[Grok-dev] Re: How do I check permissions on a view?

[Philipp von Weitershausen]

Martijn Faassen wrote:
> Sebastian Ware wrote:
>> To check permissions on an object I can use...
>>
>>   zope.security.canAccess
>>   zope.security.canWrite
>>
>> ...is there a similar way of checking if the current principal may 
>> access a given view? Maybe using the URL?
> 
> You can explicitly check permissions like this:
> 
> from zope.security.management import getInteraction
> interaction = getInteraction()
> interaction.checkPermission('mypermission', object):

Or just use

   zope.security.checkPermission(perm, obj)

which hides all this interaction business away.

Either way, I think this is only half the solution to Sebastian's 
problem. If he wants to separate concerns, then he shouldn't make his 
code have to know about the required permission. It should just work 
with whichever permission was set on the view. This is what canAccess does:

   zope.security.canAccess(view, '__call__')

It will look up which permission is required for accessing view.__call__ 
and then check if the user has the permission.


-- 
http://worldcookery.com -- Professional Zope documentation and training