TALES Python expressions

  Syntax

    Python expression syntax::

      Any valid Python language expression

  Description
  
    Python expressions evaluate Python code in a security-restricted
    environment. Python expressions offer the same facilities as those
    available in Python-based Scripts and DTML variable expressions.

    Security Restrictions

      Python expressions are subject to the same security restrictions
      as Python-based scripts. These restrictions include:

      access limits -- Python expressions are subject to Zope
      permission and role security restrictions. In addition,
      expressions cannot access objects whose names begin with
      underscore.

      write limits -- Python expressions cannot change attributes of
      Zope objects.

      Despite these limits malicious Python expressions can cause
      problems.  See The Zope Book for more information.

    Built-in Functions

      Python expressions have the same built-ins as Python-based
      Scripts with a few additions.

      These standard Python built-ins are available: 'None', 'abs',
      'apply', 'callable', 'chr', 'cmp', 'complex', 'delattr',
      'divmod', 'filter', 'float', 'getattr', 'hash', 'hex', 'int',
      'isinstance', 'issubclass', 'list', 'len', 'long', 'map', 'max',
      'min', 'oct', 'ord', 'repr', 'round', 'setattr', 'str', 'tuple'.

      The 'range' and 'pow' functions are available and work the same
      way they do in standard Python; however, they are limited to
      keep them from generating very large numbers and sequences. This
      limitation helps protect against denial of service attacks.

      Finally, these functions are available in Python expressions,
      but not in Python-based scripts:

      'path(string)' -- Evaluate a TALES "path":tales-path.stx
      expression.

      'string(string)' -- Evaluate a TALES "string":tales-string.stx
      expression.

      'exists(string)' -- Evaluates a TALES "exists":tales-exists.stx
      expression.

      'nocall(string)' -- Evaluates a TALES "nocall":tales-nocall.stx
      expression.

    Python Modules

      A number of Python modules are available by default. You can
      make more modules available. You can access modules either via
      path expressions (for example 'modules/string/join') or in
      Python with the 'modules' mapping object (for example
      'modules["string"].join'). Here are the default modules:

      'string' -- The standard "Python string
      module":http://www.python.org/doc/current/lib/module-string.html. Note:
      most of the functions in the module are also available as
      methods on string objects.

      'random' -- The standard "Python random
      module":http://www.python.org/doc/current/lib/module-random.html.

      'math' -- The standard "Python math
      module":http://www.python.org/doc/current/lib/module-math.html.

  Examples

    Using a module usage (pick a random choice from a list)::

      <span tal:replace="python:modules['random'].choice(['one', 
                           'two', 'three', 'four', 'five'])">
        a random number between one and five
      </span>

    String processing (capitalize the user name)::

      <p tal:content="python:user.getUserName().capitalize()">
        User Name
      </p>

    Basic math (convert an image size to megabytes)::

      <p tal:content="python:image.getSize() / 1048576.0">
        12.2323
      </p>

    String formatting (format a float to two decimal places)::

      <p tal:content="python:'%0.2f' % size">
        13.56
      </p>
