[Zope-Checkins] CVS: Zope/lib/python/AccessControl -
Owned.py:1.18.6.2 ZopeSecurityPolicy.py:1.20.4.5
Tres Seaver
tseaver at zope.com
Mon Jan 26 13:16:13 EST 2004
Update of /cvs-repository/Zope/lib/python/AccessControl
In directory cvs.zope.org:/tmp/cvs-serv31220/lib/python/AccessControl
Modified Files:
Tag: Zope-2_6-branch
Owned.py ZopeSecurityPolicy.py
Log Message:
Fix breakage in tests
- AccessControl/Owned.py:
o Expand API to include explicit methods for retrieving the
"owner tuple" and the "wrapped owner".
o Deprecate the 'getOwner(1)' wart.
o Add tests.
- AccessControl/ZopeSecurityPolicy.py:
o For the Python version of validate, use the new 'getWrappedOwner'
API, rather than painfully reconstructing it ourselves. Also, skip
tests for acquisition trickery if the container is not a wrapper
(should repair breakage in DCWorkflow scripts w/ proxy roles).
o XXX: Note that cAccessControl needs to follow suit!
- App/special_dtml.py, Products/PageTemplates/PageTemplateFile.py:
o Implement the new Owned API.
=== Zope/lib/python/AccessControl/Owned.py 1.18.6.1 => 1.18.6.2 ===
--- Zope/lib/python/AccessControl/Owned.py:1.18.6.1 Wed Nov 19 07:23:23 2003
+++ Zope/lib/python/AccessControl/Owned.py Mon Jan 26 13:15:41 2004
@@ -10,21 +10,18 @@
# FOR A PARTICULAR PURPOSE
#
##############################################################################
-__doc__='''Support for owned objects
+"""Support for owned objects
-
-$Id$'''
-__version__='$Revision$'[11:-2]
+$Id$
+"""
import Globals, urlparse, SpecialUsers, ExtensionClass
from AccessControl import getSecurityManager, Unauthorized
from Acquisition import aq_get, aq_parent, aq_base
UnownableOwner=[]
-def ownableFilter(self,
- aq_get=aq_get,
- UnownableOwner=UnownableOwner):
- _owner=aq_get(self, '_owner', None, 1)
+def ownableFilter(self):
+ _owner = aq_get(self, '_owner', None, 1)
return _owner is not UnownableOwner
# Marker to use as a getattr default.
@@ -52,8 +49,11 @@
def owner_info(self):
"""Get ownership info for display
"""
- owner=self.getOwner(1)
- if owner is None or owner is UnownableOwner: return owner
+ owner=self.getOwnerTuple()
+
+ if owner is None or owner is UnownableOwner:
+ return owner
+
d={'path': '/'.join(owner[0]), 'id': owner[1],
'explicit': hasattr(self, '_owner'),
'userCanChangeOwnershipType':
@@ -62,43 +62,71 @@
return d
getOwner__roles__=()
- def getOwner(self, info=0,
- aq_get=aq_get,
- UnownableOwner=UnownableOwner,
- getSecurityManager=getSecurityManager,
- ):
+ def getOwner(self, info=0):
"""Get the owner
If a true argument is provided, then only the owner path and id are
returned. Otherwise, the owner object is returned.
"""
- owner=aq_get(self, '_owner', None, 1)
- if info or (owner is None): return owner
+ if info:
+ import warnings
+ warnings.warn('Owned.getOwner(1) is deprecated; '
+ 'please use getOwnerTuple() instead.',
+ DeprecationWarning)
+
+ return self.getOwnerTuple()
+
+ return aq_base(self.getWrappedOwner()) # ugh, backward compat.
+
+ getOwnerTuple__roles__=()
+ def getOwnerTuple(self):
+ """Return a tuple, (userdb_path, user_id) for the owner.
+
+ o Ownership can be acquired, but only from the containment path.
+
+ o If unowned, return None.
+ """
+ return aq_get(self, '_owner', None, 1)
- if owner is UnownableOwner: return None
+ getWrappedOwner__roles__=()
+ def getWrappedOwner(self):
+ """Get the owner, modestly wrapped in the user folder.
- udb, oid = owner
+ o If the object is not owned, return None.
+
+ o If the owner's user database doesn't exist, return Nobody.
+
+ o If the owner ID does not exist in the user database, return Nobody.
+ """
+ owner = self.getOwnerTuple()
+
+ if owner is None:
+ return None
+
+ udb_path, oid = owner
+
+ root = self.getPhysicalRoot()
+ udb = root.unrestrictedTraverse(udb_path, None)
- root=self.getPhysicalRoot()
- udb=root.unrestrictedTraverse(udb, None)
if udb is None:
- user = SpecialUsers.nobody
- else:
- user = udb.getUserById(oid, None)
- if user is None: user = SpecialUsers.nobody
- return user
+ return SpecialUsers.nobody
+
+ user = udb.getUserById(oid, None)
+
+ if user is None:
+ return SpecialUsers.nobody
+
+ return user.__of__(udb)
changeOwnership__roles__=()
- def changeOwnership(self, user, recursive=0,
- aq_get=aq_get,
- ):
+ def changeOwnership(self, user, recursive=0):
"""Change the ownership to the given user. If 'recursive' is
true then also take ownership of all sub-objects, otherwise
sub-objects retain their ownership information."""
new=ownerInfo(user)
if new is None: return # Special user!
- old=aq_get(self, '_owner', None, 1)
+ old = self.getOwnerTuple()
if old==new: return
if old is UnownableOwner: return
@@ -117,7 +145,7 @@
user=security.getUser()
info=ownerInfo(user)
if info is None: return 0
- owner=self.getOwner(1)
+ owner=self.getOwnerTuple()
if owner == info: return 0
return security.checkPermission('Take ownership', self)
@@ -147,7 +175,7 @@
old=getattr(self, '_owner', None)
if explicit:
if old is not None: return
- owner=aq_get(self, '_owner', None, 1)
+ owner = self.getOwnerTuple()
if owner is not None and owner is not UnownableOwner:
self._owner=owner
else:
=== Zope/lib/python/AccessControl/ZopeSecurityPolicy.py 1.20.4.4 => 1.20.4.5 ===
--- Zope/lib/python/AccessControl/ZopeSecurityPolicy.py:1.20.4.4 Mon Jan 12 16:29:50 2004
+++ Zope/lib/python/AccessControl/ZopeSecurityPolicy.py Mon Jan 26 13:15:41 2004
@@ -198,18 +198,15 @@
# in the context of the accessed item; users in subfolders
# should not be able to use proxy roles to access items
# above their subfolder!
- owner = eo.getOwner()
- # Sigh; the default userfolder doesn't return users wrapped
- if owner and not hasattr(owner, 'aq_parent'):
- udb=eo.getOwner(1)[0]
- root=container.getPhysicalRoot()
- udb=root.unrestrictedTraverse(udb)
- owner=owner.__of__(udb)
+ owner = eo.getWrappedOwner()
if owner is not None:
- if not owner._check_context(container):
- # container is higher up than the owner, deny access
- raise Unauthorized(name, value)
+ if container is not containerbase:
+ # Unwrapped objects don't need checking
+ if not owner._check_context(container):
+ # container is higher up than the owner,
+ # deny access
+ raise Unauthorized(name, value)
for r in proxy_roles:
if r in roles: return 1
More information about the Zope-Checkins
mailing list