[Zope3-checkins] SVN: Zope3/trunk/ Fixed Bug 484: Viewmeta directive bug. The browser:view and page:view

[Christian Theune]

Log message for revision 40517:
  Fixed Bug 484: Viewmeta directive bug. The browser:view and page:view
  directives did not apply the 'allowed_attributes' attribute and the unit test
  checking this was broken because the 'attribute' will always be available
  regardless of 'allowed_attributes'.
  
  

Changed:
  U   Zope3/trunk/doc/CHANGES.txt
  U   Zope3/trunk/src/zope/app/publisher/browser/tests/test_directives.py
  U   Zope3/trunk/src/zope/app/publisher/browser/viewmeta.py

-=-
Modified: Zope3/trunk/doc/CHANGES.txt
===================================================================
--- Zope3/trunk/doc/CHANGES.txt	2005-12-03 13:03:27 UTC (rev 40516)
+++ Zope3/trunk/doc/CHANGES.txt	2005-12-03 13:12:15 UTC (rev 40517)
@@ -162,6 +162,11 @@
 
     Bug Fixes
 
+      - Fixed Bug 484: Viewmeta directive bug. The browser:view and page:view
+        directives did not apply the 'allowed_attributes' attribute and the
+        unit test checking this was broken because the 'attribute' will always
+        be available regardless of 'allowed_attributes'.
+
       - Fixed bug 152 and 114: "redirects with large HML" and "logging http
         disconnects". Added an observer for twisted's log that routes error
         messages to the python logging facility for "twisted" on DEBUG level.

Modified: Zope3/trunk/src/zope/app/publisher/browser/tests/test_directives.py
===================================================================
--- Zope3/trunk/src/zope/app/publisher/browser/tests/test_directives.py	2005-12-03 13:03:27 UTC (rev 40516)
+++ Zope3/trunk/src/zope/app/publisher/browser/tests/test_directives.py	2005-12-03 13:12:15 UTC (rev 40517)
@@ -61,6 +61,14 @@
 
 request = TestRequest()
 
+class V2(V1, object):
+
+    def action(self):
+        return self.action2()
+
+    def action2(self):
+        return "done"
+
 class VT(V1, object):
     def publishTraverse(self, request, name):
         try:
@@ -469,11 +477,11 @@
         xmlconfig(StringIO(template %
             '''
             <browser:page name="test"
-                class="zope.app.component.tests.views.V1"
+                class="zope.app.publisher.browser.tests.test_directives.V2"
                 for="zope.app.component.tests.views.IC"
                 attribute="action"
                 permission="zope.Public"
-                allowed_attributes="action"
+                allowed_attributes="action2"
                 />
             '''
             ))
@@ -481,8 +489,30 @@
         v = zapi.getMultiAdapter((ob, request), name='test')
         v = ProxyFactory(v)
         self.assertEqual(v.action(), 'done')
+        self.assertEqual(v.action2(), 'done')
         self.assertRaises(Exception, getattr, v, 'index')
 
+    def testAttributeProtectedView(self):
+        xmlconfig(StringIO(template %
+            '''
+            <browser:view name="test"
+                class="zope.app.publisher.browser.tests.test_directives.V2"
+                for="zope.app.component.tests.views.IC"
+                permission="zope.Public"
+                allowed_attributes="action2"
+                >
+              <browser:page name="index.html" attribute="action" />
+           </browser:view>
+            '''
+            ))
+
+        v = zapi.getMultiAdapter((ob, request), name='test')
+        v = ProxyFactory(v)
+        page = v.publishTraverse(request, 'index.html')
+        self.assertEqual(page(), 'done')
+        self.assertEqual(v.action2(), 'done')
+        self.assertRaises(Exception, getattr, page, 'index')
+
     def testInterfaceAndAttributeProtectedPage(self):
         xmlconfig(StringIO(template %
             '''

Modified: Zope3/trunk/src/zope/app/publisher/browser/viewmeta.py
===================================================================
--- Zope3/trunk/src/zope/app/publisher/browser/viewmeta.py	2005-12-03 13:03:27 UTC (rev 40516)
+++ Zope3/trunk/src/zope/app/publisher/browser/viewmeta.py	2005-12-03 13:12:15 UTC (rev 40517)
@@ -164,7 +164,7 @@
 
     _handle_allowed_interface(_context, allowed_interface, permission,
                               required)
-    _handle_allowed_attributes(_context, allowed_interface, permission,
+    _handle_allowed_attributes(_context, allowed_attributes, permission,
                                required)
 
     _handle_for(_context, for_)
@@ -335,7 +335,7 @@
 
         _handle_allowed_interface(_context, allowed_interface, permission,
                                   required)
-        _handle_allowed_attributes(_context, allowed_interface, permission,
+        _handle_allowed_attributes(_context, allowed_attributes, permission,
                                    required)
         _handle_for(_context, for_)