From andrewm at object-craft.com.au  Wed Apr  6 11:13:46 2011
From: andrewm at object-craft.com.au (Andrew McNamara)
Date: Wed, 06 Apr 2011 11:13:46 +1000
Subject: [albatross-users] "noescape" tag attribute
Message-ID: <20110406011346.BF7B120851@longblack.object-craft.com.au>

While reviewing the "Tag Reference" section of the manual, I've noticed a
bit of an inconsistency. The "noescape" attribute is documented as only
having the following effects:

 * for <al-input>, noescape turns off the escaping of the evaluated value=
   attribute.

 * for <al-select>, noescape turns off the escaping of the generated
   <option> values.

 * for <al-textarea>, noescape turns off the escaping of the evaluated
   content that is generated for the tag.

 * for <al-img>, noescape turns off the escaping of the src="" attribute.

 * for <al-value>, noescape turns off the escaping of the replacement
   content.

Unfortunately, as other evaluated attributes have added, the "noescape"
logic has been extended to them as well, and "noescape" is all or
nothing. I'm worried that this is too much rope - someone will have
a nasty accident and pass unescaped content though, not realising it
applies to other tag attributes than those documented. Even if we fix
the documentation, it's too broad in scope to be used safely.

My feeling is that there is never a case for *not* escaping attributes,
and escaping of attributes should be made unconditional. My proposal is
to restrict the use and application of "noescape" to:

 * <al-value> content
 * <al-select> optionexpr-generated <option> body
 * <al-textarea> content body

The use of the attribute on other tags would become an error.

BTW, the escape function is:

    def escape(text):
        text = str(text)
        text = text.replace('&', '&amp;')
        text = text.replace('<', '&lt;')
        text = text.replace('>', '&gt;')
        text = text.replace('"', '&quot;')
        text = text.replace("'", '&#39;')
        return text

BTW2, This single function tops the list when template rendering is
profiled - a more efficient replacement could make template rendering up
to 20% faster (although this is insignificant in most applications). If
anyone is aware of a more efficient way of doing this, let me know
(and before you ask, regexps are 2-3x slower).

-- 
Andrew McNamara, Senior Developer, Object Craft
http://www.object-craft.com.au/


From andrewm at object-craft.com.au  Wed Apr 27 19:33:47 2011
From: andrewm at object-craft.com.au (Andrew McNamara)
Date: Wed, 27 Apr 2011 19:33:47 +1000
Subject: [albatross-users] Albatross 1.42 released
Message-ID: <20110427093347.80AEF20FEB@longblack.object-craft.com.au>


OVERVIEW

Albatross is a small toolkit for developing highly stateful web applications.

The toolkit has been designed to take a lot of the pain out of constructing
python web applications.

In slightly more than 4000 lines of Python (according to pycount) you get the
following:

  An extensible HTML templating system similar to DTML including tags for:
    - Conditional processing.
    - Macro definition and expansion.
    - Sequence iteration and pagination.
    - Tree browsing.
    - Lookup tables to translate Python values to arbitrary template text.

  Application classes which offer the following features:
    - Optional server side or browser side sessions.
    - The ability to place Python code for each page in a dynamically loaded
      module, or to place all page processing code in a single mainline.

  The ability to deploy applications as CGI, FastCGI, mod_python or a pure
  python HTTP server by changing less than 10 lines of code.

The toolkit application functionality is defined by a collection of fine
grained mixin classes.  Nine different application types and six different
execution contexts are prepackaged, you are able to define your own drop
in replacements for any of the mixins to alter any aspect of the toolkit
semantics.

Application deployment is controlled by your choice of either cgi, FastCGI,
mod_python, or BaseHTTPServer Request class.  It should be possible to
develop a Request class for Medusa or Twisted to allow applications to be
deployed on those platforms with minimal changes.

Albatross comes with over 200 pages of documentation.  HTML and PDF formatted
documentation is available from the toolkit homepage.

The toolkit homepage:

        http://www.object-craft.com.au/projects/albatross/

The Albatross mailing list subscription and archives:

	http://object-craft.com.au/cgi-bin/mailman/listinfo/albatross-users

CHANGES SINCE 1.40:
===================

New Features
------------

* Template evaluation namespaces

  Evaluation of expressions in templates normally takes place within the
  scope of ctx.locals. The new <al-namespace> tag allows you to switch
  temporarily to a subordinate namespace. Expression evaluation will take
  place with respect to that namespace, and input names will automatically
  be prefixed with the name of the namespace.

  For example:

      class Field:
          prompt = 'Enter age'
          data = 23

      field = Field()
  
  And

      <al-namespace name="field">
          <al-value expr="prompt">: <al-input name="data" whitespace>
      </al-namespace>

  Would produce:

      Enter age: <input name="field.data" value="23" />

  A namespace="..." attribute has also been added to the <al-expand> and
  <al-for> tags allowing you to execute their contained content in the
  specified namespace.

* Easier selection of Application and Context classes

  A new get_app_classes(page_model, context_model) function has been added
  that makes choosing Application and Context classes easier. Previously,
  you had to choose between one of twelve Application classes and match
  this with an appropriate Context class. With the get_app_classes()
  function, you just need to choose a page model and a session model,
  and the appropriate Application and Context classes are returned. For
  more information, see the "Prepackaged Application and Execution Context
  Classes" section of the manual.

* Albatross command line and quick-start application skeleton

  An albatross command line utility has been added. This utility currently
  has four sub-commands:

  * create - creates the basic framework of an application.

  * add-page - adds a page to an application so created.

  * serve - starts a stand-alone development server for the specified
    application.

  * session-server - starts a session server (see "Session Server Daemon"
    in the "Guide to Building Applications" section of the manual for
    more information).

  This makes it very easy to get started writing Albatross applications:

    $ albatross create myapp
    $ cd myapp
    $ ls
    app.ini  app.py  pages	session  static
    $ ls pages
    environment.html  macros.html  new_session.py       session_expired.html
    environment.py    main.html    page_not_found.html  uncaught_exception.html
    __init__.py       main.py      raise_exception.py   unhandled_exception.html
    1$ ls static
    alxform.css  favicon.ico  logo.png  style.css
    $ albatross serve
    Starting web server for "myapp" on port 8000
    Stop the server with Ctrl-C
    http://localhost:8000/


Enhancements
------------

* A new alternative to the noescape attribute has been implemented that
  allows a data source to signal that a given string does not require
  escaping when it is rendered by template execution by casting it to the
  htmlsafe() type. This moves the responsibility for this potentially risky
  action from the template closer to the code that generated the string.
  The htmlsafe() type can also be used to selectively disable the escaping
  of evaluated attributes.

  While the "noescape" attribute still works, it's scope has been reduced,
  and it should be considered deprecated.

* RandomModular applications will now attempt to render an
  application-supplied page_not_found.html template, before falling back
  to an internal "URL .. was not found on this server" message.

* A simple logging mechanism has been added. Calling the
  Application.set_logger(logger) method with a logger compatible with the
  standard python logging module registers that logger with the application.
  Exceptions will be logged to the logger at "error" level, and a ctx.log(msg)
  method allows messages to be logged at "info" level.


Incompatibilities
-----------------

* As of version 1.42, Albatross no longer supports Python 2.3 - version
  2.4 or up is required (Python 3 is not supported at this time).

* Application.handle_exception(ctx, req) no longer escapes the python and
  template tracebacks before executing any application-supplied trackback
  template. As this change could result in a potential security problem, the
  application-supplied exception template has been renamed from traceback.html
  to uncaught_exception.html. If you used this functionality, you must
  remove "noescape" from your traceback.html template before renaming it
  to uncaught_exception.html.

* SessionExpired handling was made consistent across session
  models and SessionExpired is now caught by the Application.run()
  method. When run() catches a SessionExpired exception, it calls
  Application.handle_session_expired(). This method attempts to display an
  application-supplied session_expired.html template before falling back
  to an internal "Your session has expired" message.

* The noescape attribute (which disables the escaping of special HTML
  characters) is now only honoured for tag content, not tag attributes.
  Formerly, noescape on a tag would turn off escaping of all attributes
  and tag content. On reflection, this is too broad to be used safely. The
  noescape attribute will now raise an exception if used on any tag other than
  <al-option>, <al-select>, <al-textarea> or <al-value>, and only applies to
  the tag content. The new htmlsafe() mechanism provides an alternative way to
  disable escaping of evaluated attributes (see "Escaping generated content"
  in the "Templates Reference" section of the manual for more information).

* The session daemon al-session-daemon and the stand-alone development
  server al-httpd are now part of the Albatross command line tool.  Usage
  remains largely the same, but rather than invoking al-session-daemon
  start, use albatross session-server start, and rather than al-httpd
  module.app 8080, use albatross serve --port=8080 module.app. You can
  also symlink the albatross script to al-session-daemon and al-httpd.
  For more information on the session server, see "Session Server Daemon"
  in the "Guide to Building Applications" section of the manual, and for
  more information on the stand-alone development server, see "Stand-alone
  Python HTTP Server Deployment".

Bug Fixes
---------

* If an application supplied it's own traceback.html template, the HTML
  headers would be emitted twice. Also see the important note above regarding
  escaping of the tracebacks and renaming the template.

* PageModuleMixin.load_page_module() now raises a new PageNotFound exception
  (a subclass of ApplicationError) if the page module is not found.
  This addresses a bug where the RandomPageModuleMixin would not reliably
  handle an unknown page.

* The standard exception handling bypasses the context logic, writing
  directly to the Request object. This created an issue with the session
  cookie not being cleared when an exception occurred. The exception handler
  now explicitly adds a "Set-Cookie:" header to clear the application cookie.

-- 
Andrew McNamara, Senior Developer, Object Craft
http://www.object-craft.com.au/