Re: [Zope3-dev] security problems with database adapters (second edition)

2005-08-31 Thread Dmitry Vasiliev
Velko Ivanov wrote: Dmitry Vasiliev wrote: Maybe we need always check security map at the root folder? I don't believe this is the solution. Altrough it will solve my example, it wouldn't help in other scenarios. I would eventually make ZopeConnection and ZopeCursor locatable, if they

Re: [Zope3-dev] security problems with database adapters (second edition)

2005-08-30 Thread Dmitry Vasiliev
Velko Ivanov wrote: The problem is easy to reproduce in a few simple steps - assuming clean installation from the .tgz release, here is what I do: 1. create an instance (of course), zope.Manager granted principal is crated by the mkzopeinstance script. 2. uncomment the sample zope.Member

Re: [Zope3-dev] security problems with database adapters (second edition)

2005-08-29 Thread Dmitry Vasiliev
Velko Ivanov wrote: Hello, My problems on this subject didn't get resolved since my last post, but I have some new info and questions - The sympthoms (Zope 3.1.0c1): Database adapters are not usable by principals other than the zope.Manager, in the principals.zcml file. Any other principal

Re: [Zope3-dev] security problems with database adapters (second edition)

2005-08-29 Thread Velko Ivanov
I forgot to add cc: for the list, sorry Dmitry Vasiliev wrote: Looking at the code, the ZopeConnection object is created by the ZopeDatabaseAdapter class in zope.app.rdb (inherited by the actual DatabaseAdapter) with a simple call - self._v_connection =

Re: [Zope3-dev] security problems with database adapters (second edition)

2005-08-28 Thread Stephan Richter
On Friday 26 August 2005 11:51, Velko Ivanov wrote: My question is, does this eventually mean, that ZopeConnection objects, which are created at run-time, are not security proxied and consequently unauthorized in all cases (except the system_user) and if yes, what should be done? I'm not