>>> In my understanding this is the expected behavior. >>> >>> SecureObject just secures that one object, but if you want to secure >>> the whole controller class you should make it subclass SecureResource. >>> >>> This is all documented here: >>> >>> http://docs.turbogears.org/1.0/UsingIdentity#protecting-resources >> >> I'm not saying I understand everything around this topic, but Florent >> has just increased the priority of this ticket to highest and severity >> to major which made me think that this behaviour is not intended. >> >> Anyway, I'll try using SecureResource in the meantime. > > Well at least the docs around catwalk are unclear and could lead > people to this situation, but Mark is right... SecureResource is the > way to go for your use case. > > Florent.
Mark, Florent, it turns out identity.SecureResource doesn't cascade down to subcontrollers either. This contradicts the docs on the point Mark mentioned too, i.e. """ Protecting a Controller To restrict access to an entire controller (i.e. a whole URL subtree), add identity.SecureResource to the base classes of your Controller and add a require attribute at the class level: """ I added identity.SecureResource to the base class of CatWalk, but the URL /admin/browse/?object_name=mytable is still accessible and the access restriction is only applied to /admin itself. (Assuming that I have "mounted" the catwalk controller as admin. I've updated the ticket. Cheers, Daniel -- Psss, psss, put it down! - http://www.cafepress.com/putitdown --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
