[Checkins] SVN: z3c.layer/branches/0.2/ backport the fix from z3c.layer.pagelet and z3c.layer.minimal

Christophe Combelles ccomb at free.fr
Sat Apr 17 20:39:42 EDT 2010


Log message for revision 111025:
  backport the fix from z3c.layer.pagelet and z3c.layer.minimal
  

Changed:
  U   z3c.layer/branches/0.2/CHANGES.txt
  U   z3c.layer/branches/0.2/setup.py
  U   z3c.layer/branches/0.2/src/z3c/layer/minimal/README.txt
  U   z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/__init__.py
  A   z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/bugfixes.txt
  U   z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/ftesting.zcml
  U   z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/test_layer.py
  U   z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.app.publication.zcml
  U   z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.traversing.browser.zcml
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/README.txt
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/browser/__init__.py
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/__init__.py
  A   z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/bugfixes.txt
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/ftesting.zcml
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/test_layer.py
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.app.publication.zcml
  U   z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.traversing.browser.zcml

-=-
Modified: z3c.layer/branches/0.2/CHANGES.txt
===================================================================
--- z3c.layer/branches/0.2/CHANGES.txt	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/CHANGES.txt	2010-04-18 00:39:41 UTC (rev 111025)
@@ -2,6 +2,21 @@
 CHANGES
 =======
 
+0.2.4 (2010-04-18)
+------------------
+
+- **Security issue:** The traversers defined for
+  ``IPageletBrowserLayer`` and ``IMinimalBrowserLayer`` was trusted adapters, so the security
+  proxy got removed from each traversed object. Thus all sub-objects
+  were publically accessable, too.
+
+  Making this change might BREAK your application!
+  That means if security is not well declared.
+
+- Bugfix: use IContentTemplate instead of IPageTemplate which avoids to get the
+  layout template if no IPageTemplate is registered
+
+
 0.2.3 (2007-11-07)
 ------------------
 
@@ -18,7 +33,7 @@
 
 - Bug: Fixed test failures due to depency updates.
 
-- Restructure: Fixed deprecation warninf for ``ZopeSecurityPolicy``.
+- Restructure: Fixed deprecation warning for ``ZopeSecurityPolicy``.
 
 
 0.2.1 (2007-??-??)

Modified: z3c.layer/branches/0.2/setup.py
===================================================================
--- z3c.layer/branches/0.2/setup.py	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/setup.py	2010-04-18 00:39:41 UTC (rev 111025)
@@ -23,7 +23,7 @@
     return open(os.path.join(os.path.dirname(__file__), *rnames)).read()
 
 setup(name = 'z3c.layer',
-      version = '0.2.3',
+      version = '0.2.4',
       author='Zope Corporation and Contributors',
       author_email='zope3-dev at zope.org',
       description='Collection of Alternative Base Layers',
@@ -50,8 +50,8 @@
       namespace_packages=['z3c'],
       extras_require = dict(
           test=['zope.app.testing',
+                'zope.securitypolicy',
                 'zope.app.securitypolicy',
-                'zope.securitypolicy',
                 'zope.testbrowser',
                 ]
           ),

Modified: z3c.layer/branches/0.2/src/z3c/layer/minimal/README.txt
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/README.txt	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/README.txt	2010-04-18 00:39:41 UTC (rev 111025)
@@ -3,17 +3,17 @@
 ======
 
 This package contains the minimal layer. This layer supports a correct set of 
-component registration and can be used for inheritation in custom skins.
+component registration and can be used for inheritance in custom skins.
 
-Right now the default implementation in Zope3 has different restriction in the
-traversal concept and use to much registration on the default layer.
+Right now the default implementation in Zope3 has different restrictions in the
+traversal concept and use to many registrations on the default layer.
 
 
 IMinimalBrowserLayer
 --------------------
 
 The minimal layer is useful for build custom presentation skins without access 
-to ZMI menus like zmi_views etc. This means there is no menu item registred if 
+to ZMI menus like zmi_views etc. This means there is no menu item registered if 
 you use this layer.
 
 This layer is NOT derived from IDefaultBrowserLayer. Therefore it provides 

Modified: z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/__init__.py
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/__init__.py	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/__init__.py	2010-04-18 00:39:41 UTC (rev 111025)
@@ -44,7 +44,7 @@
         context = self.context
         request = self.request
         for name in self.macro_pages:
-            page = zope.component.getMultiAdapter((context, request), 
+            page = zope.component.getMultiAdapter((context, request),
                 name=name)
             try:
                 v = page[key]
@@ -76,4 +76,12 @@
 
     def __call__(self):
         raise Exception('simply system error')
-        return u''
\ No newline at end of file
+        return u''
+
+
+class ContainerContentsPage(BrowserPage):
+    """Contents of a container."""
+
+    def __call__(self):
+        return str([type(x) for x in self.context.values()])
+

Added: z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/bugfixes.txt
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/bugfixes.txt	                        (rev 0)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/bugfixes.txt	2010-04-18 00:39:41 UTC (rev 111025)
@@ -0,0 +1,27 @@
+==========
+ Bugfixes
+==========
+
+Traversed objects where not security proxied
+============================================
+
+When an object got traversed its security proxy was removed, so its
+sub-objects could be publically accessed. To show that this behavior
+was fixed we put a folder into the root folder and look at its
+contents using a view:
+
+  >>> import zope.app.folder
+  >>> getRootFolder()['test'] = zope.app.folder.Folder()
+
+  >>> from zope.testbrowser.testing import Browser
+  >>> manager = Browser()
+  >>> manager.addHeader('Authorization', 'Basic mgr:mgrpw')
+  >>> skinURL = 'http://localhost/++skin++MinimalTesting'
+  >>> manager.open(skinURL + '/container_contents.html')
+
+The view displays the types of the content objects inside the root
+folder. The content objects are security proxied:
+
+  >>> print manager.contents
+  [<type 'zope.security._proxy._Proxy'>]
+

Modified: z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/ftesting.zcml
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/ftesting.zcml	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/ftesting.zcml	2010-04-18 00:39:41 UTC (rev 111025)
@@ -128,5 +128,13 @@
       layer="z3c.layer.minimal.IMinimalBrowserLayer"
       class=".SystemErrorPage"
       />
+  <browser:page
+      for="*"
+      name="container_contents.html"
+      permission="zope.View"
+      layer="z3c.layer.minimal.IMinimalBrowserLayer"
+      class=".ContainerContentsPage"
+      />
 
+
 </configure>

Modified: z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/test_layer.py
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/test_layer.py	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/tests/test_layer.py	2010-04-18 00:39:41 UTC (rev 111025)
@@ -1,6 +1,6 @@
 ##############################################################################
 #
-# Copyright (c) 2005 Zope Foundation and Contributors.
+# Copyright (c) 2007-2010 Zope Foundation and Contributors.
 # All Rights Reserved.
 #
 # This software is subject to the provisions of the Zope Public License,
@@ -19,22 +19,28 @@
 from zope.testing import renormalizing
 from zope.app.testing import functional
 
+
 functional.defineLayer('TestLayer', 'ftesting.zcml')
 
 
+checker = renormalizing.RENormalizing([
+    (re.compile(r'httperror_seek_wrapper:', re.M), 'HTTPError:'),
+    ])
+
+
+def create_suite(*args, **kw):
+    suite = functional.FunctionalDocFileSuite(*args, **kw)
+    suite.layer = TestLayer
+    return suite
+
+
 def test_suite():
     suite = unittest.TestSuite()
+    suite.addTest(create_suite('../README.txt', checker=checker))
+    suite.addTest(create_suite('bugfixes.txt'))
+    return suite
 
-    s = functional.FunctionalDocFileSuite(
-        '../README.txt',
-        checker = renormalizing.RENormalizing([
-            (re.compile(r'httperror_seek_wrapper:', re.M), 'HTTPError:'),
-            ])
-        )
-    s.layer = TestLayer
-    suite.addTest(s)
 
-    return suite
-
 if __name__ == '__main__':
     unittest.main(defaultTest='test_suite')
+

Modified: z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.app.publication.zcml
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.app.publication.zcml	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.app.publication.zcml	2010-04-18 00:39:41 UTC (rev 111025)
@@ -1,14 +1,14 @@
 <configure
     xmlns="http://namespaces.zope.org/zope"
-    xmlns:browser="http://namespaces.zope.org/browser"
     i18n_domain="z3c">
 
-  <browser:view
+  <view
       for="zope.app.publication.interfaces.IFileContent"
+      type="z3c.layer.minimal.IMinimalBrowserLayer"
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
-      class="zope.app.publication.traversers.FileContentTraverser"
+      factory="zope.app.publication.traversers.FileContentTraverser"
       permission="zope.Public"
-      layer="z3c.layer.minimal.IMinimalBrowserLayer"
+      allowed_interface="zope.publisher.interfaces.browser.IBrowserPublisher"
       />
 
 </configure>

Modified: z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.traversing.browser.zcml
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.traversing.browser.zcml	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/minimal/zope.traversing.browser.zcml	2010-04-18 00:39:41 UTC (rev 111025)
@@ -9,7 +9,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.publication.traversers.SimpleComponentTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <adapter
@@ -18,7 +17,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.container.traversal.ItemTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <adapter
@@ -27,7 +25,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.container.traversal.ItemTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <view

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/README.txt
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/README.txt	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/README.txt	2010-04-18 00:39:41 UTC (rev 111025)
@@ -3,10 +3,10 @@
 ======
 
 This package contains the pagelet layer. This layer supports a correct set of
-component registration and can be used for inheritation in custom skins.
+component registration and can be used for inheritance in custom skins.
 
-Right now the default implementation in Zope3 has different restriction in the
-traversal concept and use to much registration on the default layer.
+Right now the default implementation in Zope3 has different restrictions in the
+traversal concept and uses to many registrations on the default layer.
 
 Important
 ---------
@@ -52,10 +52,10 @@
 
   >>> manager = Browser()
   >>> manager.addHeader('Authorization', 'Basic mgr:mgrpw')
-  >>> skinURL = 'http://localhost/++skin++MinimalTesting'
+  >>> skinURL = 'http://localhost/++skin++PageletTestSkin'
   >>> manager.open(skinURL + '/page.html')
   >>> manager.url
-  'http://localhost/++skin++MinimalTesting/page.html'
+  'http://localhost/++skin++PageletTestSkin/page.html'
 
   >>> print manager.contents
   <!DOCTYPE...

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/browser/__init__.py
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/browser/__init__.py	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/browser/__init__.py	2010-04-18 00:39:41 UTC (rev 111025)
@@ -21,7 +21,7 @@
 from zope.app.exception.browser.user import UserErrorView
 from zope.app.exception.browser.notfound import NotFound
 from zope.app import zapi
-from z3c.template.interfaces import IPageTemplate
+from z3c.template.interfaces import IContentTemplate
 from z3c.pagelet import browser
 
 
@@ -36,7 +36,7 @@
         # Set the error status to 403 (Forbidden) in the case when we don't
         # challenge the user
         self.request.response.setStatus(403)
-        
+
         # make sure that squid does not keep the response in the cache
         self.request.response.setHeader(
             'Expires', 'Mon, 26 Jul 1997 05:00:00 GMT')
@@ -48,11 +48,11 @@
         auth = zapi.principals()
         auth.unauthorized(principal.id, self.request)
         if self.request.response.getStatus() not in (302, 303):
-            template = zope.component.getMultiAdapter((self, self.request), 
-                IPageTemplate)
+            template = zope.component.getMultiAdapter((self, self.request),
+                IContentTemplate)
             return template(self)
-        
 
+
 class UserErrorPagelet(browser.BrowserPagelet, UserErrorView):
     """UserError pagelet."""
 
@@ -62,6 +62,6 @@
 
     def render(self):
         self.request.response.setStatus(404)
-        template = zope.component.getMultiAdapter((self, self.request), 
-            IPageTemplate)
+        template = zope.component.getMultiAdapter((self, self.request),
+            IContentTemplate)
         return template(self)

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/__init__.py
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/__init__.py	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/__init__.py	2010-04-18 00:39:41 UTC (rev 111025)
@@ -25,7 +25,7 @@
 import z3c.layer.pagelet
 
 
-class IPageletBrowserTestingSkin(z3c.layer.pagelet.IPageletBrowserLayer):
+class IPageletBrowserTestSkin(z3c.layer.pagelet.IPageletBrowserLayer):
     """The IJSABrowser testing skin."""
 
 
@@ -54,4 +54,12 @@
 
     def __call__(self):
         raise Exception('simply system error')
-        return u''
\ No newline at end of file
+        return u''
+
+
+class ContainerContentsPage(BrowserPage):
+    """Contents of a container."""
+
+    def __call__(self):
+        return str([type(x) for x in self.context.values()])
+

Added: z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/bugfixes.txt
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/bugfixes.txt	                        (rev 0)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/bugfixes.txt	2010-04-18 00:39:41 UTC (rev 111025)
@@ -0,0 +1,27 @@
+==========
+ Bugfixes
+==========
+
+Traversed objects where not security proxied
+============================================
+
+When an object got traversed its security proxy was removed, so its
+sub-objects could be publically accessed. To show that this behavior
+was fixed we put a folder into the root folder and look at its
+contents using a view:
+
+  >>> import zope.app.folder
+  >>> getRootFolder()['test'] = zope.app.folder.Folder()
+
+  >>> from zope.testbrowser.testing import Browser
+  >>> manager = Browser()
+  >>> manager.addHeader('Authorization', 'Basic mgr:mgrpw')
+  >>> skinURL = 'http://localhost/++skin++PageletTestSkin'
+  >>> manager.open(skinURL + '/container_contents.html')
+
+The view displays the types of the content objects inside the root
+folder. The content objects are security proxied:
+
+  >>> print manager.contents
+  [<type 'zope.security._proxy._Proxy'>]
+

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/ftesting.zcml
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/ftesting.zcml	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/ftesting.zcml	2010-04-18 00:39:41 UTC (rev 111025)
@@ -52,6 +52,7 @@
   <grantAll role="zope.Manager" />
 
   <include package="zope.app.form.browser" />
+  <include package="zope.app.folder" />
   <include package="zope.app.http.exception" />
   <include package="zope.app.publication" />
   <include package="zope.app.publisher.browser" />
@@ -66,9 +67,9 @@
   <include package="z3c.layer.pagelet" />
 
   <interface
-      interface="z3c.layer.pagelet.tests.IPageletBrowserTestingSkin"
+      interface="z3c.layer.pagelet.tests.IPageletBrowserTestSkin"
       type="zope.publisher.interfaces.browser.IBrowserSkinType"
-      name="MinimalTesting"
+      name="PageletTestSkin"
       />
 
   <z3c:layout
@@ -115,4 +116,13 @@
       class=".SystemErrorPage"
       />
 
+  <browser:page
+      for="*"
+      name="container_contents.html"
+      permission="zope.View"
+      layer="z3c.layer.pagelet.IPageletBrowserLayer"
+      class=".ContainerContentsPage"
+      />
+
+
 </configure>

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/test_layer.py
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/test_layer.py	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/tests/test_layer.py	2010-04-18 00:39:41 UTC (rev 111025)
@@ -1,39 +1,46 @@
-##############################################################################
-#
-# Copyright (c) 2007 Zope Foundation and Contributors.
-# All Rights Reserved.
-#
-# This software is subject to the provisions of the Zope Public License,
-# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
-# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
-# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
-# FOR A PARTICULAR PURPOSE.
-#
-##############################################################################
-"""
-$Id: __init__.py 97 2007-03-29 22:58:27Z rineichen $
-"""
-import re
-import unittest
-from zope.testing import renormalizing
-from zope.app.testing import functional
-
-functional.defineLayer('TestLayer', 'ftesting.zcml')
-
-
-def test_suite():
-    suite = unittest.TestSuite()
-    s = functional.FunctionalDocFileSuite(
-        '../README.txt',
-        checker = renormalizing.RENormalizing([
-            (re.compile(r'httperror_seek_wrapper:', re.M), 'HTTPError:'),
-            ])
-        )
-    s.layer = TestLayer
-    suite.addTest(s)
-
-    return suite
-
-if __name__ == '__main__':
-    unittest.main(defaultTest='test_suite')
+##############################################################################
+#
+# Copyright (c) 2007-2010 Zope Foundation and Contributors.
+# All Rights Reserved.
+#
+# This software is subject to the provisions of the Zope Public License,
+# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
+# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
+# FOR A PARTICULAR PURPOSE.
+#
+##############################################################################
+"""
+$Id: test_layer.py 111023 2010-04-17 23:31:18Z ccomb $
+"""
+import re
+import unittest
+from zope.testing import renormalizing
+from zope.app.testing import functional
+
+
+functional.defineLayer('TestLayer', 'ftesting.zcml')
+
+
+checker = renormalizing.RENormalizing([
+    (re.compile(r'httperror_seek_wrapper:', re.M), 'HTTPError:'),
+    ])
+
+
+def create_suite(*args, **kw):
+    suite = functional.FunctionalDocFileSuite(*args, **kw)
+    suite.layer = TestLayer
+    return suite
+
+
+def test_suite():
+    suite = unittest.TestSuite()
+    suite.addTest(create_suite('../README.txt', checker=checker))
+    suite.addTest(create_suite('bugfixes.txt'))
+    return suite
+
+
+if __name__ == '__main__':
+    unittest.main(defaultTest='test_suite')
+

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.app.publication.zcml
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.app.publication.zcml	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.app.publication.zcml	2010-04-18 00:39:41 UTC (rev 111025)
@@ -1,14 +1,14 @@
 <configure
     xmlns="http://namespaces.zope.org/zope"
-    xmlns:browser="http://namespaces.zope.org/browser"
     i18n_domain="z3c">
 
-  <browser:view
+  <view
       for="zope.app.publication.interfaces.IFileContent"
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
-      class="zope.app.publication.traversers.FileContentTraverser"
+      factory="zope.app.publication.traversers.FileContentTraverser"
+      type="z3c.layer.pagelet.IPageletBrowserLayer"
       permission="zope.Public"
-      layer="z3c.layer.pagelet.IPageletBrowserLayer"
+      allowed_interface="zope.publisher.interfaces.browser.IBrowserPublisher"
       />
 
 </configure>

Modified: z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.traversing.browser.zcml
===================================================================
--- z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.traversing.browser.zcml	2010-04-18 00:00:50 UTC (rev 111024)
+++ z3c.layer/branches/0.2/src/z3c/layer/pagelet/zope.traversing.browser.zcml	2010-04-18 00:39:41 UTC (rev 111025)
@@ -9,7 +9,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.publication.traversers.SimpleComponentTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <adapter
@@ -18,7 +17,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.container.traversal.ItemTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <adapter
@@ -27,7 +25,6 @@
       provides="zope.publisher.interfaces.browser.IBrowserPublisher"
       factory="zope.app.container.traversal.ItemTraverser"
       permission="zope.Public"
-      trusted="True"
       />
 
   <view



More information about the checkins mailing list