David Glick <[hidden email]>- Live without RestrictedPython for TTW templates and warn about this.
The important bit is that templates respect AccessControl security.
RestrictedPython is really a misfeature that needs to go away.

Hear, hear. For very large values of +1.

--
Alexander Limi · http://limi.net · http://twitter.com/limi




------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:

Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers
Alexander Limi · http://limi.net

Alan Runyan-3 Alan Runyan-3
Reply | Threaded
Open this post in threaded view
|

Re: Time to start getting add-on products ready for Chameleon?

In reply to this post by JonStahl
On Fri, Aug 27, 2010 at 11:29 PM, Jon Stahl <[hidden email]> wrote:
> I've taken the bull by the horns here and written a short article in
> the "Upgrading your add-on product" section of the Plone Upgrade
> Guide.
>
> http://plone.org/documentation/manual/upgrade-guide/version/upgrading-plone-3-x-to-4.0/updating-add-on-products-for-plone-4.0/make-sure-your-templates-are-xhtml-compliant
>
> Comments, suggestions, corrections welcome.   If y'all think this is
> good (or it soon becomes good), I'll publicize it a bit on the Product
> Developers list.

After experimenting with chameleon for one of our projects.  We found:
  - EAGER does not work 100% of the time.
  - We should (I hope to have someone at enfold) write a test which walks all
    zpts and do the compilation.  Should be at higher test level;
since it could take awhile
  - There should be a "best practice" around preamble and how this
will be handled.
  - xmllint generates boatloads of noise

my thoughts before the weekend,
alan

------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Plone-developers mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-developers