Stuck with newSecurityManager in an access rule
Hi, I used successfully newSecurityManager in a Product to change dynamically the user during a transaction (running some methods as owner). I tried to use this to change dynamically the user in a special folder hierarchy based on a request parameter. For doing this in this folder, I made standard user folder, a Python script as access rule that calls an external method like this... Python script (setUser1)... ==== container.setUser2(container) return ==== External method setUser2... ==== from AccessControl.SecurityManagement import newSecurityManager requestKey = 'an_userid' def setUser2(container): anUserId = container.REQUEST.get(requestKey, None) userFolder = container.acl_users if anUserId: userObj = userFolder.getUser(anUserId).__of__(userFolder) if userObj: newSecurityManager(container.REQUEST, userObj) return ==== The newSecurityManager is executed but seems to have no effect on the user during the rest of the transaction : <dtml-var AUTHENTICATED_USER> always shows "Anonymous User" in a template for which the above access rule is executed, and the REQUEST has a valid "an_userid" key. Did I miss something somewhere ? Why such a construct works in a Product and not in an external method ? Many thanks in advance. --Gilles
Gilles Lenfant wrote:
Hi,
I used successfully newSecurityManager in a Product to change dynamically the user during a transaction (running some methods as owner).
That's a highyl dodgy thing to do, just so you know...
I tried to use this to change dynamically the user in a special folder hierarchy based on a request parameter.
That sounds even more dodgy, what if someone spoofs that request parameter?
The newSecurityManager is executed but seems to have no effect on the user during the rest of the transaction :
I'm not suprised, it's really not designed to be used like that...
Did I miss something somewhere ? Why such a construct works in a Product and not in an external method ?
What are you trying to do here, this seems like a terrifically dangerous way to go about it, whatever it is... Chris
Gilles Lenfant wrote at 2003-9-4 17:03 +0200:
I used successfully newSecurityManager in a Product to change dynamically the user during a transaction (running some methods as owner).
I tried to use this to change dynamically the user in a special folder hierarchy based on a request parameter. For doing this in this folder, I made standard user folder, a Python script as access rule that calls an external method like this... .... The newSecurityManager is executed but seems to have no effect on the user during the rest of the transaction :
Zope does almost no security checks during traversal (exception: TTW code in AccessRules). At the end of traversal, it perform an authentication. This Zope code is quite old -- from a time as there have been no AccessRules and therefore no preset user. Therefore, it does not expect the user could already been set and overwrites whatever is there with the result of its standard authentication. Dieter
participants (3)
-
Chris Withers -
Dieter Maurer -
Gilles Lenfant