[Checkins] SVN: z3c.layer.minimal/trunk/ Fixed security issue: The traverser defined for ``IMinimalBrowserLayer`` was a trusted adapter, so the security proxy got removed from each traversed object. Thus all sub-objects were publically accessable, too.

[Michael Howitz]

Log message for revision 96930:
  Fixed security issue: The traverser defined for ``IMinimalBrowserLayer`` was a trusted adapter, so the security proxy got removed from each traversed object. Thus all sub-objects were publically accessable, too.
  

Changed:
  U   z3c.layer.minimal/trunk/CHANGES.txt
  U   z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/__init__.py
  A   z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/bugfixes.txt
  U   z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/ftesting.zcml
  U   z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/test_layer.py
  U   z3c.layer.minimal/trunk/src/z3c/layer/minimal/zope.traversing.browser.zcml

-=-
Modified: z3c.layer.minimal/trunk/CHANGES.txt
===================================================================
--- z3c.layer.minimal/trunk/CHANGES.txt	2009-02-21 14:13:34 UTC (rev 96929)
+++ z3c.layer.minimal/trunk/CHANGES.txt	2009-02-21 14:15:11 UTC (rev 96930)
@@ -5,7 +5,10 @@
 1.1.1 (unreleased)
 ------------------
 
-- Nothing changed yet.
+- **Security issue:** The traverser defined for
+  ``IMinimalBrowserLayer`` was a trusted adapter, so the security
+  proxy got removed from each traversed object. Thus all sub-objects
+  were publically accessable, too.
 
 
 1.1.0 (2009-02-19)
@@ -17,7 +20,7 @@
 
 - Using ``zope.container`` instead of ``zope.app.container``.
 
-- Made sure long_description renders properly on pypi.
+- Made sure that long_description renders properly on pypi.
 
 
 1.0.1 (2008-01-24)

Modified: z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/__init__.py
===================================================================
--- z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/__init__.py	2009-02-21 14:13:34 UTC (rev 96929)
+++ z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/__init__.py	2009-02-21 14:15:11 UTC (rev 96930)
@@ -44,7 +44,7 @@
         context = self.context
         request = self.request
         for name in self.macro_pages:
-            page = zope.component.getMultiAdapter((context, request), 
+            page = zope.component.getMultiAdapter((context, request),
                 name=name)
             try:
                 v = page[key]
@@ -76,4 +76,11 @@
 
     def __call__(self):
         raise Exception('simply system error')
-        return u''
\ No newline at end of file
+        return u''
+
+
+class ContainerContentsPage(BrowserPage):
+    """Contents of a conatiner."""
+
+    def __call__(self):
+        return str([type(x) for x in self.context.values()])

Added: z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/bugfixes.txt
===================================================================
--- z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/bugfixes.txt	                        (rev 0)
+++ z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/bugfixes.txt	2009-02-21 14:15:11 UTC (rev 96930)
@@ -0,0 +1,26 @@
+==========
+ Bugfixes
+==========
+
+Traversed objects where not security proxied
+============================================
+
+When an object got traversed its security proxy was removed, so its
+sub-objects could be publically accessed. To show that this behavior
+was fixed we put a folder into the root folder and look at its
+contents using a view:
+
+  >>> import zope.site.folder
+  >>> getRootFolder()['test'] = zope.site.folder.Folder()
+
+  >>> from zope.testbrowser.testing import Browser
+  >>> manager = Browser()
+  >>> manager.addHeader('Authorization', 'Basic mgr:mgrpw')
+  >>> skinURL = 'http://localhost/++skin++MinimalTesting'
+  >>> manager.open(skinURL + '/container_contents.html')
+
+The view displays the types of the content objects inside the root
+folder. The content objects are security proxied:
+
+  >>> print manager.contents
+  [<type 'zope.security._proxy._Proxy'>]
\ No newline at end of file


Property changes on: z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/bugfixes.txt
___________________________________________________________________
Added: svn:keywords
   + Id Rev Date
Added: svn:eol-style
   + native

Modified: z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/ftesting.zcml
===================================================================
--- z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/ftesting.zcml	2009-02-21 14:13:34 UTC (rev 96929)
+++ z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/ftesting.zcml	2009-02-21 14:15:11 UTC (rev 96930)
@@ -129,4 +129,12 @@
       class=".SystemErrorPage"
       />
 
+    <browser:page
+        for="*"
+        name="container_contents.html"
+        permission="zope.View"
+        layer="z3c.layer.minimal.IMinimalBrowserLayer"
+        class=".ContainerContentsPage"
+        />
+
 </configure>

Modified: z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/test_layer.py
===================================================================
--- z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/test_layer.py	2009-02-21 14:13:34 UTC (rev 96929)
+++ z3c.layer.minimal/trunk/src/z3c/layer/minimal/tests/test_layer.py	2009-02-21 14:15:11 UTC (rev 96930)
@@ -1,6 +1,6 @@
 ##############################################################################
 #
-# Copyright (c) 2005 Zope Foundation and Contributors.
+# Copyright (c) 2005-2009 Zope Foundation and Contributors.
 # All Rights Reserved.
 #
 # This software is subject to the provisions of the Zope Public License,
@@ -18,17 +18,22 @@
 import unittest
 from zope.app.testing import functional
 
+
 functional.defineLayer('TestLayer', 'ftesting.zcml')
 
 
+def create_suite(*args, **kw):
+    suite = functional.FunctionalDocFileSuite(*args, **kw)
+    suite.layer = TestLayer
+    return suite
+
+
 def test_suite():
     suite = unittest.TestSuite()
+    suite.addTest(create_suite('../README.txt'))
+    suite.addTest(create_suite('bugfixes.txt'))
+    return suite
 
-    s = functional.FunctionalDocFileSuite('../README.txt')
-    s.layer = TestLayer
-    suite.addTest(s)
 
-    return suite
-
 if __name__ == '__main__':
     unittest.main(defaultTest='test_suite')

Modified: z3c.layer.minimal/trunk/src/z3c/layer/minimal/zope.traversing.browser.zcml
===================================================================
--- z3c.layer.minimal/trunk/src/z3c/layer/minimal/zope.traversing.browser.zcml	2009-02-21 14:13:34 UTC (rev 96929)
+++ z3c.layer.minimal/trunk/src/z3c/layer/minimal/zope.traversing.browser.zcml	2009-02-21 14:15:11 UTC (rev 96930)
@@ -9,7 +9,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.publication.traversers.SimpleComponentTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <adapter
@@ -18,7 +17,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.container.traversal.ItemTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <adapter
@@ -27,7 +25,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.container.traversal.ItemTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <view