On Saturday February 21, 2009 13:20:12 Christoph Zwerschke wrote:
> If it's only a session cookie then it's not so serious a problem.
>
> It may still be better to have the not_anonymous predicate do
>
> if not credentials or credentials.get('repoze.what.userid') is None
>
> instead of only
>
> if not credentials
Checking whether the user really is authenticated (and "authenticated" means
that the user account really exists and the user provided the right
credentials on login) is a task specific to the authentication framework, not
to the authorization framework. If the authentication framework says the
current user is authenticated, the authorization framework must not question
that -- that's out of its scope.
In repoze.what v1, when the user is authenticated, the credentials dict is set
along with its 'repoze.what.userid' key, so the following lines are exactly
the same thing:
if not credentials or credentials.get('repoze.what.userid') is None
if not credentials
But as you said, it's no big deal because it's just a session cookie. But if
this really bothers you, use the following repoze.who metadata provider (must
be passed as the last MD provider to repoze.who):
# I've not tested this, but theoretically it will work as you'd expect
from zope.interface import implements
from repoze.who.interfaces import IMetadataProvider
from paste.httpexceptions import NotAuthorized
class UserStillExists(object):
implements(IMetadataProvider)
def add_metadata(self, environ, identity):
if identity.get('user') is None:
raise NotAuthorized()
But given that deleting an user is not something usual and that the MD
provider above would get executed on *each* request (unless initially the user
is anonymous), I think it causes more trouble than it solves.
Cheers.
--
Gustavo Narea <http://gustavonarea.net/>.
Get rid of unethical constraints! Get freedomware:
http://www.getgnulinux.org/
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
