Chris Withers wrote:
How come getSecurityManager().getUser() returns the Anonymous User in access rules? Surely some checks must have been done to see whether the folder containing the access rule can be traversed to?
If not, then huh? I'm confused :-(
Access Rules trigger during publishing traversal, and authentication isn't performed until publishing traversal is complete. Until traversal is complete, Zope can't know which containers to check for User Folders. Also, publishing traversal only checks __roles__ on the last object in the traversal. This is very different than unrestrictedTraverse(), for instance, which checks permissions at every traversal step. This means that you can set security in a way that allows a user to access an object via ZPublisher that they could not access programmatically. Cheers, Evan @ 4-am