[Zope-dev] Re: [Zope] Restricting URL access to objects that are not complete web pages

[Steve Alexander]

Stephen Simmons wrote:

 >
 > My thoughts were to use an html_header that tracks how deeply 
components are
 > nested so that inner components turn off the page wrapper. This 
achieves 1
 > and 2. This also achieves 3 if sections raise an exception if their page
 > wrapper is not turned off.

You only want to see standard_html_footer and so forth when
REQUEST.steps[-1]!=fragment_id, so it would not be accessible directly
by URL.

Try something like this for standard_html_footer:

<dtml-if "REQUEST.steps[-1]=='standard_html_footer'">
<dtml-raise type="NotFound"></dtml-raise></dtml-if>
</BODY></HTML>

I think using siteaccess for this is more elegant, though. All the
knowledge about what is allowed and what is not is maintained in one
place, and the knowledge can be declared flexibly using regular expressions.

--
Steve Alexander
Software Engineer
Cat-Box limited
http://www.cat-box.net