[Checkins] SVN: zope.app.publisher/trunk/ Fixed bug in xmlrpc:view
about in some cases omitting the permission and
Christian Theune
ct at gocept.com
Wed Jul 18 10:06:28 EDT 2007
Log message for revision 78108:
Fixed bug in xmlrpc:view about in some cases omitting the permission and
re-using the permission of the view class.
--This line, and those below, will be ignored--
AM CHANGES.txt
M src/zope/app/publisher/ftesting.zcml
M src/zope/app/publisher/xmlrpc/metaconfigure.py
M src/zope/app/publisher/xmlrpc/metadirectives.py
M src/zope/app/publisher/xmlrpc/tests/test_directives.py
A src/zope/app/publisher/xmlrpc/tests/xmlrpc_nonamenoperm.zcml
M src/zope/app/publisher/xmlrpc/tests/xmlrpc_noperm.zcml
M src/zope/app/publisher/xmlrpc/README.txt
Changed:
A zope.app.publisher/trunk/CHANGES.txt
U zope.app.publisher/trunk/src/zope/app/publisher/ftesting.zcml
U zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/README.txt
U zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metaconfigure.py
U zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metadirectives.py
U zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/test_directives.py
A zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_nonamenoperm.zcml
U zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_noperm.zcml
-=-
Added: zope.app.publisher/trunk/CHANGES.txt
===================================================================
--- zope.app.publisher/trunk/CHANGES.txt (rev 0)
+++ zope.app.publisher/trunk/CHANGES.txt 2007-07-18 14:06:28 UTC (rev 78108)
@@ -0,0 +1,19 @@
+=======
+Changes
+=======
+
+After 3.4.0a1
+=============
+
+ - Fixed a bug about xmlrpc:view: Omitting a permission was (widely)
+ documented to be allowed when a name is given and should incorporate the
+ original security settings of the view class. This did not work at all and
+ the permission was always required. It now works as described.
+
+
+Before 3.4
+==========
+
+This package was part of the Zope 3 distribution and did not have its own
+CHANGES.txt. For earlier changes please refer to either our subversion log or
+the CHANGES.txt of earlier Zope 3 releases.
Property changes on: zope.app.publisher/trunk/CHANGES.txt
___________________________________________________________________
Name: svn:eol-style
+ native
Modified: zope.app.publisher/trunk/src/zope/app/publisher/ftesting.zcml
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/ftesting.zcml 2007-07-18 13:22:54 UTC (rev 78107)
+++ zope.app.publisher/trunk/src/zope/app/publisher/ftesting.zcml 2007-07-18 14:06:28 UTC (rev 78108)
@@ -28,6 +28,15 @@
login="mgr"
password="mgrpw" />
+ <!-- A user that only has zope.View -->
+ <principal
+ id="zope.user"
+ title="User"
+ login="usr"
+ password="usrpw"
+ />
+ <grant permission="zope.View" principal="zope.user" />
+
<!-- Bootstrap principal used to make local grant to the principal above -->
<principal
id="zope.globalmgr"
Modified: zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/README.txt
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/README.txt 2007-07-18 13:22:54 UTC (rev 78107)
+++ zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/README.txt 2007-07-18 14:06:28 UTC (rev 78108)
@@ -279,6 +279,63 @@
>>> proxy.epoch()
<DateTime u'19700101T01:00:01' at -4bcac114>
+Protecting XML/RPC views with class-based permissions
+-----------------------------------------------------
+
+When setting up an XML/RPC view with no permission, the permission check is
+deferred to the class that provides the view's implementation:
+
+ >>> class ProtectedView(object):
+ ... def public(self):
+ ... return u'foo'
+ ... def protected(self):
+ ... return u'bar'
+
+ >>> from zope.configuration import xmlconfig
+ >>> ignored = xmlconfig.string("""
+ ... <configure
+ ... xmlns="http://namespaces.zope.org/zope"
+ ... xmlns:xmlrpc="http://namespaces.zope.org/xmlrpc"
+ ... >
+ ... <!-- We only need to do this include in this example,
+ ... Normally the include has already been done for us. -->
+ ... <include package="zope.app.publisher.xmlrpc" file="meta.zcml" />
+ ... <include package="zope.app.component" file="meta.zcml" />
+ ...
+ ... <class class="zope.app.publisher.xmlrpc.README.ProtectedView">
+ ... <require permission="zope.ManageContent"
+ ... attributes="protected" />
+ ... <allow attributes="public" />
+ ... </class>
+ ...
+ ... <xmlrpc:view
+ ... name="index"
+ ... for="zope.app.folder.folder.IFolder"
+ ... methods="public protected"
+ ... class="zope.app.publisher.xmlrpc.README.ProtectedView"
+ ... />
+ ... </configure>
+ ... """)
+
+An unauthenticated user can access the public method, but not the protected
+one:
+
+ >>> proxy = ServerProxy("http://usr:usrpw@localhost/index", handleErrors=False)
+ >>> proxy.public()
+ 'foo'
+ >>> proxy.protected() # doctest: +NORMALIZE_WHITESPACE
+ Traceback (most recent call last):
+ Unauthorized: (<zope.app.publisher.xmlrpc.metaconfigure.ProtectedView
+ object at 0x...>, 'protected', 'zope.ManageContent')
+
+As a manager, we can access both:
+
+ >>> proxy = ServerProxy("http://mgr:mgrpw@localhost/index")
+ >>> proxy.public()
+ 'foo'
+ >>> proxy.protected()
+ 'bar'
+
Handling errors with the ServerProxy
------------------------------------
Modified: zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metaconfigure.py
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metaconfigure.py 2007-07-18 13:22:54 UTC (rev 78107)
+++ zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metaconfigure.py 2007-07-18 14:06:28 UTC (rev 78108)
@@ -16,7 +16,9 @@
$Id$
"""
from zope.interface import Interface
+from zope.configuration.exceptions import ConfigurationError
from zope.security.checker import CheckerPublic, Checker
+from zope.security.checker import defineChecker, getCheckerForInstancesOf
from zope.publisher.interfaces.xmlrpc import IXMLRPCRequest
from zope.component.interface import provideInterface
from zope.component.zcml import handler
@@ -70,6 +72,15 @@
class_ = proxyView
class_.factory = original_class
+ else:
+ # No permission was defined, so we defer to the checker
+ # of the original class
+ def proxyView(context, request, class_=class_):
+ view = class_(context, request)
+ view.__Security_checker__ = getCheckerForInstancesOf(original_class)
+ return view
+ class_ = proxyView
+ class_.factory = original_class
# Register the new view.
_context.action(
@@ -83,7 +94,9 @@
if permission:
checker = Checker({'__call__': permission})
else:
- checker = None
+ raise ConfigurationError(
+ "XML/RPC view has neither a name nor a permission. "
+ "You have to specify at least one of the two.")
for name in require:
# create a new callable class with a security checker;
Modified: zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metadirectives.py
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metadirectives.py 2007-07-18 13:22:54 UTC (rev 78107)
+++ zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/metadirectives.py 2007-07-18 14:06:28 UTC (rev 78108)
@@ -58,16 +58,16 @@
the names defined by the given methods or interfaces will be
under the given permission.
- If a name is not given for the view, then, this option is
- required and the the given permission is required to call the
- individual views defined by the given interface and methods.
+ If a name is not given for the view, then, this option is required and
+ the given permission is required to call the individual views defined
+ by the given interface and methods.
(See the name attribute.)
If no permission is given, then permissions should be declared
for the view using other means, such as the class directive.
""",
- required=True)
+ required=False)
name = zope.schema.TextLine(
title=u"The name of the view.",
Modified: zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/test_directives.py
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/test_directives.py 2007-07-18 13:22:54 UTC (rev 78107)
+++ zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/test_directives.py 2007-07-18 14:06:28 UTC (rev 78108)
@@ -77,8 +77,13 @@
"xmlrpc_error.zcml", xmlrpc.tests)
def testNoPermission(self):
+ xmlconfig.file("xmlrpc_noperm.zcml", xmlrpc.tests)
+ v = component.getMultiAdapter((ob, request), name='index')
+ self.assertEqual(v.index(), 'V1 here')
+
+ def test_no_name_no_permission(self):
self.assertRaises(ConfigurationError, xmlconfig.file,
- "xmlrpc_noperm.zcml", xmlrpc.tests)
+ "xmlrpc_nonamenoperm.zcml", xmlrpc.tests)
def test_no_name(self):
xmlconfig.file("xmlrpc.zcml", xmlrpc.tests)
Added: zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_nonamenoperm.zcml
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_nonamenoperm.zcml (rev 0)
+++ zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_nonamenoperm.zcml 2007-07-18 14:06:28 UTC (rev 78108)
@@ -0,0 +1,12 @@
+<configure xmlns="http://namespaces.zope.org/zope"
+ xmlns:xmlrpc="http://namespaces.zope.org/xmlrpc"
+ i18n_domain="zope">
+
+ <include package="zope.app.publisher.xmlrpc" file="meta.zcml"/>
+
+ <xmlrpc:view
+ class="zope.app.component.tests.views.V1"
+ for="zope.app.component.tests.views.IC"
+ />
+
+</configure>
Modified: zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_noperm.zcml
===================================================================
--- zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_noperm.zcml 2007-07-18 13:22:54 UTC (rev 78107)
+++ zope.app.publisher/trunk/src/zope/app/publisher/xmlrpc/tests/xmlrpc_noperm.zcml 2007-07-18 14:06:28 UTC (rev 78108)
@@ -5,7 +5,7 @@
<include package="zope.app.publisher.xmlrpc" file="meta.zcml"/>
<xmlrpc:view
- name="test"
+ name="index"
class="zope.app.component.tests.views.V1"
for="zope.app.component.tests.views.IC"
/>
More information about the Checkins
mailing list