cone.app 2.0.0__tar.gz → 2.2.0__tar.gz

{cone_app-2.0.0 → cone_app-2.2.0}/.gitignore

@@ -23,10 +23,8 @@
 /node_modules/
 /package-lock.json
 /pip-selfcheck.json
-/pnpm-lock.yaml
 /pyvenv.cfg
 /requirements-mxdev.txt
 /sources/
 /twistd.pid
 /venv/
-/pnpm-lock.yaml

{cone_app-2.0.0 → cone_app-2.2.0}/CHANGES.rst

@@ -1,6 +1,153 @@
 Changes
 =======
 
+2.2.0 (2026-11-09)
+------------------
+
+- The ``ajaxaction`` view only accepts ``POST`` requests. Requires ``treibstoff``
+  2.1.0.
+  [rnix]
+
+- The tile ``wf_dropdown`` only performs ``do_transition`` on ``POST`` requests.
+  [rnix]
+
+- ``Form`` only runs form actions on ``POST`` requests. On any other request it
+  renders the form. Tests calling a form action need ``request.method = 'POST'``.
+  [rnix]
+
+- Answer requests other than ``GET``, ``HEAD`` and ``OPTIONS`` with status ``403``
+  if a browser sends them for another site, recognized by the ``Sec-Fetch-Site``
+  and ``Origin`` headers. Clients sending neither pass. Add
+  ``cone.trusted_origins`` for browser clients of other origins.
+  [rnix]
+
+- Encode the node title in reference actions and in the link to leaf nodes, and
+  the label in display mode of the ``reference`` blueprint. Requires ``yafowil``
+  4.2.0.
+  [rnix]
+
+- ``main`` refuses to start if ``cone.auth_secret`` is missing or has the former
+  default value ``secret``.
+  [rnix]
+
+- Read ``cone.auth_secure``, ``cone.auth_include_ip``, ``cone.auth_http_only`` and
+  ``cone.auth_wild_domain`` as booleans. ``false`` in an ini file was considered
+  true before, applications with such a value change their behavior.
+  [rnix]
+
+- ``cone.auth_http_only`` defaults to ``True``.
+  [rnix]
+
+- Failures in ajax actions, ajax forms and the exception view answer with a
+  general message, the traceback goes to the log. Add setting
+  ``cone.show_tracebacks`` to show it to the client during development. Add
+  ``browser.utils.client_error_message``.
+  [rnix]
+
+- ``internal_server_error`` answers with status 500 instead of 200, also for
+  ajax requests. A ``default_commit_veto`` configured for ``pyramid_tm`` vetoes
+  such a request now, before it committed.
+  [rnix]
+
+- Compare the credentials of the admin user with ``hmac.compare_digest``.
+  [rnix]
+
+- A failed login in the login form answers with status 401 instead of 200, so a
+  throttle at the edge can recognize it. All failed logins log a warning with the
+  first two characters of the login name and the client address. The login form only
+  checks the password in the ``login`` view, not on other pages showing the form or
+  through ``ajaxaction``.
+  [rnix]
+
+- ``logout_view`` follows ``came_from`` only to an HTTP URL on the host of the
+  application. ``CameFromNext`` considers the scheme too. Add
+  ``browser.utils.is_same_host_url``.
+  [rnix]
+
+
+2.1.0 (2026-10-31)
+------------------
+
+- Require ``cone.tile>2.0.99``. ``cone.tile`` 2.0 secures tiles only if an
+  authentication and an authorization policy are registered, so it does not
+  protect tiles with the security policy configured by ``cone.app.main``.
+  [rnix]
+
+- Remove ``MainMenu.on_sidebar_left_resize``, which rendered the main menu
+  scrollbar again on each left sidebar resize. Both sidebars live inside the
+  content area below the header, so resizing them does not change the width of
+  the main menu. ``MainMenu`` keeps the inherited ``LayoutAware`` behavior.
+  [rnix]
+
+- Fix shift click selection of ``Selectable`` items. Shift click selects the
+  range from the last plain or ctrl clicked item (the anchor) to the clicked
+  item, as in file managers. Before, a further shift click started the range at
+  the wrong item. Shift click without an anchor acts like a plain click.
+  ``Selectable.select_direction`` and ``Selectable.get_nearest`` are removed.
+  [rnix]
+
+- Fix ``SidebarLeft`` and ``SidebarRight`` skipping their initialization on
+  small viewports with a stored lock state. The sidebar content and the ajax
+  destroy hook were missing.
+  [rnix]
+
+- Fix ``LayoutAware`` handling a right sidebar resize as a left sidebar resize.
+  ``is_sidebar_left_collapsed`` and ``is_sidebar_right_collapsed`` are
+  properties now, so ``on_is_sidebar_left_collapsed`` and
+  ``on_is_sidebar_right_collapsed`` get called on changes. The unused
+  ``is_sidebar_collapsed`` property is removed.
+  [rnix]
+
+- Fix the color mode toggle not following changes of the OS color scheme.
+  A destroyed ``ColorToggler`` stops following them and no longer keeps the
+  removed toggle in memory. Fix ``ColorMode.unbind`` not removing its
+  listener. ``ColorMode.media_query`` returns the same ``MediaQueryList`` on
+  each call now, the new ``ColorMode.unwatch`` removes a listener added with
+  ``ColorMode.watch``.
+  [rnix]
+
+- Fix ``Header`` binding the mobile menu collapse handlers again on each switch
+  to compact mode, and keeping them after leaving compact mode or destroying
+  the header, which caused a ``TypeError`` on later collapse events.
+  [rnix]
+
+- Extend the JS tests to 100 % coverage, all modules including bundles are
+  loaded by the tests now.
+  [rnix]
+
+- Lint and format the JS code with biome. ``make check`` runs ``biome check``,
+  ``make format`` runs ``biome check --write`` (see ``include.mk``). Behavior
+  unchanged.
+  [rnix]
+
+- JS tooling: Commit ``pnpm-lock.yaml``. Upgrade ``@web/test-runner`` to 1.0
+  and run the JS tests headless in Chromium via Playwright, installed in the JS
+  CI workflow. Drop the accidental ``install`` dev dependency. Pin patched
+  versions of vulnerable transitive dependencies via ``pnpm.overrides``.
+  [rnix]
+
+- Use a Pyramid security policy instead of the authentication and
+  authorization policies deprecated in Pyramid 2.0. ``cone.app.main``
+  configures ``cone.app.security.SecurityPolicy`` (auth ticket cookie and
+  ACLs, principals from ``groups_callback``) unless a security policy is
+  registered already. The ``cone.auth_*`` settings keep working.
+  ``cone.app.auth_tkt_factory`` and ``cone.app.acl_factory`` are deprecated.
+  [rnix]
+
+- Import ``Allow``, ``Deny``, ``Everyone`` and ``ALL_PERMISSIONS`` from
+  ``pyramid.authorization``, they are deprecated in ``pyramid.security``.
+  [rnix]
+
+- Sort the imports with ruff (one per line, ``from`` imports first, no
+  sections) and format the code with ``ruff format`` (90 characters per line,
+  single quotes).
+  [rnix]
+
+- Add import sorting (``I`` rules) and the formatter settings to the ruff
+  configuration in ``pyproject.toml``.
+  [rnix]
+
+
 2.0.0 (2026-10-24)
 ------------------
 

{cone_app-2.0.0 → cone_app-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cone.app
-Version: 2.0.0
+Version: 2.2.0
 Summary: Web application stub
 Project-URL: Homepage, http://github.com/conestack/cone.app
 Author-email: Cone Contributors <dev@conestack.org>
@@ -14,21 +14,22 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
 Requires-Python: >=3.10
 Requires-Dist: chameleon
-Requires-Dist: cone-tile>1.99
-Requires-Dist: node-ext-ugm>1.99
+Requires-Dist: cone-tile>2.1.99
+Requires-Dist: node-ext-ugm>2.0.99
 Requires-Dist: node>1.99
 Requires-Dist: pyramid-chameleon
 Requires-Dist: pyramid-zcml
 Requires-Dist: pyramid>=2.0
 Requires-Dist: repoze-workflow
-Requires-Dist: treibstoff>1.99
+Requires-Dist: treibstoff>2.0.99
 Requires-Dist: webresource>1.2.99
 Requires-Dist: yafowil-bootstrap>1.99
 Requires-Dist: yafowil-webob>1.99
-Requires-Dist: yafowil>3.99
+Requires-Dist: yafowil>4.1.99
 Provides-Extra: docs
 Requires-Dist: repoze-sphinx-autointerface; extra == 'docs'
 Requires-Dist: sphinx; extra == 'docs'
@@ -103,6 +104,153 @@ Contributors
 Changes
 =======
 
+2.2.0 (2026-11-09)
+------------------
+
+- The ``ajaxaction`` view only accepts ``POST`` requests. Requires ``treibstoff``
+  2.1.0.
+  [rnix]
+
+- The tile ``wf_dropdown`` only performs ``do_transition`` on ``POST`` requests.
+  [rnix]
+
+- ``Form`` only runs form actions on ``POST`` requests. On any other request it
+  renders the form. Tests calling a form action need ``request.method = 'POST'``.
+  [rnix]
+
+- Answer requests other than ``GET``, ``HEAD`` and ``OPTIONS`` with status ``403``
+  if a browser sends them for another site, recognized by the ``Sec-Fetch-Site``
+  and ``Origin`` headers. Clients sending neither pass. Add
+  ``cone.trusted_origins`` for browser clients of other origins.
+  [rnix]
+
+- Encode the node title in reference actions and in the link to leaf nodes, and
+  the label in display mode of the ``reference`` blueprint. Requires ``yafowil``
+  4.2.0.
+  [rnix]
+
+- ``main`` refuses to start if ``cone.auth_secret`` is missing or has the former
+  default value ``secret``.
+  [rnix]
+
+- Read ``cone.auth_secure``, ``cone.auth_include_ip``, ``cone.auth_http_only`` and
+  ``cone.auth_wild_domain`` as booleans. ``false`` in an ini file was considered
+  true before, applications with such a value change their behavior.
+  [rnix]
+
+- ``cone.auth_http_only`` defaults to ``True``.
+  [rnix]
+
+- Failures in ajax actions, ajax forms and the exception view answer with a
+  general message, the traceback goes to the log. Add setting
+  ``cone.show_tracebacks`` to show it to the client during development. Add
+  ``browser.utils.client_error_message``.
+  [rnix]
+
+- ``internal_server_error`` answers with status 500 instead of 200, also for
+  ajax requests. A ``default_commit_veto`` configured for ``pyramid_tm`` vetoes
+  such a request now, before it committed.
+  [rnix]
+
+- Compare the credentials of the admin user with ``hmac.compare_digest``.
+  [rnix]
+
+- A failed login in the login form answers with status 401 instead of 200, so a
+  throttle at the edge can recognize it. All failed logins log a warning with the
+  first two characters of the login name and the client address. The login form only
+  checks the password in the ``login`` view, not on other pages showing the form or
+  through ``ajaxaction``.
+  [rnix]
+
+- ``logout_view`` follows ``came_from`` only to an HTTP URL on the host of the
+  application. ``CameFromNext`` considers the scheme too. Add
+  ``browser.utils.is_same_host_url``.
+  [rnix]
+
+
+2.1.0 (2026-10-31)
+------------------
+
+- Require ``cone.tile>2.0.99``. ``cone.tile`` 2.0 secures tiles only if an
+  authentication and an authorization policy are registered, so it does not
+  protect tiles with the security policy configured by ``cone.app.main``.
+  [rnix]
+
+- Remove ``MainMenu.on_sidebar_left_resize``, which rendered the main menu
+  scrollbar again on each left sidebar resize. Both sidebars live inside the
+  content area below the header, so resizing them does not change the width of
+  the main menu. ``MainMenu`` keeps the inherited ``LayoutAware`` behavior.
+  [rnix]
+
+- Fix shift click selection of ``Selectable`` items. Shift click selects the
+  range from the last plain or ctrl clicked item (the anchor) to the clicked
+  item, as in file managers. Before, a further shift click started the range at
+  the wrong item. Shift click without an anchor acts like a plain click.
+  ``Selectable.select_direction`` and ``Selectable.get_nearest`` are removed.
+  [rnix]
+
+- Fix ``SidebarLeft`` and ``SidebarRight`` skipping their initialization on
+  small viewports with a stored lock state. The sidebar content and the ajax
+  destroy hook were missing.
+  [rnix]
+
+- Fix ``LayoutAware`` handling a right sidebar resize as a left sidebar resize.
+  ``is_sidebar_left_collapsed`` and ``is_sidebar_right_collapsed`` are
+  properties now, so ``on_is_sidebar_left_collapsed`` and
+  ``on_is_sidebar_right_collapsed`` get called on changes. The unused
+  ``is_sidebar_collapsed`` property is removed.
+  [rnix]
+
+- Fix the color mode toggle not following changes of the OS color scheme.
+  A destroyed ``ColorToggler`` stops following them and no longer keeps the
+  removed toggle in memory. Fix ``ColorMode.unbind`` not removing its
+  listener. ``ColorMode.media_query`` returns the same ``MediaQueryList`` on
+  each call now, the new ``ColorMode.unwatch`` removes a listener added with
+  ``ColorMode.watch``.
+  [rnix]
+
+- Fix ``Header`` binding the mobile menu collapse handlers again on each switch
+  to compact mode, and keeping them after leaving compact mode or destroying
+  the header, which caused a ``TypeError`` on later collapse events.
+  [rnix]
+
+- Extend the JS tests to 100 % coverage, all modules including bundles are
+  loaded by the tests now.
+  [rnix]
+
+- Lint and format the JS code with biome. ``make check`` runs ``biome check``,
+  ``make format`` runs ``biome check --write`` (see ``include.mk``). Behavior
+  unchanged.
+  [rnix]
+
+- JS tooling: Commit ``pnpm-lock.yaml``. Upgrade ``@web/test-runner`` to 1.0
+  and run the JS tests headless in Chromium via Playwright, installed in the JS
+  CI workflow. Drop the accidental ``install`` dev dependency. Pin patched
+  versions of vulnerable transitive dependencies via ``pnpm.overrides``.
+  [rnix]
+
+- Use a Pyramid security policy instead of the authentication and
+  authorization policies deprecated in Pyramid 2.0. ``cone.app.main``
+  configures ``cone.app.security.SecurityPolicy`` (auth ticket cookie and
+  ACLs, principals from ``groups_callback``) unless a security policy is
+  registered already. The ``cone.auth_*`` settings keep working.
+  ``cone.app.auth_tkt_factory`` and ``cone.app.acl_factory`` are deprecated.
+  [rnix]
+
+- Import ``Allow``, ``Deny``, ``Everyone`` and ``ALL_PERMISSIONS`` from
+  ``pyramid.authorization``, they are deprecated in ``pyramid.security``.
+  [rnix]
+
+- Sort the imports with ruff (one per line, ``from`` imports first, no
+  sections) and format the code with ``ruff format`` (90 characters per line,
+  single quotes).
+  [rnix]
+
+- Add import sorting (``I`` rules) and the formatter settings to the ruff
+  configuration in ``pyproject.toml``.
+  [rnix]
+
+
 2.0.0 (2026-10-24)
 ------------------
 

cone_app-2.2.0/biome.json

@@ -0,0 +1,31 @@
+{
+    "$schema": "https://biomejs.dev/schemas/2.6.3/schema.json",
+    "files": {
+        "includes": ["js/src/**/*.js", "js/tests/**/*.js"]
+    },
+    "formatter": {
+        "enabled": true,
+        "indentStyle": "space",
+        "indentWidth": 4,
+        "lineWidth": 100
+    },
+    "linter": {
+        "enabled": true,
+        "rules": {
+            "preset": "recommended",
+            "correctness": {
+                "noUnusedVariables": "warn"
+            },
+            "complexity": {
+                "noStaticOnlyClass": "off",
+                "noThisInStatic": "off"
+            }
+        }
+    },
+    "javascript": {
+        "formatter": {
+            "quoteStyle": "single",
+            "semicolons": "always"
+        }
+    }
+}

{cone_app-2.0.0 → cone_app-2.2.0}/include.mk

@@ -46,3 +46,20 @@ example-lingua: $(LINGUA_TARGET)
 		LINGUA_SEARCH_PATH=$(EXAMPLE_LINGUA_SEARCH_PATH) \
 		LINGUA_OPTIONS=$(EXAMPLE_LINGUA_OPTIONS) \
 		lingua
+
+##############################################################################
+# biome (JS linting and formatting)
+##############################################################################
+
+.PHONY: biome-check
+biome-check: $(NODEJS_TARGET)
+	@echo "Run biome check"
+	@biome check
+
+.PHONY: biome-format
+biome-format: $(NODEJS_TARGET)
+	@echo "Run biome format"
+	@biome check --write
+
+CHECK_TARGETS+=biome-check
+FORMAT_TARGETS+=biome-format

{cone_app-2.0.0 → cone_app-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cone.app"
-version = "2.0.0"
+version = "2.2.0"
 description = "Web application stub"
 dynamic = ["readme"]
 requires-python = ">=3.10"
@@ -19,22 +19,23 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Topic :: Internet :: WWW/HTTP :: Dynamic Content",
 ]
 dependencies = [
     "Chameleon",
-    "cone.tile>1.99",
-    "node.ext.ugm>1.99",
+    "cone.tile>2.1.99",
+    "node.ext.ugm>2.0.99",
     "node>1.99",
     "pyramid>=2.0",
     "pyramid_chameleon",
     "pyramid_zcml",
     "repoze.workflow",
-    "treibstoff>1.99",
+    "treibstoff>2.0.99",
     "webresource>1.2.99",
     "yafowil.bootstrap>1.99",
     "yafowil.webob>1.99",
-    "yafowil>3.99",
+    "yafowil>4.1.99",
 ]
 
 [project.optional-dependencies]
@@ -102,12 +103,22 @@ consider_namespace_packages = true
 addopts = ["--import-mode=importlib"]
 pythonpath = "src"
 
+[tool.ruff]
+line-length = 90
+
 [tool.ruff.lint]
-select = ["E4", "E7", "E9", "F", "UP"]
+select = ["E4", "E7", "E9", "F", "I", "UP"]
 # UP008: zero-argument ``super()`` breaks on ``@plumbing`` decorated classes.
 # UP031: ``%`` formatting is kept.
 ignore = ["UP008", "UP031"]
 
+[tool.ruff.lint.isort]
+force-single-line = true
+from-first = true
+no-sections = true
+lines-after-imports = 2
+order-by-type = false
+
 [tool.ruff.format]
 quote-style = "single"
 

{cone_app-2.0.0 → cone_app-2.2.0}/src/cone/app/__init__.py

@@ -15,7 +15,9 @@ from pyramid.authentication import AuthTktAuthenticationPolicy
 from pyramid.authorization import ACLAuthorizationPolicy
 from pyramid.config import Configurator
 from pyramid.interfaces import ISecurityPolicy
+from pyramid.settings import asbool
 from pyramid.traversal import ResourceTreeTraverser
+from pyramid.tweens import INGRESS
 from yafowil.bootstrap import configure_factory
 from zope.component import adapter
 from zope.component import getGlobalSiteManager
@@ -25,6 +27,7 @@ import os
 import pyramid_chameleon
 import pyramid_zcml
 import threading
+import warnings
 
 
 logger = logging.getLogger('cone.app')
@@ -32,6 +35,9 @@ logger = logging.getLogger('cone.app')
 # configuration
 cfg = Properties()
 
+# show tracebacks to clients
+cfg.show_tracebacks = False
+
 # available languages
 cfg.available_languages = []
 
@@ -169,12 +175,24 @@ def thread_shutdown_hook(func):  # pragma: no cover
     return func
 
 
+# B/C
 def auth_tkt_factory(**kwargs):
+    warnings.warn(
+        '``cone.app.auth_tkt_factory`` is deprecated, ``cone.app.main`` '
+        'configures ``cone.app.security.SecurityPolicy``',
+        DeprecationWarning,
+    )
     kwargs.setdefault('callback', security.groups_callback)
     return AuthTktAuthenticationPolicy(**kwargs)
 
 
+# B/C
 def acl_factory(**kwargs):
+    warnings.warn(
+        '``cone.app.acl_factory`` is deprecated, ``cone.app.main`` '
+        'configures ``cone.app.security.SecurityPolicy``',
+        DeprecationWarning,
+    )
     return ACLAuthorizationPolicy()
 
 
@@ -210,6 +228,41 @@ def start_thread_monitor():  # pragma: no cover
     monitor.start()
 
 
+def create_security_policy(settings):
+    """Create the security policy from application settings.
+
+    The settings used for this get removed from ``settings``.
+
+    :param settings: The application settings.
+    :return: The security policy.
+    :raises ValueError: If ``cone.auth_secret`` is missing or the former default.
+    """
+    auth_secret = settings.pop('cone.auth_secret', None)
+    if not auth_secret or auth_secret == 'secret':
+        raise ValueError(
+            'cone.auth_secret signs the authentication cookie and must be set to a '
+            'secret value of your own.'
+        )
+    auth_reissue_time = settings.pop('cone.auth_reissue_time', None)
+    if auth_reissue_time is not None:
+        auth_reissue_time = int(auth_reissue_time)
+    auth_max_age = settings.pop('cone.auth_max_age', None)
+    if auth_max_age is not None:
+        auth_max_age = int(auth_max_age)
+    return security.SecurityPolicy(
+        secret=auth_secret,
+        cookie_name=settings.pop('cone.auth_cookie_name', 'auth_tkt'),
+        secure=asbool(settings.pop('cone.auth_secure', False)),
+        include_ip=asbool(settings.pop('cone.auth_include_ip', False)),
+        timeout=settings.pop('cone.auth_timeout', None),
+        reissue_time=auth_reissue_time,
+        max_age=auth_max_age,
+        http_only=asbool(settings.pop('cone.auth_http_only', True)),
+        path=settings.pop('cone.auth_path', '/'),
+        wild_domain=asbool(settings.pop('cone.auth_wild_domain', True)),
+    )
+
+
 def main(global_config, **settings):
     """Returns WSGI application."""
     # set authentication related application properties
@@ -222,33 +275,9 @@ def main(global_config, **settings):
     if node_available_callback:
         security.node_available = import_from_string(node_available_callback)
 
-    auth_secret = settings.pop('cone.auth_secret', 'secret')
-    auth_cookie_name = settings.pop('cone.auth_cookie_name', 'auth_tkt')
-    auth_secure = settings.pop('cone.auth_secure', False)
-    auth_include_ip = settings.pop('cone.auth_include_ip', False)
-    auth_timeout = settings.pop('cone.auth_timeout', None)
-    auth_reissue_time = settings.pop('cone.auth_reissue_time', None)
-    if auth_reissue_time is not None:
-        auth_reissue_time = int(auth_reissue_time)
-    auth_max_age = settings.pop('cone.auth_max_age', None)
-    if auth_max_age is not None:
-        auth_max_age = int(auth_max_age)
-    auth_http_only = settings.pop('cone.auth_http_only', False)
-    auth_path = settings.pop('cone.auth_path', '/')
-    auth_wild_domain = settings.pop('cone.auth_wild_domain', True)
+    security_policy = create_security_policy(settings)
 
-    auth_policy = auth_tkt_factory(
-        secret=auth_secret,
-        cookie_name=auth_cookie_name,
-        secure=auth_secure,
-        include_ip=auth_include_ip,
-        timeout=auth_timeout,
-        reissue_time=auth_reissue_time,
-        max_age=auth_max_age,
-        http_only=auth_http_only,
-        path=auth_path,
-        wild_domain=auth_wild_domain,
-    )
+    cfg.show_tracebacks = asbool(settings.pop('cone.show_tracebacks', False))
 
     # create root node
     global root
@@ -268,10 +297,9 @@ def main(global_config, **settings):
     # Initialize resource registry
     ResourceRegistry.initialize(config, settings)
 
-    # set authentication and authorization policies
+    # set security policy
     if config.registry.queryUtility(ISecurityPolicy) is None:
-        config.set_authentication_policy(auth_policy)
-        config.set_authorization_policy(acl_factory())
+        config.set_security_policy(security_policy)
     config.commit()
 
     # begin configuration
@@ -302,6 +330,9 @@ def main(global_config, **settings):
     #      provide locales either in yafowil resources or as entry points in
     #      all yafowil packages providing translations
 
+    # outermost, a refused request does not reach the transaction or the views
+    config.add_tween('cone.app.origin.origin_check_tween_factory', under=INGRESS)
+
     # static routes
     config.add_route('favicon', '/favicon.ico')
     # XXX: robots.txt

{cone_app-2.0.0 → cone_app-2.2.0}/src/cone/app/browser/actions.py

@@ -1,4 +1,3 @@
-import copy
 from cone.app.browser.utils import bdajax_warning
 from cone.app.browser.utils import make_query
 from cone.app.browser.utils import make_url
@@ -10,6 +9,7 @@ from cone.tile import render_tile
 from node.interfaces import IMappingOrder
 from odict import odict
 from pyramid.i18n import TranslationStringFactory
+import copy
 
 
 _ = TranslationStringFactory('cone.app')
@@ -478,9 +478,7 @@ class ActionDelete(LinkAction):
     id = 'toolbaraction-delete'
     icon = 'bi-trash3'
     action = 'delete:NONE:NONE'
-    confirm = _(
-        'delete_item_confirm', default='Do you really want to delete this Item?'
-    )
+    confirm = _('delete_item_confirm', default='Do you really want to delete this Item?')
     text = _('action_delete', default='Delete')
 
     @property
@@ -489,9 +487,7 @@ class ActionDelete(LinkAction):
         scope = self.action_scope == 'content'
         if self.model.properties.default_content_tile:
             scope = self.action_scope == 'view'
-        return (
-            self.model.properties.action_delete and self.permitted('delete') and scope
-        )
+        return self.model.properties.action_delete and self.permitted('delete') and scope
 
 
 class ActionDeleteChildren(LinkAction):