[Zope] security model with regards to aquisition

[Jay, Dylan]

> -----Original Message-----
> From: Jim Fulton [mailto:jim@digicool.com]
> Sent: Thursday, 29 April 1999 00:11
> To: Jay, Dylan
> Cc: 'zope@zope.org'
> Subject: Re: [Zope] security model with regards to aquisition
> 
> 
> 
> 
> "Jay, Dylan" wrote:
> > 
> > I have a folder that has restricted access. In a parent 
> folder I have a DTML
> > method that accesses a property of the folder. A browser 
> that has not been
> > autheticated for viewing the folder can still view use the 
> aquired method in
> > the folder, ie they type
> > 
> > http://server.com/RestrictedFolder/parentMethod and it works!!!
> > 
> > This seems counter intuitive to me.
> 
> Me too.  Note that this has nothing to do with acquisition.
> A Public method of the folder could also access a property 
> of the folder.
> 
> > Either you have access to a folder or
> > you do not.
> 
> Well, there are many types of access.  But I think it should 
> be possible
> to disacble access to a folder's properties through the 
> "Access contents information" permission.
> 
> > Why is this the case and should it be? In any case how do I make
> > sure users can not do the above unless authenticated?
> 
> This is a bug in the validation logic.  The current rules
> allow access to objects that don't have __roles__ attributes 
> and that are not acquired.  The reason is that it is assumed that
> you have to have access to the container to get the object, but this
> is not always true.  
> 
> I will fix this today and check the fix in, so it will be available 
> via the public CVS.  The fix will also be in the next release.
> The fix will add a check for parent roles even if an object is
> not acquired.
> 
> A possible work around is to use an expression and name the folder 
> when you access properties to force access to the folder to 
> be checked:
> 
>   <!--#var "theSecretFolder.aProperty"-->

This work around doesn't seem to work in my case. I want to actually
redirect to another address which seems to always work no matter whether the
the folder is allowed to be accessed or not. Here is the method I'm using

<!--#if "_.getitem(id).title"-->
<!--#call
"REQUEST.set('blah',_.string.split(DownloadItems[_.int(file)],'|'))"-->
<!--#call "REQUEST.set('loc',_.string.split(Locations[_.int(loc)],'|'))"-->
<!--#with "_.namespace(file=aq_parent.id + '/' + id + '/' + blah[1])"-->
 <!--#call "RESPONSE.redirect(loc[1]+'/'+file+'?'+getArgs(_,file,
10)+'&f='+file)"-->
<!--#/with-->
<!--#else-->
<!--#call "RESPONSE.setStatus(404)"-->
<!--#/if-->