[CMF-checkins] CVS: CMF - PortalContent.py:1.21 PortalFolder.py:1.17 TypesTool.py:1.16 utils.py:1.13

[tseaver@digicool.com]

Update of /cvs-repository/CMF/CMFCore
In directory korak.digicool.com:/tmp/cvs-serv19450/CMFCore

Modified Files:
	PortalContent.py PortalFolder.py TypesTool.py utils.py 
Log Message:

 - Work around breakage in SecurityManager.checkPermission (members
   were failing permission checks which Anonymous passed).



--- Updated File PortalContent.py in package CMF --
--- PortalContent.py	2001/06/05 21:48:58	1.20
+++ PortalContent.py	2001/06/08 15:07:21	1.21
@@ -92,7 +92,7 @@
      ReviewPortalContent, ModifyPortalContent
 import CMFCorePermissions
 from DynamicType import DynamicType
-from utils import getToolByName
+from utils import getToolByName, _checkPermission
 
 from Acquisition import aq_base
 
@@ -197,7 +197,7 @@
             return 1
         sm = getSecurityManager()
         for p in pp:
-            if sm.checkPermission(p, self):
+            if _checkPermission(p, self):
                 return 1
         return 0
 

--- Updated File PortalFolder.py in package CMF --
--- PortalFolder.py	2001/06/07 00:23:45	1.16
+++ PortalFolder.py	2001/06/08 15:07:21	1.17
@@ -99,7 +99,7 @@
 from AccessControl import getSecurityManager, ClassSecurityInfo
 from Acquisition import aq_parent, aq_inner, aq_base
 from DynamicType import DynamicType
-from utils import getToolByName
+from utils import getToolByName, _checkPermission
 
 factory_type_information = ( { 'id'             : 'Folder'
                              , 'meta_type'      : 'Portal Folder'
@@ -371,8 +371,7 @@
         # This method prevents people other than the portal manager
         # from overriding skinned names.
         if not allow_dup:
-            if not getSecurityManager().checkPermission(
-                'Manage portal', self):
+            if not _checkPermission( 'Manage portal', self):
                 ob = self
                 while ob is not None and not getattr(ob, '_isPortalRoot', 0):
                     ob = aq_parent(aq_inner(ob))
@@ -403,7 +402,7 @@
                     break
 
             if permission_name is not None:
-                if getSecurityManager().checkPermission(permission_name,self):
+                if _checkPermission(permission_name,self):
                     if not validate_src:
                         # We don't want to check the object on the clipboard
                         return

--- Updated File TypesTool.py in package CMF --
--- TypesTool.py	2001/06/07 00:23:45	1.15
+++ TypesTool.py	2001/06/08 15:07:21	1.16
@@ -91,7 +91,8 @@
 
 import OFS
 from Globals import InitializeClass, DTMLFile
-from utils import UniqueObject, SimpleItemWithProperties, tuplize, _dtmldir
+from utils import UniqueObject, SimpleItemWithProperties, tuplize
+from utils import _dtmldir, _checkPermission
 import string
 from AccessControl import getSecurityManager, ClassSecurityInfo
 from Acquisition import aq_base
@@ -508,8 +509,7 @@
         order to construct an instance?
         """
         permission = self.permission
-        if permission and not getSecurityManager().checkPermission(
-            permission, container):
+        if permission and not _checkPermission( permission, container ):
             return 0
         return 1
 

--- Updated File utils.py in package CMF --
--- utils.py	2001/06/01 00:20:24	1.12
+++ utils.py	2001/06/08 15:07:21	1.13
@@ -84,8 +84,9 @@
 ##############################################################################
 
 from ExtensionClass import Base
-from AccessControl import ClassSecurityInfo
+from AccessControl import ClassSecurityInfo, getSecurityManager
 from AccessControl.Permission import Permission
+from AccessControl.PermissionRole import rolesForPermissionOn
 from AccessControl.Role import gather_permissions
 import Globals
 from Acquisition import aq_get, aq_inner, aq_parent
@@ -138,23 +139,16 @@
     if type(value) == type(''): return tuple( split( value ) )
     raise ValueError, "%s of unsupported type" % valueName
 
-try:
-    # Zope 2.2.x access control.
-    from AccessControl import getSecurityManager
-    def _getAuthenticatedUser(self):
-        return getSecurityManager().getUser()
-    def _checkPermission(permission, obj):
-        return getSecurityManager().checkPermission(permission, obj)
-except:
-    # Zope 2.1.x access control.
-    from AccessControl import User
-    def _getAuthenticatedUser(self):
-        u = self.REQUEST.get('AUTHENTICATED_USER', None)
-        if u is None:
-            u = User.nobody
-        return u
-    def _checkPermission(permission, obj):
-        return _getAuthenticatedUser(obj).has_permission(permission, obj)
+def _getAuthenticatedUser( self ):
+    return getSecurityManager().getUser()
+
+def _checkPermission(permission, obj, StringType = type('')):
+    roles = rolesForPermissionOn(permission, obj)
+    if type(roles) is StringType:
+        roles=[roles]
+    if _getAuthenticatedUser( obj ).allowed( obj, roles ):
+        return 1
+    return 0
 
 
 # If Zope ever provides a call to getRolesInContext() through