Forward port of #807 (Consistently use "zope.tales" as TALES implemen…

…tation) (#810)

* resolve merge conflicts

* - add forgotten version update

* - remove Python 2 compatibility code

* - update to zope.hookable 5.0.1 to fix Python 3.9 issues

* - allow Python 3.9 to fail until Zope's dependencies support it

* - still need to list the failing job in the matrix

* merge in #812

Co-authored-by: Jens Vagelpohl <jens@netz.ooo>

.travis.yml

@@ -14,6 +14,9 @@ matrix:
           env: TOXENV=py38
         - python: "3.9-dev"
           env: TOXENV=py39
+    allow_failures:
+        - python: "3.9-dev"
+          env: TOXENV=py39
 
 install:
     - travis_retry pip install -U pip setuptools

CHANGES.rst

@@ -25,6 +25,19 @@ New features
 Bug fixes
 +++++++++
 
+- Improve ``chameleon`` --> ``zope.tales`` context wrapper
+  (support for template variable injection)
+  (`#812 <https://github.com/zopefoundation/Zope/pull/812>`_).
+
+- Require ``zope.tales>=5.0.2``
+
+- Fix issue 717 by fully honoring the engine returned by
+  ``PageTemplate.pt_getEngine``
+  (`#717 <https://github.com/zopefoundation/Zope/issues/717>`_).
+  The engine also decides about the use of ``zope.tales``
+  (engine is an instance of ``zope.pagetemplate.engine.ZopeBaseEngine``)
+  or ``chameleon.tales`` (otherwise) TALES expressions.
+
 - Fixed encoding issue of `displayname` WebDAV property
   (`#797 <https://github.com/zopefoundation/Zope/issues/797>`_)
 

constraints.txt

@@ -2,7 +2,7 @@ AccessControl==4.1
 Acquisition==4.6
 AuthEncoding==4.1
 BTrees==4.6.1
-Chameleon==3.6.2
+Chameleon==3.7.0
 DateTime==4.3
 DocumentTemplate==3.2.2
 ExtensionClass==4.4
@@ -64,7 +64,7 @@ zope.exceptions==4.3
 zope.filerepresentation==4.2.0
 zope.formlib==4.7.0
 zope.globalrequest==1.5
-zope.hookable==5.0.0
+zope.hookable==5.0.1
 zope.i18n==4.7.0
 zope.i18nmessageid==5.0.1
 zope.interface==4.7.2
@@ -84,7 +84,7 @@ zope.site==4.2.2
 zope.size==4.3
 zope.structuredtext==4.3
 zope.tal==4.4
-zope.tales==5.0.1
+zope.tales==5.0.2
 zope.testbrowser==5.5.1
 zope.testing==4.7
 zope.testrunner==5.1

requirements-full.txt

@@ -3,7 +3,7 @@ AccessControl==4.1
 Acquisition==4.6
 AuthEncoding==4.1
 BTrees==4.6.1
-Chameleon==3.6.2
+Chameleon==3.7.0
 DateTime==4.3
 DocumentTemplate==3.2.2
 ExtensionClass==4.4
@@ -65,7 +65,7 @@ zope.exceptions==4.3
 zope.filerepresentation==4.2.0
 zope.formlib==4.7.0
 zope.globalrequest==1.5
-zope.hookable==5.0.0
+zope.hookable==5.0.1
 zope.i18n==4.7.0
 zope.i18nmessageid==5.0.1
 zope.interface==4.7.2
@@ -85,7 +85,7 @@ zope.site==4.2.2
 zope.size==4.3
 zope.structuredtext==4.3
 zope.tal==4.4
-zope.tales==5.0.1
+zope.tales==5.0.2
 zope.testbrowser==5.5.1
 zope.testing==4.7
 zope.testrunner==5.1

setup.py

@@ -72,6 +72,7 @@ def _read_file(filename):
         'AccessControl >= 4.0b4',
         'Acquisition',
         'BTrees',
+        'Chameleon >= 3.7.0',
         'DateTime',
         'DocumentTemplate >= 3.0b9',
         'ExtensionClass',
@@ -115,7 +116,7 @@ def _read_file(filename):
         'zope.site',
         'zope.size',
         'zope.tal',
-        'zope.tales >= 3.5.0',
+        'zope.tales >= 5.0.2',
         'zope.testbrowser',
         'zope.testing',
         'zope.traversing',

src/Products/Five/browser/pagetemplatefile.py

@@ -19,13 +19,13 @@
 from AccessControl import getSecurityManager
 from Acquisition import aq_get
 from Products.PageTemplates.Expressions import SecureModuleImporter
-from Products.PageTemplates.Expressions import createTrustedZopeEngine
+from Products.PageTemplates.Expressions import getTrustedEngine
 from zope.component import getMultiAdapter
 from zope.pagetemplate.engine import TrustedAppPT
 from zope.pagetemplate.pagetemplatefile import PageTemplateFile
 
 
-_engine = createTrustedZopeEngine()
+_engine = getTrustedEngine()
 
 
 def getEngine():

src/Products/PageTemplates/Expressions.py

@@ -398,7 +398,7 @@ def __call__(self, econtext):
         return self._expr % tuple(vvals)
 
 
-def createZopeEngine(zpe=ZopePathExpr):
+def createZopeEngine(zpe=ZopePathExpr, untrusted=True):
     e = ZopeEngine()
     e.iteratorFactory = PathIterator
     for pt in zpe._default_type_names:
@@ -410,13 +410,15 @@ def createZopeEngine(zpe=ZopePathExpr):
     e.registerType('lazy', LazyExpr)
     e.registerType('provider', TALESProviderExpression)
     e.registerBaseName('modules', SecureModuleImporter)
+    e.untrusted = untrusted
     return e
 
 
 def createTrustedZopeEngine():
     # same as createZopeEngine, but use non-restricted Python
     # expression evaluator
-    e = createZopeEngine(TrustedZopePathExpr)
+    # still uses the ``SecureModuleImporter``
+    e = createZopeEngine(TrustedZopePathExpr, untrusted=False)
     e.types['python'] = PythonExpr
     return e
 
@@ -426,3 +428,10 @@ def createTrustedZopeEngine():
 
 def getEngine():
     return _engine
+
+
+_trusted_engine = createTrustedZopeEngine()
+
+
+def getTrustedEngine():
+    return _trusted_engine