[Zope] Re: DiskBased products and security

[Haim Ashkenazi]

On Mon, 13 Jun 2005 19:13:14 +0200, Dieter Maurer wrote:

> Haim Ashkenazi wrote at 2005-6-13 15:43 +0300:
>> ...
>>1. __roles__ = () - I didn't understand exactly why but with this
>>statement I can't access the product either from the ZMI or directly from
>>the web.
> 
> This is a (deprecated) alternative for "security.declareObjectPrivate()".
> 
>>2. security.setDefaultAccess("deny") - I think I understand why we changed
>>that, but it's causing a lot of problems. If I add 'delareProtected' for
>>all my methods, I can access certain pages , but with some pages (maybe
>>ones that's calling methods form base classes or acquisition like
>>'title_or_id') I still get errors ("Unauthorized: You are not allowed to
>>access 'title_or_id' in this context"). trying to solve this I started
>>adding 'declareProtected' for every method I got error for. I gave up
>>after 3 methods, but it seem to help.
> 
> Yes, many methods of "OFS.SimpleItem.SimpleItem" and its base
> classes rely on its "setDefaultAccess('allow')".
> 
> If you change this to "deny", you have to provide the
> explicit security declarations.
> 
>>so, I was wondering if something was changed in the security model since
>>2.5 (the version that the book is about) until 2.7, and is there a place
>>where it's documented (the zope developer guide is versioned 2.4)?
> 
> "setDefaultAccess('deny')" had a bug in some earlier Zope versions.
> With the exception of this fix, nothing changed here for a long
> time. You can still use the Zope Developper Guide...
> 
>>also, If I'll make sure that every method I have in my module is also
>>declared as protected, or public, is there a problem with living the
>>default access as any?
> 
> As what?
sorry, I was unclear there :)

what I meant is if I won't leave any method undeclaired (security wise) in
my class, will it be a security risc to leave the default access
(setDefaultAccess('any'))? can I protect uncallable objects (like
variables) the same way?

> 
> The "default access" also controls access to attributes of simple type
> (strings, tuples, dicts, ...) which cannot have their own security
> declarations.
> 
> If you do not access such attributes directly and you provide security
> declarations for all methods you use, then you can keep "defaultAccess
> == 'deny'".
thanx a lot for a very informative answer.

Bye
-- 
Haim