Hi all again,

We have been written last week about some attribute permission problems with Zope 2.7.3 beta due to a patch applied by Tres.

First of all, Tres, apologies for my too fast written test case and my too late test of Zope 2.7.3. Now, with some more time, I've tested and debugged on Zope 2.7.3 and found exactly what's happen.

Supose we have a structure of objects like this: A.__of__(B)
"A" inherits from Acquisition.Implicit, has security assertions, but has not __allow_access_to_unprotected_subojects__
We want to access, from a Zope Page Template, an attribute of "B" that is not present in "A"
Accessing B.our_attribute attribute works fine. But accessing A.__of__(B).our_attribute fails, and should work.

The problem is the call to "validate" done in "guarded_getattr" method of ImplPython.py. The actual call is "if validate(inst, inst, name, v)", but the validate function says:

       accessed -- the object that was being accessed
       container -- the object the value was found in
       name -- The name used to access the value
       value -- The value retrieved though the access.
       roles -- The roles of the object if already known.

Now, "accessed" and "container" are always the same, and in some cases should be different. I attach a patch to solve this case that works for me. I'm not sure if my code is the best way to solve the problem but, as I said, it seems to work fine.

Of course, If the patch is accepted, the same change should be done in the C version.


Santi Camps

--- ImplPython.py       2004-08-07 19:15:48.000000000 +0200
+++ /usr/local/zope273/lib/python/AccessControl/ImplPython.py   2004-10-29 
10:56:11.000000000 +0200
@@ -534,6 +534,12 @@
         # exceptions are caught early.
             v = getattr(inst, name)
+            container = inst
+            while hasattr(container,'aq_explicit') and \
+                  not(hasattr(container.aq_explicit, name)) and \
+                  hasattr(container, 'aq_parent'):
+                # Find real container when attribute is acquired
+                container = container.aq_parent
         except AttributeError:
             if default is not _marker:
                 return default
@@ -551,6 +557,6 @@
             return v
         validate = SecurityManagement.getSecurityManager().validate
-        if validate(inst, inst, name, v):
+        if validate(inst, container, name, v):
             return v
     raise Unauthorized, name
Zope-Dev maillist  -  [EMAIL PROTECTED]
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope )

Reply via email to