> In my understanding this is the expected behavior. > > SecureObject just secures that one object, but if you want to secure > the whole controller class you should make it subclass SecureResource. > > This is all documented here: > > http://docs.turbogears.org/1.0/UsingIdentity#protecting-resources
I'm not saying I understand everything around this topic, but Florent has just increased the priority of this ticket to highest and severity to major which made me think that this behaviour is not intended. Anyway, I'll try using SecureResource in the meantime. Cheers, Daniel >>> If I have nested controllers like so: >>> >>> class A1( RootController ): >>> A2 = identity.SecureObject( A2, identity.in_group( 'test' ) ) >>> >>> class A2( Controller ): >>> @expose( ) >>> def meth2( self ): return dict( ) >>> A3 = A3( ) >>> >>> class A3( Controller ): >>> @expose( ) >>> def meth3( self ): return dict( ) >>> >>> then access to /A1/A2/meth2 is limited, as expected, by the >>> identity.SecureObject construction. But if I access /A1/A2/A3/meth3 >>> there is no access limitation! I would have thought that if there is >>> identity involved anywhere in the object dispatch chain access will be >>> limited accordingly. Is it a feature or a bug? >>> >>> I'm using tg 1.1b3 >> >> >> Submitted a ticket on this: >> >> http://trac.turbogears.org/ticket/2207 >> >> Cheers, >> Daniel >> >> -- >> Psss, psss, put it down! - http://www.cafepress.com/putitdown >> >> > >> > > > > -- > Mark Ramm-Christensen > email: mark at compoundthinking dot com > blog: www.compoundthinking.com/blog > > > > -- Psss, psss, put it down! - http://www.cafepress.com/putitdown --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
