37. SQLALCHEMY + URL DISPATCH WIKI TUTORIAL
from pyramid.security import ( remember,
forget, authenticated_userid,
)
from .security import USERS
37.7.5 Changing Existing Views
Add permision declarations
Then we need to change each of our view_page, edit_page and add_page view callables in views.py. Within each of these views, we’ll need to pass a “logged in” parameter to its template. We’ll add something like this to each view body:
from pyramid.security import authenticated_userid logged_in = authenticated_userid(request)
Return a logged_in flag to the renderer
We’ll then change the return value of these views to pass the resulting logged_in value to the template, e.g.:
return dict(page = page, content = content,
logged_in = logged_in, edit_url = edit_url)
We’ll also need to add a permission value to the @view_config decorator for each of the add_page and edit_page view callables. For each, we’ll add permission=’edit’, for example:
@view_config(route_name=’edit_page’, renderer=’templates/edit.pt’, permission=’edit’)
37.7. ADDING AUTHORIZATION
See the permission=’edit’ we added there? This indicates that the view callables which these views reference cannot be invoked without the authenticated user possessing the edit permission with respect to the current context.
Adding these permission arguments causes Pyramid to make the assertion that only users who possess the effective edit permission at the time of the request may invoke those two views. We’ve granted the group:editors principal the edit permission in the root factory via its ACL, so only a user who is a member of the group named group:editors will be able to invoke the views associated with the add_page or edit_page routes.
37.7.6 Adding the login.pt Template
Add a login.pt template to your templates directory. It’s referred to within the login view we just added to views.py.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:tal="http://xml.zope.org/namespaces/tal">
<head>
<title>Login - Pyramid tutorial wiki (based on TurboGears 20-Minute Wiki)</title>
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8"/> <meta name="keywords" content="python web application" />
<meta name="description" content="pyramid web application" /> <link rel="shortcut icon"
href="${request.static_url(’tutorial:static/favicon.ico’)}" /> <link rel="stylesheet"
href="${request.static_url(’tutorial:static/pylons.css’)}" type="text/css" media="screen" charset="utf-8" />
<!--[if lte IE 6]> <link rel="stylesheet"
href="${request.static_url(’tutorial:static/ie6.css’)}" type="text/css" media="screen" charset="utf-8" />
<![endif]-->
</head>
<body>
<div id="wrap">
<div id="top-small">
<div class="top-small align-center">
<div>
<img width="220" height="50" alt="pyramid" src="${request.static_url(’tutorial:static/pyramid-small.png’)}" />
</div>
37. SQLALCHEMY + URL DISPATCH WIKI TUTORIAL
</div>
</div>
<div id="middle">
<div class="middle align-right">
<div id="left" class="app-welcome align-left"> <b>Login</b><br/>
<span tal:replace="message"/>
</div>
<div id="right" class="app-welcome align-right"></div>
</div>
</div>
<div id="bottom">
<div class="bottom">
<form action="${url}" method="post">
<input type="hidden" name="came_from" value="${came_from}"/> <input type="text" name="login" value="${login}"/><br/> <input type="password" name="password"
value="${password}"/><br/>
<input type="submit" name="form.submitted" value="Log In"/>
</form>
</div>
</div>
</div>
<div id="footer"> <div class="footer"
>© Copyright 2008-2011, Agendaless Consulting.</div>
</div>
</body>
</html>
37.7.7 Add a “Logout” link when logged in
We’ll also need to change our edit.pt and view.pt templates to display a “Logout” link if someone is logged in. This link will invoke the logout view.
To do so we’ll add this to both templates within the <div id="right" class="app-welcome align-right"> div:
<span tal:condition="logged_in">
<a href="${request.application_url}/logout">Logout</a>
</span>
37.7. ADDING AUTHORIZATION
37.7.8 Seeing Our Changes To views.py and our Templates
Our views.py module will look something like this when we’re done:
1 |
import re |
2 |
from |
docutils.core import publish_parts |
3 |
|
|
4 |
from |
pyramid.httpexceptions import ( |
5HTTPFound,
6HTTPNotFound,
7)
8
9 from pyramid.view import (
10view_config,
11forbidden_view_config,
12)
13
14from pyramid.security import (
15remember,
16forget,
17authenticated_userid,
18)
19
20from .models import (
21DBSession,
22Page,
23)
24
25 from .security import USERS
26
27# regular expression used to find WikiWords
28wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
29
30@view_config(route_name=’view_wiki’)
31def view_wiki(request):
32return HTTPFound(location = request.route_url(’view_page’,
33 |
pagename=’FrontPage’)) |
34
35@view_config(route_name=’view_page’, renderer=’templates/view.pt’)
36def view_page(request):
37pagename = request.matchdict[’pagename’]
38page = DBSession.query(Page).filter_by(name=pagename).first()
39if page is None:
40return HTTPNotFound(’No such page’)
41
42 def check(match):