<br><br><div class="gmail_quote">On Tue, Jun 10, 2008 at 9:34 AM, Stephan Richter <<a href="mailto:srichter@cosmos.phy.tufts.edu">srichter@cosmos.phy.tufts.edu</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class="Wj3C7c">On Monday 09 June 2008, Daniel Blackburn wrote:<br>
> It seems that there either may be an issue with Zope security or I do<br>
> not understand it properly. Please let me know what you guys think.<br>
><br>
> Lets say we have a principal with no direct permissions or roles<br>
> assigned to see a view index.html. The principal has two groups,<br>
> group1 and group2. group1 allows the principal to see index.html and<br>
> group2 denys access to index.html. It seems to me that in this<br>
> situation of conflicting permissions a deny permission should result<br>
> for the principal to the index view. However it does not, the<br>
> permission will be digested into allowing the principal to have access<br>
> to the view. Is this the desired behavior, or just simply overlooked.<br>
> I looked in the doctests and did not see anything like this. Any<br>
> feedback would be appreciated.<br>
<br>
</div></div>I would epxect the order of the groups to matter and simply the setting that<br>
is found last wins. This is a third possible behavior that mimics Python's<br>
inheritance behavior.<br>
<br>The order seems to have no effect on the inheritance, I just ran the tests with two</blockquote><div> groups and toggled the permissions on each. <br></div></div><br>