[z3-checkins] r5758 - in z3/Five/branch/dc-experiments: . tests tests/products/FiveTest

[dreamcatcher at codespeak.net]

Author: dreamcatcher
Date: Wed Jul 28 21:10:50 2004
New Revision: 5758

Modified:
   z3/Five/branch/dc-experiments/browserconfigure.py
   z3/Five/branch/dc-experiments/tests/products/FiveTest/configure.zcml
   z3/Five/branch/dc-experiments/tests/test_security2.py
   z3/Five/branch/dc-experiments/traversable.py
Log:
Add a test for protecting (allowing?) a method on a View. The method is protected by the same permission as the view.

Modified: z3/Five/branch/dc-experiments/browserconfigure.py
==============================================================================
--- z3/Five/branch/dc-experiments/browserconfigure.py	(original)
+++ z3/Five/branch/dc-experiments/browserconfigure.py	Wed Jul 28 21:10:50 2004
@@ -30,7 +30,7 @@
 from resource import DirectoryResourceFactory
 from api import BrowserView
 from metaclass import makeClass
-from security import getSecurityInfo, protectClass, initializeClass
+from security import getSecurityInfo, protectClass, protectName, initializeClass
 from Products.PageTemplates.Expressions import SecureModuleImporter
 
 def page(_context, name, permission, for_,
@@ -46,6 +46,11 @@
 
     if not (class_ or template):
         raise ConfigurationError("Must specify a class or template")
+    if allowed_attributes is None:
+        allowed_attributes = []
+    if allowed_interface is not None:
+        attrs = [n for n, d in interface.namesAndDescriptions(1)]
+        allowed_attributes.extend(attrs)
 
     if attribute != '__call__':
         if template:
@@ -117,6 +122,13 @@
         callable = protectClass,
         args = (new_class, permission)
         )
+    if allowed_attributes:
+        for attr in allowed_attributes:
+            _context.action(
+                discriminator = ('five:protectName', new_class, attr),
+                callable = protectName,
+                args = (new_class, attr, permission)
+                )
     _context.action(
         discriminator = ('five:initialize:class', new_class),
         callable = initializeClass,

Modified: z3/Five/branch/dc-experiments/tests/products/FiveTest/configure.zcml
==============================================================================
--- z3/Five/branch/dc-experiments/tests/products/FiveTest/configure.zcml	(original)
+++ z3/Five/branch/dc-experiments/tests/products/FiveTest/configure.zcml	Wed Jul 28 21:10:50 2004
@@ -31,6 +31,14 @@
       />
 
   <browser:page
+      for=".interfaces.ISimpleContent"
+      class=".browser.SimpleContentView"
+      name="eagle.method"
+      permission="zope2.ViewManagementScreens"
+      allowed_attributes="eagle"
+      />
+
+  <browser:page
       for=".interfaces.IFancyContent"
       class=".browser.FancyContentView"
       attribute="view"

Modified: z3/Five/branch/dc-experiments/tests/test_security2.py
==============================================================================
--- z3/Five/branch/dc-experiments/tests/test_security2.py	(original)
+++ z3/Five/branch/dc-experiments/tests/test_security2.py	Wed Jul 28 21:10:50 2004
@@ -135,6 +135,11 @@
             self.check(
                 'context.restrictedTraverse("testoid/%s")()' % view_name)
 
+    def test_view_method_permission(self):
+        self.login('manager')
+        self.check(
+            'context.restrictedTraverse("testoid/eagle.method").eagle()')
+
 class PublishTestCase(Functional, ZopeTestCase.ZopeTestCase):
     """A functional test for security actually involving the publisher.
     """

Modified: z3/Five/branch/dc-experiments/traversable.py
==============================================================================
--- z3/Five/branch/dc-experiments/traversable.py	(original)
+++ z3/Five/branch/dc-experiments/traversable.py	Wed Jul 28 21:10:50 2004
@@ -55,7 +55,10 @@
         by using an ITraverser adapter.
         """
         if not IBrowserRequest.providedBy(REQUEST):
-            REQUEST = FakeRequest()
+            # Try to get the REQUEST by acquisition
+            REQUEST = getattr(self, 'REQUEST', None)
+            if not IBrowserRequest.providedBy(REQUEST):
+                REQUEST = FakeRequest()
         try:
             kw = dict(path=[name], request=REQUEST)
             return ITraverser(self).traverse(**kw).__of__(self)