Broken images in calendar feed in Plone CMS

Question

We periodically have broken images in the calendar feed on the main home page, http://cnr.foo.edu. The problem appears to be that our script that pulls the feed into the home page is prepending http://events.foo.edu onto all image URLs, which creates a failure when the image in question is hosted on a remote server rather than the calendar network server. How can I tweak the script so that it will not add the root calendar URL if an image URL already contains http?

Here is a snippet of the python script that I need to modify:

<div class="campus-calendar-event">
        <div class="image-left" style="width: 40px;" tal:condition="python: event['Image']">
            <a tal:attributes="href python:'http://events.foo.edu/index.php/calendar/sn/coe.html?event_ID=%s' % event['ID'];
               title python: event['Title']">
               <img tal:condition="python: event['Image']"
                 tal:attributes="src python: 'http://events.foo.edu%s' % event['Image']['URL'];
                                 alt python: event['Title'];
                                 width string:40px " /></a>
        </div>

How can i add an "if" statement to omit the "http://events.foo.edu" part, if 'URL' already contains a "http" (the link to remote server)? Thank you for your help!

Answer 1

As a stopgap, this might work (untested -- I don't have an installation at home):

<img tal:define="url python: event['Image'] and event['Image']['URL'];"
     tal:condition="python: event['Image']"
     tal:attributes="src python: url if url.startswith('http') else 'http://events.foo.edu%s' % (url,);
                     alt python: event['Title'];
                     width string:40px " /></a>

(Note that your code doesn't handle event['Image'] not having an entry URL, neither does mine.)

There's probably a more elegant solution to be had using urlsplit/urljoin, though, which would dissect your url into protocol, server, path, query, fragment, and you could reassemble it from there.

In detail, we define a variable url to save ourselves a bit of typing -- we first have to check again that event['Image'] is present. The whole tag is protected by a tal:condition that does this, but the order of execution is always define, condition, repeat, content/replace, attributes, omit; this is so you can define a variable and use it in the condition clause. We could name it URL, but I don't usually name my variables in all-caps. x and y in python yields the value of x if it is falsy and the value of y if it is truthy, so in the usual case, we'll get the url-ish string from your object.

The new attributes clause might be confusing because it's underparenthized: in more detail, it's

url if url.startswith('http') else ('http://events.foo.edu%s' % (url,));

so it's the usual string formatting. Seeing how the %s is at the end, we coud probably say 'http://events.foo.edu'+url, but "don't concatenate constants and user data together" triggers my "is this a possible command injection vulnerability" reflex.