• Vincent Pelletier's avatar
    ERP5Security.ERP5UserLoginManager: Special-case user_id='System Processes' · 17d3df41
    Vincent Pelletier authored
    Because of ERP5Type.UnrestrictedMethod, 'System Processes' can own objects.
    Such objects can be proxy-role'd scripts, and proxy-role mechanism
    triggers many users look-ups (each time security is evaluated, which is
    virtually every getattr). Each such lookup will do a query for 'System
    Processes' user, which will (hopefully) find nothing anyway.
    So special-case 'System Processes' when looking by user_id by skipping
    the search altogether (enforcing the inability to locate this user,
    consistently with Zope assumptions, and consistently with previous
    behaviour).
    17d3df41
ERP5LoginUserManager.py 11.2 KB