[Checkins] SVN: AccessControl/branches/2.13/ Merge r127999, r128000 from trunk

[Hano Schlichting]

Log message for revision 128001:
  Merge r127999,r128000 from trunk
  

Changed:
  U   AccessControl/branches/2.13/CHANGES.txt
  U   AccessControl/branches/2.13/src/AccessControl/security.py

-=-
Modified: AccessControl/branches/2.13/CHANGES.txt
===================================================================
--- AccessControl/branches/2.13/CHANGES.txt	2012-10-14 13:17:13 UTC (rev 128000)
+++ AccessControl/branches/2.13/CHANGES.txt	2012-10-14 13:20:31 UTC (rev 128001)
@@ -4,6 +4,8 @@
 2.13.11 (unreleased)
 --------------------
 
+- LP #966101: Recognize special `zope2.Private` permission in ZCML
+  role directive.
 
 2.13.10 (2012-09-09)
 --------------------

Modified: AccessControl/branches/2.13/src/AccessControl/security.py
===================================================================
--- AccessControl/branches/2.13/src/AccessControl/security.py	2012-10-14 13:17:13 UTC (rev 128000)
+++ AccessControl/branches/2.13/src/AccessControl/security.py	2012-10-14 13:20:31 UTC (rev 128001)
@@ -167,28 +167,33 @@
         perm = str(permission.title)
         security.declareObjectProtected(perm)
 
+
 class PermissionDirective(GroupingContextDecorator):
     implements(IConfigurationContext, IPermissionDirective)
-    
+
     def __init__(self, context, id, title, description=''):
         self.context = context
         self.id, self.title, self.description = id, title, description
         self.roles = []
-    
+
     def after(self):
         permission = Permission(self.id, self.title, self.description)
         utility(self.context, IPermission, permission, name=self.id)
-        
+
         zope2_permission = str(self.title)
         if self.roles:
             addPermission(zope2_permission, default_roles=tuple(self.roles))
+        elif self.id == CheckerPrivateId:
+            addPermission(zope2_permission, default_roles=())
         else:
             addPermission(zope2_permission)
 
+
 class IRoleDirective(Interface):
-    
+
     name = ASCIILine()
 
+
 def RoleDirective(context, name):
     permission_directive = context.context
     if name not in permission_directive.roles: