I've been making some assumptions about how ownership works, and I'd appreciate it if anyone could tell me if they are right. 1) The owner of an object is the authenticated user when the script that creates it runs. 2) So User objects have an owner of superuser, not themselves. 3) I can programmatically create an object graph, and the ownership of the parts of the graph will be right. 2) is an implication of 1), but seems a bit odd. Thanks.
Ross Boylan <RossBoylan@stanfordalumni.org> wrote:
I've been making some assumptions about how ownership works, and I'd appreciate it if anyone could tell me if they are right.
1) The owner of an object is the authenticated user when the script that creates it runs.
can you tell me how i can find out the owner of an object? i've been searching the source code for getOwner() methods or something like that but couln't find anything... thilo -- mezger@innominate.de innominate AG networking people fon: +49.30.308806-11 fax: -77 web: http://innominate.de pgp: /pgp/tm
At 07:33 AM 12/13/99 GMT, Thilo Mezger wrote:
Ross Boylan <RossBoylan@stanfordalumni.org> wrote:
I've been making some assumptions about how ownership works, and I'd appreciate it if anyone could tell me if they are right.
1) The owner of an object is the authenticated user when the script that creates it runs.
can you tell me how i can find out the owner of an object? i've been searching the source code for getOwner() methods or something like that but couln't find anything...
thilo
Unfortunately, I can't. It's something else I'd like to know. My guess is that it's part of the object database (bobobase) code. On the other hand, since permissioning is run by the object publisher, it can't be entirely there. I have turned up the following clues while poking around: 1. Here's how lib/python/ZPublisher/test.py pretends it's a user if u: import base64 env['HTTP_AUTHORIZATION']="Basic %s" % base64.encodestring(u) u is a string "username:password" env can be an empty dictionary 2. here's code from Client.py if (self.username and self.password and not headers.has_key('Authorization')): headers['Authorization']=( "Basic %s" % replace(encodestring('%s:%s' % (self.username,self.password)), '\012','')) 3. BaseRequest.traverse does the authorization checks, and the following variables figure in it: __allow_groups__ validate
participants (2)
-
news-list.zope.dev＠innominate.de -
Ross Boylan