So, here's a tricky one.
In BaseRequest.traverse(), when invalid credentials are supplied, the
validation will return the special 'Anonymous User' and proceed. Later
in the game, if the 'current user' (in this case 'Anonymous User') is
not allowed to access something, an 'Unauthorized' exception is
Mark Hammond has been arguing me for hours now, and has convinced me
that this is wrong. Why?
- If you want to access a anonymous page, you will *not* be sending
- If you *are* supplying credentials, they must either be *valid* or
*invalid*. Falling back to 'Anonymous User' just hides the fact that
you have provided wrong credentials.
- Falling back to 'Anonymous User' will eventually fail down the path,
unless, by luck, everything you need to access in that request is
accessible to the 'Anonymous User'. It might fail quite deep inside
Zope, thus possibly masking the real issue.
- Anyone sending wrong credentials and *expecting* that Zope will
fallback to 'Anonymous User' knows and is actively abusing
- Falling back to 'Anonymous User' and proceeding might also consume
more resources than it really should in this case.
In any case, if someone is depending on this behaviour, he has a
broken application that must be fixed.
The patch (attached) is very short and simple, and I can't think of a
single reasonable, sane case that would break with this change.
If no-one has a real reason for not checkin this in, I would like to
make the change in Zope 2.7 and trunk as IMO it's a bug.
Sidnei da Silva <[EMAIL PROTECTED]>
http://awkly.org - dreamcatching :: making your dreams come true
<glyph> we need PB for C#
* moshez squishes glyph
<moshez> glyph: squishy insane person
RCS file: /cvs-repository/Packages/ZPublisher/Attic/BaseRequest.py,v
retrieving revision 220.127.116.11
diff -u -r18.104.22.168 BaseRequest.py
--- lib/python/ZPublisher/BaseRequest.py 2 Dec 2004 16:49:28 -0000
+++ lib/python/ZPublisher/BaseRequest.py 20 Apr 2005 02:14:19 -0000
@@ -387,7 +387,7 @@
request['PUBLISHED'] = parents.pop(0)
# Do authorization checks
if 1: # Always perform authentication.
@@ -452,6 +452,12 @@
if validated_hook is not None: validated_hook(self, user)
+ if auth is not None:
+ from AccessControl.User import nobody
+ from Acquisition import aq_base
+ if aq_base(user) is nobody:
# Remove http request method from the URL.
Zope-Coders mailing list