[Zope-dev] More on [Removal of aq_acquire from guarded_getattr]

[Richard Jones]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 25 Jan 2005 10:30 am, Stefan H. Holek wrote:
>    - declaring object security on the acquiree via
> declareObjectProtected(foo)

For me, the problem arises when the acquiree is a Python builtin object - a 
string instance attribute in my case. Hence I can't make any useful statement 
like the above. I have a statement::

   security.setDefaultAccess({'secure_url': 1})

on the class, but with the change discussed here, that assertion is never 
looked up. I attempted to::

   security.declarePublic('secure_url') 

but of course that didn't change anything, as I mentioned the class assertions 
weren't being looked at.

After poking around some more, I realised that validate() 
(VerboseSecurityPolicy's) was being invoked with::

   aq_chain(container) = [
     <CG Conference Registrations registrations at 0x4176ba00>,
     <CG WebSpace web at 0x41483ce0>,
     <CG Conference 1 at 0x4176b970>,
     <CG Conferences conferences at 0x41483c30>,
     <CGPublisher CGPublisher at 0x4176b980>,
     <Application instance at 4179e050>,
     <RequestContainer instance at 4176b9f0>]

   context = <AccessControl.SecurityManagement.SecurityContext instance at
     0x413cabec>

   aq_chain(value) = ['http://secure.cgpublisher.localhost']

That is, there's no acquisition context on the simple string. To "fix" the 
problem, I changed secure_url to be a ComputedAttribute which looked up the 
instance attribute _secure_url. This then gave the value a valid acquisition 
chain and everything "works" now.

I'm really sorry I can't be more helpful and produce a useful test case, but 
I've a bazillion deadlines falling on the floor. Maybe in a few months. For 
now I just needed a work-around that will let me run in an un-patched Zope.


    Richard
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCBwoerGisBEHG6TARAqRIAJwOOCtEccg2RqsjqjzlTLkEVfvn2gCeMYRw
qwFvrTuk5xxhYi0pAU+UcUo=
=SOlC
-----END PGP SIGNATURE-----