Produits Entr'ouvert » w.c.s. » Au quotidien

import time

from quixote import get_request, get_response, get_session, redirect

from quixote.directory import Directory, AccessControlled

import wcs

import wcs.admin.root

from wcs.backoffice.menu import *

from qommon import errors, misc

from qommon.form import *

from qommon.strftime import strftime

from events import Event, RemoteCalendar, get_default_event_tags

class RemoteCalendarDirectory(Directory):

    _q_exports = ['', 'edit', 'delete', 'update']

    def __init__(self, calendar):

        self.calendar = calendar

    def _q_index [html] (self):

        form = Form(enctype='multipart/form-data')

        form.add_submit('edit', _('Edit'))

        form.add_submit('delete', _('Delete'))

        form.add_submit('update', _('Update'))

        form.add_submit('back', _('Back'))

        if form.get_submit() == 'edit':

            return redirect('edit')

        if form.get_submit() == 'update':

            return redirect('update')

        if form.get_submit() == 'delete':

            return redirect('delete')

        if form.get_submit() == 'back':

            return redirect('..')

        html_top('events', title = _('Remote Calendar: %s') % self.calendar.label)

        '<h2>%s</h2>' % _('Remote Calendar: %s') % self.calendar.label

        get_session().display_message()

        '<p>'

        self.calendar.url

        if self.calendar.error:

            ' - <span class="error-message">%s</span>' % self.calendar.get_error_message()

        '</p>'

        if not self.calendar.content:

            '<p>'

            _('No content has been retrieved yet.')

            '</p>'

        else:

            '<ul>'

            for ev in sorted(self.calendar.events, lambda x,y: cmp(x.date_start, y.date_start)):

                '<li>'

                if ev.date_start:

                    strftime(misc.date_format(), ev.date_start)

                if ev.date_end and ev.date_start[:3] != ev.date_end[:3]:

                    ' - '

                    strftime(misc.date_format(), ev.date_start)

                ' : '

                if ev.url:

                    '<a href="%s">%s</a>' % (ev.url, ev.title)

                else:

                    ev.title

                '</li>'

            '</ul>'

        form.render()

    def edit [html] (self):

        form = self.form()

        if form.get_submit() == 'cancel':

            return redirect('.')

        if form.is_submitted() and not form.has_errors():

            self.submit(form)

            return redirect('..')

        html_top('events', title = _('Edit Remote Calendar: %s') % self.calendar.label)

        '<h2>%s</h2>' % _('Edit Remote Calendar: %s') % self.calendar.label

        form.render()

    def form(self):

        form = Form(enctype='multipart/form-data')

        form.add(StringWidget, 'label', title = _('Label'), required = True,

                value = self.calendar.label)

        form.add(StringWidget, 'url', title = _('URL'), required = True,

                value = self.calendar.url, size = 40)

        form.add_submit('submit', _('Submit'))

        form.add_submit('cancel', _('Cancel'))

        return form

    def submit(self, form):

        for k in ('label', 'url'):

            widget = form.get_widget(k)

            if widget:

                setattr(self.calendar, k, widget.parse())

        self.calendar.store()

    def delete [html] (self):

        form = Form(enctype='multipart/form-data')

        form.widgets.append(HtmlWidget('<p>%s</p>' % _(

                        'You are about to irrevocably delete this remote calendar.')))

        form.add_submit('submit', _('Submit'))

        form.add_submit('cancel', _('Cancel'))

        if form.get_submit() == 'cancel':

            return redirect('..')

        if not form.is_submitted() or form.has_errors():

            get_response().breadcrumb.append(('delete', _('Delete')))

            html_top('events', title = _('Delete Remote Calendar'))

            '<h2>%s</h2>' % _('Deleting Remote Calendar: %s') % self.calendar.label

            form.render()

        else:

            self.calendar.remove_self()

            return redirect('..')

    def update(self):

        get_session().message = ('info',

                _('Calendar update has been requested, reload in a few moments'))

        get_response().add_after_job('updating remote calendar',

                self.calendar.download_and_parse,

                fire_and_forget = True)

        return redirect('.')

class RemoteCalendarsDirectory(Directory):

    _q_exports = ['', 'new']

    def _q_traverse(self, path):

        get_response().breadcrumb.append(('remote/', _('Remote Calendars')))

        return Directory._q_traverse(self, path)

    def _q_index [html] (self):

        return redirect('..')

    def new [html] (self):

        calendar_ui = RemoteCalendarDirectory(RemoteCalendar())

        form = calendar_ui.form()

        if form.get_submit() == 'cancel':

            return redirect('.')

        if form.is_submitted() and not form.has_errors():

            calendar_ui.submit(form)

            return redirect('%s/' % calendar_ui.calendar.id)

        get_response().breadcrumb.append(('new', _('New Remote Calendar')))

        html_top('events', title = _('New Remote Calendar'))

        '<h2>%s</h2>' % _('New Remote Calendar')

        form.render()

    def _q_lookup(self, component):

        try:

            event = RemoteCalendar.get(component)

        except KeyError:

            raise errors.TraversalError()

        get_response().breadcrumb.append((str(event.id), event.label))

        return RemoteCalendarDirectory(event)

class EventDirectory(Directory):

    _q_exports = ['', 'edit', 'delete']

    def __init__(self, event):

        self.event = event

    def _q_index [html] (self):

        form = Form(enctype='multipart/form-data')

        form.add_submit('edit', _('Edit'))

        form.add_submit('delete', _('Delete'))

        form.add_submit('back', _('Back'))

        if form.get_submit() == 'edit':

            return redirect('edit')

        if form.get_submit() == 'delete':

            return redirect('delete')

        if form.get_submit() == 'back':

            return redirect('..')

        html_top('events', title = _('Event: %s') % self.event.title)

        '<h2>%s</h2>' % _('Event: %s') % self.event.title

        '<p>'

        self.event.description

        '</p>'

        '<ul>'

        if self.event.location:

            '<li>%s: %s</li>' % (_('Location'), self.event.location)

        if self.event.organizer:

            '<li>%s: %s</li>' % (_('Organizer'), self.event.organizer)

        if self.event.url:

            '<li>%s: <a href="%s">%s</a></li>' % (_('URL'), self.event.url, self.event.url)

        '</ul>'

        if self.event.more_infos:

            '<p>'

            self.event.more_infos

            '</p>'

        form.render()

    def edit [html] (self):

        form = self.form()

        if form.get_submit() == 'cancel':

            return redirect('.')

        if form.is_submitted() and not form.has_errors():

            self.submit(form)

            return redirect('..')

        html_top('events', title = _('Edit Event: %s') % self.event.title)

        '<h2>%s</h2>' % _('Edit Event: %s') % self.event.title

        form.render()

    def form(self):

        form = Form(enctype='multipart/form-data')

        form.add(StringWidget, 'title', title = _('Title'), required = True,

                value = self.event.title)

        form.add(TextWidget, 'description', title = _('Description'),

                cols = 70, rows = 10,

                required = True, value = self.event.description)

        form.add(StringWidget, 'url', title = _('URL'), required = False,

                value = self.event.url, size = 40)

        form.add(DateWidget, 'date_start', title = _('Start Date'), required = True,

                value = strftime(misc.date_format(), self.event.date_start))

        form.add(DateWidget, 'date_end', title = _('End Date'), required = False,

                value = strftime(misc.date_format(), self.event.date_end))

        form.add(TextWidget, 'location', title = _('Location'),

                cols = 70, rows = 4,

                required = False, value = self.event.location)

        form.add(StringWidget, 'organizer', title = _('Organizer'), required = False,

                value = self.event.organizer, size = 40)

        form.add(TextWidget, 'more_infos', title = _('More informations'),

                cols = 70, rows = 10,

                required = False, value = self.event.more_infos)

        form.add(TagsWidget, 'keywords', title = _('Keywords'),

                value = self.event.keywords, size = 50,

                known_tags = get_cfg('misc', {}).get('event_tags', get_default_event_tags()))

        form.add_submit('submit', _('Submit'))

        form.add_submit('cancel', _('Cancel'))

        return form

    def submit(self, form):

        for k in ('title', 'description', 'url', 'date_start', 'date_end',

                    'organizer', 'location', 'more_infos', 'keywords'):

            widget = form.get_widget(k)

            if widget:

                if k in ('date_start', 'date_end'):

                    # convert dates to 9-item tuples

                    v = widget.parse()

                    if v:

                        setattr(self.event, k, time.strptime(v, misc.date_format()))

                    else:

                        setattr(self.event, k, None)

                else:

                    setattr(self.event, k, widget.parse())

        self.event.store()

    def delete [html] (self):

        form = Form(enctype='multipart/form-data')

        form.widgets.append(HtmlWidget('<p>%s</p>' % _(

                        'You are about to irrevocably delete this event.')))

        form.add_submit('submit', _('Submit'))

        form.add_submit('cancel', _('Cancel'))

        if form.get_submit() == 'cancel':

            return redirect('..')

        if not form.is_submitted() or form.has_errors():

            get_response().breadcrumb.append(('delete', _('Delete')))

            html_top('events', title = _('Delete Event'))

            '<h2>%s</h2>' % _('Deleting Event: %s') % self.event.title

            form.render()

        else:

            self.event.remove_self()

            return redirect('..')

class EventsDirectory(AccessControlled, Directory):

    _q_exports = ['', 'new', 'listing', 'remote']

    label = N_('Events')

    remote = RemoteCalendarsDirectory()

    def _q_access(self):

        user = get_request().user

        if not user:

            raise errors.AccessUnauthorizedError()

        admin_role = get_cfg('aq-permissions', {}).get('events', None)

        if not (user.is_admin or admin_role in (user.roles or [])):

            raise errors.AccessForbiddenError(

                    public_msg = _('You are not allowed to access Events Management'),

                    location_hint = 'backoffice')

        get_response().breadcrumb.append(('events/', _('Events')))

    def _q_index [html] (self):

        html_top('events', _('Events'))

        '<ul id="main-actions">'

        '  <li><a class="new-item" href="new">%s</a></li>' % _('New Event')

        '  <li><a class="new-item" href="remote/new">%s</a></li>' % _('New Remote Calendar')

        '</ul>'

        '<div class="splitcontent-left">'

        '<div class="bo-block">'

        events = Event.select()

        '<h2>%s</h2>' % _('Events')

        if not events:

            '<p>'

            _('There is no event defined at the moment.')

            '</p>'

        '<ul class="biglist" id="events-list">'

        for l in events:

            event_id = l.id

            '<li class="biglistitem" id="itemId_%s">' % event_id

            '<strong class="label"><a href="%s/">%s</a></strong>' % (event_id, l.title)

            ' - '

            l.format_date()

            '<p class="commands">'

            command_icon('%s/edit' % event_id, 'edit')

            command_icon('%s/delete' % event_id, 'remove')

            '</p></li>'

        '</ul>'

        '</div>'

        '</div>'

        '<div class="splitcontent-right">'

        '<div class="bo-block">'

        rcalendars = RemoteCalendar.select()

        '<h2>%s</h2>' % _('Remote Calendars')

        if not rcalendars:

            '<p>'

            _('There is no remote calendars defined at the moment.')

            '</p>'

        '<ul class="biglist" id="events-list">'

        for l in rcalendars:

            rcal_id = l.id

            '<li class="biglistitem" id="itemId_%s">' % rcal_id

            '<strong class="label"><a href="remote/%s/">%s</a></strong>' % (rcal_id, l.label)

            '<p class="details">'

            l.url

            if l.error:

                '<br /><span class="error-message">%s</span>' % l.get_error_message()

            '</p>'

            '<p class="commands">'

            command_icon('remote/%s/edit' % rcal_id, 'edit')

            command_icon('remote/%s/delete' % rcal_id, 'remove')

            '</p></li>'

        '</ul>'

        '</div>'

        '</div>'

    def new [html] (self):

        event_ui = EventDirectory(Event())

        form = event_ui.form()

        if form.get_submit() == 'cancel':

            return redirect('.')

        if form.is_submitted() and not form.has_errors():

            event_ui.submit(form)

            return redirect('%s/' % event_ui.event.id)

        get_response().breadcrumb.append(('new', _('New Event')))

        html_top('events', title = _('New Event'))

        '<h2>%s</h2>' % _('New Event')

        form.render()

    def _q_lookup(self, component):

        try:

            event = Event.get(component)

        except KeyError:

            raise errors.TraversalError()

        get_response().breadcrumb.append((str(event.id), event.title))

        return EventDirectory(event)

    def listing(self):

        return redirect('.')

from quixote import get_publisher, get_request, redirect

from quixote.directory import Directory

from quixote.html import htmltext

import os

import wcs

import wcs.forms.root

from qommon import template

from qommon import errors

from qommon.form import *

from wcs.roles import logged_users_role

from qommon import emails

OldFormPage = wcs.forms.root.FormPage

class AlternateFormPage(OldFormPage):

    def step(self, *args, **kwargs):

        steps_html = OldFormPage.step(self, *args, **kwargs)

        steps_html = str(steps_html).replace('<ol>', '<h2>%s</h2>\n<ol>' % _('Steps'))

        get_response().filter['gauche'] = steps_html

        get_response().filter['steps'] = steps_html

        return

wcs.forms.root.FormPage = AlternateFormPage

OldFormsRootDirectory = wcs.forms.root.RootDirectory

class AlternateFormsRootDirectory(OldFormsRootDirectory):

    def form_list(self, *args, **kwargs):

        form_list = OldFormsRootDirectory.form_list(self, *args, **kwargs)

        return htmltext(str(form_list).replace('h2>', 'h3>'))

wcs.forms.root.RootDirectory = AlternateFormsRootDirectory

import urllib

import urllib2

import urlparse

import json

import base64

import datetime

from quixote import get_publisher, get_request, redirect, get_response, get_session_manager, get_session

from quixote.directory import AccessControlled, Directory

import qommon.form

from qommon.misc import http_post_request, http_get_page

class MSPDirectory(Directory):

    _q_exports = ['', 'pick', 'download']

    @property

    def msp_gateway_base_url(self):

        return get_publisher().get_site_option('msp')

    @property

    def authorize_url(self):

        return urlparse.urljoin(self.msp_gateway_base_url, 'authorize/')

    @property

    def access_token_url(self):

        return urlparse.urljoin(self.msp_gateway_base_url, 'access_token/')

    @property

    def documents_url(self):

        return urlparse.urljoin(self.msp_gateway_base_url, 'documents/')

    @property

    def document_url(self):

        return urlparse.urljoin(self.msp_gateway_base_url, 'documents/%s/')

    @property

    def client_id(self):

        return get_publisher().get_site_option('msp_client_id')

    @property

    def client_secret(self):

        return get_publisher().get_site_option('msp_client_secret')

    def fix_document(self, document):

        site_charset = get_publisher().site_charset

        for key, value in document.iteritems():

            # date are returned as millisecond POSIX timestamp,

            # it should be ISO-8601 instead

            if key.endswith('Date') and value is not None:

                document[key] = unicode(datetime.date.fromtimestamp(value // 1000))

                value = document[key] = document[key].replace(u'-', u'\u2011')

            if isinstance(value, unicode) and key != 'content':

                document[key] = value.encode(site_charset)

    def get_documents(self, access_token):

        response, status, content, auth_header = http_get_page(self.documents_url, {

            'Authorization': 'Bearer %s' % access_token,

        });

        documents = json.loads(content)

        for document in documents:

            self.fix_document(document)

        return documents

    def get_document(self, doc_id, access_token):

        response, status, content, auth_header = http_get_page(

                self.document_url % doc_id, 

                { 'Authorization': 'Bearer %s' % access_token, }

        );

        document = json.loads(content)

        self.fix_document(document)

        return document

    def authorize(self, self_url, scope):

        params = {

                'redirect_uri': self_url,

                'response_type': 'code',

                'scope': scope,

        }

        return redirect('%s?%s' % (

            self.authorize_url, urllib.urlencode(params)))

    def access_token(self, self_url, code):

        params = {

                'code': code,

                'client_id': self.client_id,

                'client_secret': self.client_secret,

                'grant_type': 'authorization_code',

                'redirect_uri': self_url,

        }

        response, status, data, auth_header = http_post_request(self.access_token_url,

                urllib.urlencode(params), { 'Content-Type': 'application/x-www-form-urlencoded' })

        return json.loads(data)['access_token']

    def pick (self):

        request = get_request()

        frontoffice_url = get_publisher().get_frontoffice_url()

        self_url = frontoffice_url

        self_url += '/msp/pick'

        self_url = self_url.replace('://', '://iframe-')

        if 'code' not in request.form and 'error' not in request.form:

            return self.authorize(self_url, 'LIST_DOCS')

        access_token = self.access_token(self_url, request.form['code'])

        return self.pick_display(access_token)

    def pick_display [html] (self, access_token):

        request = get_request()

        get_response().add_javascript(['jquery.js',

            'tablesorter/jquery.tablesorter.min.js'])

        get_response().add_javascript_code(

                 str('''$(function() { $("table.sortable").tablesorter(); });'''))

        get_response().add_css_include('../js/tablesorter/themes/blue/style.css')

        frontoffice_url = get_publisher().get_frontoffice_url()

        '<h2>%s</h2>' % _('Pick a file')

        if 'error' not in request.form:

            documents = self.get_documents(access_token)

            '<table id="msp-pick-file-table" class="sortable tablesorter">'

            '<thead>'

            '<tr>'

            '<th>%s</th>' % _('Filename')

            '<th>%s</th>' % _('Expiration date')

            '</tr>'

            '</thead>'

            '<tbody>'

            for document in documents:

                '<tr>'

                for key in ('name', 'expirationDate'):

                    '<td class="msp-pick-file-table-%s">' % key

                    if key == 'name':

                        '<a href="%s/msp/download?doc_id=%s">' % \

                            (frontoffice_url, document['id'])

                    '%s' % (document[key] or '')

                    if key == 'name':

                        '</a>'

                    '</td>'

                '</tr>'

            '</tbody>'

            '</table>'

        else:

            '<p>%s</p>' % _('Unable to access your mon.Service-Public.fr documents')

    def set_token [html] (self, token, document):

        get_response().add_javascript(['jquery.js'])

        get_response().page_template_key = 'iframe'

        '<html><body>'

        '<pre>Token: %s</pre>' % token

        '<script>window.top.document.set_token("%s", "%s");</script>' % (token, document['name'])

        '</body></html>'

    def download(self):

        request = get_request()

        assert 'doc_id' in request.form

        doc_id = request.form['doc_id']

        frontoffice_url = get_publisher().get_frontoffice_url()

        self_url = frontoffice_url

        self_url += '/msp/download?%s' % urllib.urlencode({'doc_id': doc_id})

        if 'code' not in request.form and 'error' not in request.form:

            return self.authorize(self_url, 'GET_DOC')

        if 'error' in request.form:

            return self.download_error()

        else:

            access_token = self.access_token(self_url, request.form['code'])

            document = self.get_document(doc_id, access_token)

            download = qommon.form.PicklableUpload(document['name'],

                    content_type='application/pdf')

            download.__setstate__({

                'data': base64.b64decode(document['content']),

            })

            token = get_session().add_tempfile(download)

            return self.set_token(token, document)

try:

    import lasso

except ImportError:

    pass

import json

from quixote import get_publisher, get_request, redirect, get_response, get_session_manager, get_session

from quixote.directory import AccessControlled, Directory

from quixote.util import StaticFile, FileStream

from qommon import template

from qommon.form import *

from qommon import get_cfg, get_logger

from qommon import errors

from wcs.api import get_user_from_api_query_string

import qommon.ident.password

from qommon.ident.password_accounts import PasswordAccount

from qommon.admin.texts import TextsDirectory

from wcs.formdef import FormDef

import root

from announces import AnnounceSubscription

from strongbox import StrongboxItem, StrongboxType

from payments import Invoice, Regie, is_payment_supported

import msp_ui

class MyInvoicesDirectory(Directory):

    _q_exports = ['']

    def _q_traverse(self, path):

        if not is_payment_supported():

            raise errors.TraversalError()

        get_response().breadcrumb.append(('invoices/', _('Invoices')))

        return Directory._q_traverse(self, path)

    def _q_index [html] (self):

        user = get_request().user

        if not user or user.anonymous:

            raise errors.AccessUnauthorizedError()

        template.html_top(_('Invoices'))

        TextsDirectory.get_html_text('aq-myspace-invoice')

        get_session().display_message()

        invoices = []

        invoices.extend(Invoice.get_with_indexed_value(

            str('user_id'), str(user.id)))

        try:

            invoices.extend(Invoice.get_with_indexed_value(

                str('user_hash'), str(user.hash)))

        except AttributeError:

            pass

        def cmp_invoice(a, b):

            t = cmp(a.regie_id, b.regie_id)

            if t != 0:

                return t

            return -cmp(a.date, b.date)

        invoices.sort(cmp_invoice)

        last_regie_id = None

        unpaid = False

        for invoice in invoices:

            if invoice.regie_id != last_regie_id:

                if last_regie_id:

                    '</ul>'

                    if unpaid:

                        '<input type="submit" value="%s"/>' % _('Pay Selected Invoices')

                    '</form>'

                last_regie_id = invoice.regie_id

                '<h3>%s</h3>' % Regie.get(last_regie_id).label

                unpaid = False

                '<form action="%s/invoices/multiple">' % get_publisher().get_frontoffice_url()

                '<ul>'

            '<li>'

            if not (invoice.paid or invoice.canceled):

                '<input type="checkbox" name="invoice" value="%s"/>' % invoice.id

                unpaid = True

            misc.localstrftime(invoice.date)

            ' - '

            '%s' % invoice.subject

            ' - '

            '%s' % invoice.amount

            ' €'

            ' - '

            button = '<span class="paybutton">%s</span>' % _('Pay')

            if invoice.canceled:

                _('canceled on %s') % misc.localstrftime(invoice.canceled_date)

                ' - '

                button = _('Details')

            if invoice.paid:

                _('paid on %s') % misc.localstrftime(invoice.paid_date)

                ' - '

                button = _('Details')

            '<a href="%s/invoices/%s">%s</a>' % (get_publisher().get_frontoffice_url(),

                    invoice.id, button)

            '</li>'

        if last_regie_id:

            '</ul>'

            if unpaid:

                '<input type="submit" value="%s"/>' % _('Pay Selected Invoices')

            '</form>'

class StrongboxDirectory(Directory):

    _q_exports = ['', 'add', 'download', 'remove', 'pick', 'validate']

    def _q_traverse(self, path):

        if not get_cfg('misc', {}).get('aq-strongbox'):

            raise errors.TraversalError()

        get_response().breadcrumb.append(('strongbox/', _('Strongbox')))

        return Directory._q_traverse(self, path)

    def get_form(self):

        types = [(x.id, x.label) for x in StrongboxType.select()]

        form = Form(action='add', enctype='multipart/form-data')

        form.add(StringWidget, 'description', title=_('Description'), size=60)

        form.add(FileWidget, 'file', title=_('File'), required=True)

        form.add(SingleSelectWidget, 'type_id', title=_('Document Type'),

                 options = [(None, _('Not specified'))] + types)

        form.add(DateWidget, 'date_time', title = _('Document Date'))

        form.add_submit('submit', _('Upload'))

        return form

    def _q_index [html] (self):

        template.html_top(_('Strongbox'))

        # TODO: a paragraph of explanations here could be useful

        sffiles = StrongboxItem.get_with_indexed_value(

                        str('user_id'), str(get_request().user.id))

        if sffiles:

            '<table id="strongbox-items">'

            '<tr><th></th><th>%s</th><th>%s</th><th></th></tr>' % (

                _('Type'), _('Expiration'))

        else:

            '<p>'

            _('There is currently nothing in your strongbox.')

            '</p>'

        has_items_to_validate = False

        for i, sffile in enumerate(sffiles):

            expired = False

            if not sffile.validated_time:

                has_items_to_validate = True

                continue

            if sffile.expiration_time and sffile.expiration_time < time.localtime():

                expired = True

            if i%2:

                classnames = ['odd']

            else:

                classnames = ['even']

            if expired:

                classnames.append('expired')

            '<tr class="%s">' % ' '.join(classnames)

            '<td class="label">'

            sffile.get_display_name()

            '</td>'

            if sffile.type_id:

                '<td class="type">%s</td>' % StrongboxType.get(sffile.type_id).label

            else:

                '<td class="type">-</td>'

            if sffile.expiration_time:

                '<td class="expiration">%s' % strftime(misc.date_format(), sffile.expiration_time)

                if expired:

                    ' (%s)' % _('expired')

                '</td>'

            else:

                '<td class="expiration">-</td>'

            '<td class="actions">'

            ' [<a href="download?id=%s">%s</a>] ' % (sffile.id, _('download'))

            '[<a rel="popup" href="remove?id=%s">%s</a>] ' % (sffile.id, _('remove'))

            '</td>'

            '</tr>'

        if has_items_to_validate:

            '<tr><td colspan="4"><h3>%s</h3></td></tr>' % _('Proposed Items')

            for sffile in sffiles:

                if sffile.validated_time:

                    continue

                if sffile.expiration_time and sffile.expiration_time < time.localtime():

                    expired = True

                if i%2:

                    classnames = ['odd']

                else:

                    classnames = ['even']

                if expired:

                    classnames.append('expired')

                '<tr class="%s">' % ' '.join(classnames)

                '<td class="label">'

                sffile.get_display_name()

                '</td>'

                if sffile.type_id:

                    '<td class="type">%s</td>' % StrongboxType.get(sffile.type_id).label

                else:

                    '<td class="type">-</td>'

                if sffile.expiration_time:

                    '<td class="expiration">%s' % strftime(misc.date_format(), sffile.expiration_time)

                    if expired:

                        ' (%s)' % _('expired')

                    '</td>'

                else:

                    '<td class="expiration">-</td>'

                '<td class="actions">'

                ' [<a href="download?id=%s">%s</a>] ' % (sffile.id, _('download'))

                ' [<a href="validate?id=%s">%s</a>] ' % (sffile.id, _('validate'))

                ' [<a href="remove?id=%s">%s</a>] ' % (sffile.id, _('reject'))

                '</td>'

                '</tr>'

        if sffiles:

            '</table>'

        '<h3>%s</h3>' % _('Add a file to the strongbox')

        form = self.get_form()

        form.render()

    def add(self):

        form = self.get_form()

        if not form.is_submitted():

            if get_request().form.get('mode') == 'pick':

                return redirect('pick')

            else:

                return redirect('.')

        sffile = StrongboxItem()

        sffile.user_id = get_request().user.id

        sffile.description = form.get_widget('description').parse()

        sffile.validated_time = time.localtime()

        sffile.type_id = form.get_widget('type_id').parse()

        v = form.get_widget('date_time').parse()

        sffile.set_expiration_time_from_date(v)

        sffile.store()

        sffile.set_file(form.get_widget('file').parse())

        sffile.store()

        if get_request().form.get('mode') == 'pick':

            return redirect('pick')

        else:

            return redirect('.')

    def download(self):

        id = get_request().form.get('id')

        if not id:

            raise errors.TraversalError()

        try:

            sffile = StrongboxItem.get(id)

        except KeyError:

            raise errors.TraversalError()

        if str(sffile.user_id) != str(get_request().user.id):

            raise errors.TraversalError()

        filename = sffile.file.filename

        fd = file(filename)

        size = os.path.getsize(filename)

        response = get_response()

        response.set_content_type('application/octet-stream')

        response.set_header('content-disposition', 'attachment; filename="%s"' % sffile.file.base_filename)

        return FileStream(fd, size)

    def validate(self):

        id = get_request().form.get('id')

        if not id:

            raise errors.TraversalError()

        try:

            sffile = StrongboxItem.get(id)

        except KeyError:

            raise errors.TraversalError()

        if str(sffile.user_id) != str(get_request().user.id):

            raise errors.TraversalError()

        sffile.validated_time = time.time()

        sffile.store()

        return redirect('.')

    def remove [html] (self):

        id = get_request().form.get('id')

        if not id:

            raise errors.TraversalError()

        try:

            sffile = StrongboxItem.get(id)

        except KeyError:

            raise errors.TraversalError()

        if str(sffile.user_id) != str(get_request().user.id):

            raise errors.TraversalError()

        form = Form(enctype='multipart/form-data')

        form.add_hidden('id', get_request().form.get('id'))

        form.widgets.append(HtmlWidget('<p>%s</p>' % _(

                        'You are about to irrevocably delete this item from your strongbox.')))

        form.add_submit('submit', _('Submit'))

        form.add_submit('cancel', _('Cancel'))

        if form.get_submit() == 'cancel':

            return redirect('.')

        if not form.is_submitted() or form.has_errors():

            if sffile.type_id:

                '<h2>%s</h2>' % _('Deleting %(filetype)s: %(filename)s') % {

                        'filetype': StrongboxType.get(sffile.type_id).label,

                        'filename': sffile.get_display_name()

                    }

            else:

                '<h2>%s</h2>' % _('Deleting %(filename)s') % {'filename': sffile.get_display_name()}

            form.render()

        else:

            sffile.remove_self()

            sffile.remove_file()

            return redirect('.')

    def picked_file(self):

        get_response().set_content_type('application/json')

        sffile = StrongboxItem.get(get_request().form.get('val'))

        sffile.file.fp = file(sffile.file.filename)

        if sffile.user_id != get_request().user.id:

            raise errors.TraversalError()

        # XXX: this will copy the file, it would be quite nice if it was

        # possible to just make it a symlink to the sffile

        token = get_session().add_tempfile(sffile.file)

        return json.dumps({'token': token, 'filename': sffile.file.base_filename})

    def pick [html] (self):

        if get_request().form.get('select') == 'true':

            return self.picked_file()

        root_url = get_publisher().get_root_url()

        sffiles = StrongboxItem.get_with_indexed_value(

                        str('user_id'), str(get_request().user.id))

        '<h2>%s</h2>' % _('Pick a file')

        if not sffiles:

            '<p>'

            _('You do not have any file in your strongbox at the moment.')

            '</p>'

            '<div class="buttons">'

            '<a href="%smyspace/strongbox/" target="_blank">%s</a>' % (root_url,

                _('Open Strongbox Management'))

            '</div>'

        else:

            '<form id="strongbox-pick">'

            '<ul>'

            for sffile in sffiles:

                '<li><label><input type="radio" name="file" value="%s"/>%s</label>' % (

                                sffile.id, sffile.get_display_name())