OK, I'll publicly humilate myself now. My anonymous user problem was due to my own oversight. I incorrectly believed that having turned off permission acquisition and limiting 'View' access to a few select roles would be sufficient regarding DTMLFiles. I believe, and am not completely sure, that this is not the case because they are global having been 'instatiated' via: index_html = DTMLFile('index_html', globals()) within a product. setting all DTMLFiles within a security.declareProtected('index_html',etc...) did the trick, which of course makes sense in hindsight. The clue I got was that if I came through a management screen the user was being pushed through as expected. So, I apologize to anyone who may have interpreted my frustration/desperation as inappropriate. Zope can be a dark mistress. Scott Pierce Sonopress US - Digital Services 828.658.6157
"Pierce, Scott" wrote:
OK, I'll publicly humilate myself now.
Not entirely, other than not really reading the bit about security in the ZDG ;-)
my own oversight. I incorrectly believed that having turned off permission acquisition and limiting 'View' access to a few select roles would be sufficient regarding DTMLFiles.
I assume you're developing a Python Product here? The answer is that it probably should, but you got caught out by a peice of history. It is documented that if you make no security assertions about a method in a python product that nothing will be able to access them, which is what you should have been experiencing, and which would have told you much more quickly that you had forgotten to make any security assertions. However, this policy was only(?!) introduced back in Zope 2.2 and so, for fear of breaking lots of code, a class called SimpleItem has an __access_unprotected_subobjects__=1 assertion. This basically makes unprotected stuff anonymously viewable, which was the old policy. Sadly, prettymuch everything subclasses SimpleItem, so the documented security policy isn't realyl adhered to much, hence when you forgot to make security assertions, the methods became anonymously viewable, which, from your poitn of view, sux ass.
I believe, and am not completely sure, that this is not the case because they are global having been 'instatiated' via: index_html = DTMLFile('index_html', globals()) within a product.
...so this isn't quite correct.
frustration/desperation as inappropriate. Zope can be a dark mistress.
...some would say a complete bitch ;-) Maybe it's time to change that assertion in SimpleItem and finally break all the code that peopel should have fixed long ago? cheers, Chris
participants (2)
-
Chris Withers -
Pierce, Scott