In my understanding this is the expected behavior. SecureObject just secures that one object, but if you want to secure the whole controller class you should make it subclass SecureResource.
This is all documented here: http://docs.turbogears.org/1.0/UsingIdentity#protecting-resources On Fri, Feb 13, 2009 at 2:15 PM, Daniel Fetchinson <[email protected]> wrote: > >> If I have nested controllers like so: >> >> class A1( RootController ): >> A2 = identity.SecureObject( A2, identity.in_group( 'test' ) ) >> >> class A2( Controller ): >> @expose( ) >> def meth2( self ): return dict( ) >> A3 = A3( ) >> >> class A3( Controller ): >> @expose( ) >> def meth3( self ): return dict( ) >> >> then access to /A1/A2/meth2 is limited, as expected, by the >> identity.SecureObject construction. But if I access /A1/A2/A3/meth3 >> there is no access limitation! I would have thought that if there is >> identity involved anywhere in the object dispatch chain access will be >> limited accordingly. Is it a feature or a bug? >> >> I'm using tg 1.1b3 > > > Submitted a ticket on this: > > http://trac.turbogears.org/ticket/2207 > > Cheers, > Daniel > > -- > Psss, psss, put it down! - http://www.cafepress.com/putitdown > > > > -- Mark Ramm-Christensen email: mark at compoundthinking dot com blog: www.compoundthinking.com/blog --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
