[Zope-dev] Re: Five and browser-oriented components

[Philipp von Weitershausen]

Tres Seaver wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Martin Aspeli wrote:
>> Martijn Faassen wrote:
>>
>>> Technically, I think that this is going to be hard. You'd need to patch 
>>> in the magic acquisition base class. Acquisition is the main reason that 
>>> some of the code needed to be duplicated - without the existence of 
>>> acquisition wrappers, security checks are not made for view access and 
>>> things just won't work.
>> I think if we could finish the philikon-aq_parent branch (or whatever 
>> it's called) that makes it possible to do acquisition using __parent__ 
>> pointers, we'd be a lot closer.
> 
> AFAIU, that branch doesn't provide *acquisition* via the __parent__
> pointer:

No, it does. It makes __parent__ pointers completely equivalent to 
explicit acquisition wrappers.

> rather it allows the containment-based security check, which
> currently uses the 'inner' acquisition wrapper, to use the chain of
> '__parent__' pointers as an alternative when no acquisition wrapper is
> present.

The security machinery (AccessControl) does an aq_aquire(obj, 
'__roles__') check. With __parent__ pointers, this will resolve properly.

The branch is indeed "ready" from Zope's own point of view. Last thing I 
remember is that one (!) Plone tests fails in an obscure way. Then 
again, one failing test sometimes is enough :)