On 2/10/06, Kees de Brabander <cj.de.brabander@hccnet.nl> wrote:

...

If so, couldn't we have some extra attribute to a role like "upwardly mobile"? (I want to share a code base for several folders sub-folders and I do not wanta to give it anonymous access).

I second that. This used to be possible, at least up to zope 2.7.3.

No, you don't have any rights above where you are created, because you don't exist there and hence you can not be validated. Implementing that would be complicated, unnecessary and most likely open up huge security holes.

The loss of this feature makes the acquisition concept obsolete to some extent.

There may be some difference and some feature which you lost between 2.7.3 and 2.7.8, especially since there was done a lot of security fixes, but the described functionality was not it, unless Zope 2.7.3 specifically had by mistake opened up this gaping security hole. -- Lennart Regebro, Nuxeo http://www.nuxeo.com/ CPS Content Management http://www.cps-project.org/

On 2/11/06, Kees de Brabander <cj.de.brabander@hccnet.nl> wrote:

Unaware of any security risks I used this "feature" from zope 1.10.x on and regularly upgrading my applications I had no problems until zope 2.7.8

Admittedly, I didn't use 1.10, I only discovered Zope two months later, with 2.0.1. And I don't remember those details that far back. But at least in 2.4.0, this code was called when you did user.allowed(): def _check_context(self, object): # Check that 'object' exists in the acquisition context of # the parent of the acl_users object containing this user, # to prevent "stealing" access through acquisition tricks. # Return true if in context, false if not or if context # cannot be determined (object is not wrapped). parent = getattr(self, 'aq_parent', None) context = getattr(parent, 'aq_parent', None) if context is not None: if object is None: return 1 if not hasattr(object, 'aq_inContextOf'): if hasattr(object, 'im_self'): # This is a method. Grab its self. object=object.im_self if not hasattr(object, 'aq_inContextOf'): # Object is not wrapped, so return false. return 0 if object.aq_inContextOf(context, 1): return 1 # This is lame, but required to keep existing behavior. return 1 And hence, you can't have done this after Zope 2.4.0. So I still think you are talking about something else. -- Lennart Regebro, Nuxeo http://www.nuxeo.com/ CPS Content Management http://www.cps-project.org/

On 2/11/06, Kees de Brabander <cj.de.brabander@hccnet.nl> wrote:

By refering to 1.10 I did not intend to create the impression that I am very experienced. I am still just an average user and happy with that. But consider this use case:

f1 (folder, acquisition of view permission disabled, and granted again to all roles except Anonymous) f1_index (dtml-method) f11 (folder) acl_users (user folder) user1 (user object with user defined 'student' role) index_html (dtml-method calling f1_index)

when calling .../f1/f11 and authenticating as user1 in zope 2.7.3, you will get the page, but in 2.7.8 you are not authorized.

Ah, OK, you are not calling it directly. Yes, that may be one of the security holes that was patched up in 2.7.4 I think. The solution is easy: Give index_html a proxy role. In this case "Authenticated" is enough. f1_index itself if you call it directly will not be accessible, and that's how it has to be.

More importantly, however, how would one go about making available objects shared by many subfolders each with its own group of users?

That depends very much on what type of objects it is and why you want that setup. -- Lennart Regebro, Nuxeo http://www.nuxeo.com/ CPS Content Management http://www.cps-project.org/

----- Original Message ----- From: "Lennart Regebro" <regebro@gmail.com> To: "Kees de Brabander" <cj.de.brabander@hccnet.nl> Cc: "zope user list" <zope@zope.org> Sent: Saturday, February 11, 2006 2:25 PM Subject: Re: [Zope] Zope and roles and hierarchy On 2/11/06, Kees de Brabander <cj.de.brabander@hccnet.nl> wrote:

f1 (folder, acquisition of view permission disabled, and granted again to all roles except Anonymous) f1_index (dtml-method) f11 (folder) acl_users (user folder) user1 (user object with user defined 'student' role) index_html (dtml-method calling f1_index)

when calling .../f1/f11 and authenticating as user1 in zope 2.7.3, you will get the page, but in 2.7.8 you are not authorized.

Ah, OK, you are not calling it directly. Yes, that may be one of the security holes that was patched up in 2.7.4 I think. The solution is easy: Give index_html a proxy role. In this case "Authenticated" is enough. f1_index itself if you call it directly will not be accessible, and that's how it has to be. [cb] And what are my options if I want to call f1_index directly from f11? cb

But my subfolders are for different groups of users and I want to keep them apart (so I can throw them away with the subfolder, when their use has become obsolete). cb ----- Original Message ----- From: "Lennart Regebro" <regebro@gmail.com> To: "Kees de Brabander" <cj.de.brabander@hccnet.nl> Cc: "zope user list" <zope@zope.org> Sent: Tuesday, February 14, 2006 11:33 AM Subject: Re: [Zope] Zope and roles and hierarchy On 2/13/06, Kees de Brabander <cj.de.brabander@hccnet.nl> wrote:

[cb] And what are my options if I want to call f1_index directly from f11?

Placing your acl_users folder higher up. -- Lennart Regebro, Nuxeo http://www.nuxeo.com/ CPS Content Management http://www.cps-project.org/