[Zope] security model with regards to aquisition

[Jay, Dylan]

> -----Original Message-----
> From: Jim Fulton [mailto:jim@digicool.com]
> Sent: Thursday, April 29, 1999 10:23 PM
> To: Jay, Dylan
> Cc: 'zope@zope.org'
> Subject: Re: [Zope] security model with regards to aquisition
> 
> 
> Jay, Dylan wrote:
> 
> (snip)
> 
> > I wrote:
> > > A possible work around is to use an expression and name the folder
> > > when you access properties to force access to the folder to
> > > be checked:
> > >
> > >   <!--#var "theSecretFolder.aProperty"-->
> > 
> > This work around doesn't seem to work in my case. I want to actually
> > redirect to another address which seems to always work no 
> matter whether the
> > the folder is allowed to be accessed or not. Here is the 
> method I'm using
> > 
> > <!--#if "_.getitem(id).title"-->
> > <!--#call
> > 
> "REQUEST.set('blah',_.string.split(DownloadItems[_.int(file)],
> '|'))"-->
> > <!--#call 
> "REQUEST.set('loc',_.string.split(Locations[_.int(loc)],'|'))"-->
> > <!--#with "_.namespace(file=aq_parent.id + '/' + id + '/' + 
> blah[1])"-->
> >  <!--#call "RESPONSE.redirect(loc[1]+'/'+file+'?'+getArgs(_,file,
> > 10)+'&f='+file)"-->
> > <!--#/with-->
> > <!--#else-->
> > <!--#call "RESPONSE.setStatus(404)"-->
> > <!--#/if-->
> 
> Are you saying that this code should work differently?
> Or that the file you redirect to should fail?  If the former, 

The above should call the 404 responce (or ask for authorization) if the
method is being run from a directory that is restricted.

> please help me out and point me to the specific test that you want to
> work differently. If the latter, then you need to change the property
> references in the file you redirected too.  Alternatively, you can 

The whole idea is the file I redirect too is on a completly different
website. I want to use the security model in zope to determine who I
generate a url to direct to another site (with a one time key so the file
can't be downloaded again)

> apply the change (to lib/python/DocumentTemplate/cDocumentTemplate)
> that I checked in yesterday. :)

I think I will have to do that.