George Lee wrote at 2005-11-19 00:46 -0500:
>In CMFCore 1.5.4:
>If a low-security-clearance user calls an external method that pastes
>an object from a PortalFolder, he gets an error because the following
>line in CMFCore.PortalFolder fails:
>if not sm.checkPermission(DeleteObjects, parent):
> raise AccessControl_Unauthorized
>This is even the case if "sm.checkPermission" is changed to
>"_checkPermission", which takes into account proxy roles. The external
>method does not allow proxy roles attached, so I can't just add a
>"Manager" proxy role.
>Because I called the pasting in an external method, I expected it to
>go through without security problems! Is this a right expectation /
>and a bug, or a wrong expectation?
It is the fate induced by explicit security checks.
It will get much worse when the Zope 3 security comes into
Zope 2 land: then even trusted code will have to deal with
security proxied objects.
We currently work around the problem that trusted code
cannot have proxy roles with the following class:
def __init__(self, proxy_roles):
self._proxy_roles = tuple(proxy_roles)
def getOwner(self): return None
getWrappedOwner = getOwner
This class emulates an object with proxy roles and can be pushed
onto the "SecurityManager"s "context" stack like so:
sm = getSecurityManager()
context = ProxyContext(proxy_roles)
# do something with "proxy_roles"
Note, that I had to fix (in a local copy) CMF's "_checkPermission"
for this to work:
It had decided to emulate Zope's proxy role checking only
approximately -- incorrectly for a "None" owner.
My fix looks like this:
def _checkPermission(permission, obj):
""" Check if the current user has the permission on the given object.
# this code is ported from ZopeSecurityPolicy.checkPermission
roles = rolesForPermissionOn(permission, obj)
if isinstance(roles, basestring):
roles = [roles]
context = getSecurityManager()._context
# check executable owner and proxy roles
# this code is ported from ZopeSecurityPolicy.validate
stack = context.stack
eo = stack[-1]
owner = eo.getOwner()
if owner is not None:
if not owner.allowed(obj, roles):
# DM 2005-09-07: no reason to do it differently from Zope
# It accepts "proxy_roles" even for a None owner
## proxy_roles = getattr(eo, '_proxy_roles', None)
## if proxy_roles:
## if obj is not aq_base(obj):
## if not owner._check_context(obj):
## return 0
## for r in proxy_roles:
## if r in roles:
## return 1
## return 0
proxy_roles = getattr(eo, '_proxy_roles', None)
if obj is not aq_base(obj):
# DM 2005-09-07: do it as Zope does
#if not owner._check_context(obj):
if owner is not None and not owner._check_context(obj):
for r in proxy_roles:
if r in roles:
return context.user.allowed(obj, roles)
If you are interested in using this approach, you
should probably file another CMF bug report about the
wrong handling of proxy roles in "_checkPermission".
I explicitely allow you to attach the fix given above.
Zope maillist - Zope@zope.org
** No cross posts or HTML encoding! **
(Related lists -