As I wrote before, I need to secure the whole application. At least
make everything not accessible by an anonymous.
Gustavo helped me a lot in understanding repoze.what and securing the
root controller, but I need to make some kind of default policy for
the subcontrollers.
I decided to try to modify my subcontrollers' base class,
RestController, like this:
from repoze.what.predicates import not_anonymous
from tg import allow_only
from tg.controllers import RestController
RestController = allow_only(not_anonymous())(RestController)
Then my subcontrollers get subclassed from this modified
RestController. I works great for the first-level subcontrollers, that
are plugged into my root controller, so, for example, /customers/ get
protected (/customers/ is served by a CustomersConrtoller's get_all
method), but, for example, /customers/contracts/ (or /customers/<id>/
contracts/) is *not* secured, and access is granted to an anonymous:
22:53:45,303 INFO [auth] no challenge required
22:53:45,303 INFO [auth] -- repoze.who request ended (/customers/13/
contracts/) --
What am I doing wrong? :)
--
Sergei
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
