[Zope-Coders] Re: Changes to ObjectManager, Role, and User in Zope2

[Chris McDonough]

On Thu, 2004-03-18 at 09:01, Tres Seaver wrote:
> No, they should never *have* local roles at all.  It is an error to 
> assign local roles to either one, which is why they don't have IDs.

Well, they do have ids, but their ids are both None.  But I understand
what you mean, though.

>   The 
> fact that some code used 'getUserName' instead of 'getId' is s mere bug, 
> not a sign of intent.

I understand.  I fixed many places in the code to use getId rather than
getUserName a few months back.

> > It would make sense for the emergency user and the anonymous user to
> > have distinct user ids as having them be the same seems like it might
> > become a security issue waiting to bite someone who is not completely
> > familiar with security internals.  Also, although neither the anonymous
> > user nor the emergency user are presented as options on the local roles
> > tab, if they do happen to be granted local roles programmatically,
> > seeing "None" granted roles on the local roles screen is probably going
> > to confuse people.
> 
> -1.  If we don't give them user IDs, then we won't be able to grant them 
> local roles, n'est-ce pas?  And since neither of them should ever *need* 
> local roles, we shouldn't give them IDs.

FWIW, I think the "Anonymous" role is pretty bizarre, and I'd rather be
able to assign user-defined roles to the anonymous user (which can only
be accomplished through local roles) rather than need to assign special
sets of permissions to the Anonymous role to gain the same effect. 
There may already be applications that do this.  I'm not sure they
deserve to lose, as it is a reasonable thing to want to do.  I would
like to leave this options open if possible.

> > To make life simple, maybe we should just give the anonymous user an id
> > of 'Anonymous' and the Emergency User an id of 'Emergency' and create a
> > "isSpecialUser" function that the _setObject code calls to figure out
> > whether it should grant local roles or not.  A more complicated way
> > would be to create a persistent SpecialUserId class that always
> > evaluated to false, then the _setObject code could stay as it is, but it
> > might break some other existing code.
> 
> If we modify '_setObject; and the rest of the code in Zope which assigns 
> / checks local roles to bail early if the ID is None, then the problem 
> goes away.  If third-party code has been assigning local roles to the 
> ID, 'None', it already deserves to lose.

I was worried that historically user folders created by the emergency
user got the owner local role assigned to None and  that when people
whove created user folders as the emergency user upgrade to the newer
Zope version, those user folders would become manageable by the
anonymous user.  But due to the bug of using the username in _setObject
in the first place, this isn't true.. the emergency user's *name* gets
the local role.  So the b/c issue I was worried about is a non-case.

But I would prefer that we didn't prevent local role assignment to the
anonymous user (if only on principle).  If that's untenable, maybe as a
safeguard if we don't want the Anonymous/Emergency users to ever possess
local roles, we should make their ids unpickleable so they can't
accidentally sneak in to a local role map.

- C