fixed grid layout again

gluon/html.py

@@ -243,7 +243,8 @@ def URL(
         elif a and c and not f: (c,f,a)=(a,c,f)
         from globals import current
         if hasattr(current,'request'):
-            r = current.request
+            r = current.request    
+
     if r:
         application = r.application
         controller = r.controller
@@ -296,10 +297,10 @@ def URL(
     if other.endswith('/'):
         other += '/'    # add trailing slash to make last trailing empty arg explicit
 
-    if '_signature' in vars:
-        vars.pop('_signature')
     list_vars = []
     for (key, vals) in sorted(vars.items()):
+        if key == '_signature':
+            continue
         if not isinstance(vals, (list, tuple)):
             vals = [vals]
         for val in vals:
@@ -347,7 +348,8 @@ def URL(
 
     if regex_crlf.search(join([application, controller, function, other])):
         raise SyntaxError, 'CRLF Injection Detected'
-    url = url_out(r, env, application, controller, function,
+
+    url = url_out(r,env, application, controller, function,
                   args, other, scheme, host, port)
     return url
 

gluon/rewrite.py

@@ -162,10 +162,12 @@ def url_in(request, environ):
         return map_url_in(request, environ)
     return regex_url_in(request, environ)
 
-def url_out(request, env, application, controller, function, args, other, scheme, host, port):
+def url_out(request, env, application, controller, function, 
+            args, other, scheme, host, port):
     "assemble and rewrite outgoing URL"
     if routers:
-        acf = map_url_out(request, env, application, controller, function, args, other, scheme, host, port)
+        acf = map_url_out(request, env, application, controller,
+                          function, args, other, scheme, host, port)
         url = '%s%s' % (acf, other)
     else:
         url = '/%s/%s/%s%s' % (application, controller, function, other)
@@ -226,7 +228,8 @@ def try_rewrite_on_error(http_response, request, environ, ticket=None):
                     # Rewrite routes_onerror path.
                     path_info = '/' + path_info.lstrip('/') # add leading '/' if missing
                     environ['PATH_INFO'] = path_info
-                    error_handling_path = url_in(request, environ)[1]['PATH_INFO']
+                    error_handling_path = \
+                        url_in(request, environ)[1]['PATH_INFO']
                     # Avoid infinite loop.
                     if error_handling_path != error_raising_path:
                         # wsgibase will be called recursively with the routes_onerror path.
@@ -1122,7 +1125,8 @@ class MapUrlIn(object):
 class MapUrlOut(object):
     "logic for mapping outgoing URLs"
 
-    def __init__(self, request, env, application, controller, function, args, other, scheme, host, port):
+    def __init__(self, request, env, application, controller,
+                 function, args, other, scheme, host, port):
         "initialize a map-out object"
         self.default_application = routers.BASE.default_application
         if application in routers:
@@ -1323,7 +1327,8 @@ def map_url_in(request, env, app=False):
     map.update_request()
     return (None, map.env)
 
-def map_url_out(request, env, application, controller, function, args, other, scheme, host, port):
+def map_url_out(request, env, application, controller,
+                function, args, other, scheme, host, port):
     '''
     supply /a/c/f (or /a/lang/c/f) portion of outgoing url
 
@@ -1349,7 +1354,8 @@ def map_url_out(request, env, application, controller, function, args, other, sc
 
     We assume that language names do not collide with a/c/f names.
     '''
-    map = MapUrlOut(request, env, application, controller, function, args, other, scheme, host, port)
+    map = MapUrlOut(request, env, application, controller,
+                    function, args, other, scheme, host, port)
     return map.acf()
 
 def get_effective_router(appname):

gluon/sqlhtml.py

@@ -1664,15 +1664,20 @@ class SQLFORM(FORM):
             return URL(**b)
 
         referrer = session.get('_web2py_grid_referrer_'+formname, url())
-        if user_signature:            
-            if ('/'.join(str(a) for a in args) != '/'.join(request.args) and \
-                    user_signature and \
-                    not URL.verify(request,user_signature=user_signature)) or \
-                    (not (session.auth and session.auth.user) and \
-                         ('edit' in request.args or \
-                              'create' in request.args or \
-                              'delete' in request.args)):
-                session.flash = T('not authorized')
+        # if not user_signature every action is accessible
+        # else forbid access unless
+        # - url is based url
+        # - url has valid signature (vars are not signed, only path_info)
+        # = url does not contain 'create','delete','edit' (readonly)
+        if user_signature:
+            if not(
+                '/'.join(str(a) for a in args) == '/'.join(request.args) or
+                URL.verify(request,user_signature=user_signature,
+                           hash_vars=False) or not (
+                    'create' in request.args or
+                    'delete' in request.args or
+                    'edit' in request.args)):
+                session.flash = T('not authorized')                
                 redirect(referrer)
 
         def gridbutton(buttonclass='buttonadd', buttontext='Add',
@@ -1868,6 +1873,16 @@ class SQLFORM(FORM):
         session['_web2py_grid_referrer_'+formname] = url2(vars=request.vars)
         console = DIV(_class='web2py_console %(header)s %(cornertop)s' % ui)
         error = None
+        if create:
+            add = gridbutton(
+                    buttonclass='buttonadd',
+                    buttontext='Add',
+                    buttonurl=url(args=['new',tablename]))
+            if not searchable:
+                console.append(add)
+        else:
+            add = ''
+
         if searchable:
             sfields = reduce(lambda a,b:a+b,
                              [[f for f in t if f.readable] for t in tables])
@@ -1875,7 +1890,7 @@ class SQLFORM(FORM):
                 search_widget = search_widget[tablename]
             if search_widget=='default':
                 search_menu = SQLFORM.search_menu(sfields)
-                search_widget = lambda sfield, url: DIV(FORM(
+                search_widget = lambda sfield, url: CAT(add,FORM(
                     INPUT(_name='keywords',_value=request.vars.keywords,
                           _id='web2py_keywords',_onfocus="jQuery('#w2p_query_fields').change();jQuery('#w2p_query_panel').slideDown();"),
                     INPUT(_type='submit',_value=T('Search'),_class="btn"),
@@ -1895,11 +1910,6 @@ class SQLFORM(FORM):
                 error = T('Invalid query')
         else:
             subquery = None
-        if create:
-            console.append(gridbutton(
-                    buttonclass='buttonadd',
-                    buttontext='Add',
-                    buttonurl=url(args=['new',tablename])))
 
         if subquery:
             dbset = dbset(subquery)

gluon/tools.py

@@ -1225,7 +1225,6 @@ class Auth(object):
         else:
             next = '?_next=' + urllib.quote(URL(args=request.args,
                                                 vars=request.get_vars))
-
         href = lambda function: '%s/%s%s' % (action, function,
             next if referrer_actions is DEFAULT or function in referrer_actions else '')