Skip to content

Z
Zope
Commit 41049f78 authored by Florent Guillaume's avatar Florent Guillaume
Browse files
Options

Use new-style security declarations everywhere possible. This means 

remove the use of __ac_permissions__, foo__roles__ and
default__class_init__. A few corner cases can't be converted because of
circular imports.
parent 02edbfa0
Hide whitespace changes
Inline Side-by-side
Showing with 909 additions and 578 deletions
doc/CHANGES.txt
View file @ 41049f78
...@@ -26,6 +26,11 @@ Zope Changes ...@@ -26,6 +26,11 @@ Zope Changes
Features added Features added
- Use new-style security declarations everywhere possible. This
means remove the use of __ac_permissions__, foo__roles__ and
default__class_init__. A few corner cases can't be converted
because of circular imports.
- Fixed unclear security declarations. Warn when an attempt is - Fixed unclear security declarations. Warn when an attempt is
made to have a security declaration on a nonexistent method. made to have a security declaration on a nonexistent method.
......
lib/python/AccessControl/Owned.py
View file @ 41049f78
...@@ -16,7 +16,11 @@ $Id$ ...@@ -16,7 +16,11 @@ $Id$
""" """
import Globals, urlparse, SpecialUsers, ExtensionClass import Globals, urlparse, SpecialUsers, ExtensionClass
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager, Unauthorized from AccessControl import getSecurityManager, Unauthorized
from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import take_ownership
from Acquisition import aq_get, aq_parent, aq_base from Acquisition import aq_get, aq_parent, aq_base
from zope.interface import implements from zope.interface import implements
...@@ -35,13 +39,8 @@ class Owned(ExtensionClass.Base): ...@@ -35,13 +39,8 @@ class Owned(ExtensionClass.Base):
implements(IOwned) implements(IOwned)
__ac_permissions__=( security = ClassSecurityInfo()
('View management screens', security.setPermissionDefault(take_ownership, ('Owner',))
('manage_owner', 'owner_info')),
('Take ownership',
('manage_takeOwnership','manage_changeOwnershipType'),
("Owner",)),
)
manage_options=({'label': 'Ownership', manage_options=({'label': 'Ownership',
'action': 'manage_owner', 'action': 'manage_owner',
...@@ -50,8 +49,10 @@ class Owned(ExtensionClass.Base): ...@@ -50,8 +49,10 @@ class Owned(ExtensionClass.Base):
}, },
) )
security.declareProtected(view_management_screens, 'manage_owner')
manage_owner=Globals.DTMLFile('dtml/owner', globals()) manage_owner=Globals.DTMLFile('dtml/owner', globals())
security.declareProtected(view_management_screens, 'owner_info')
def owner_info(self): def owner_info(self):
"""Get ownership info for display """Get ownership info for display
""" """
...@@ -67,7 +68,7 @@ class Owned(ExtensionClass.Base): ...@@ -67,7 +68,7 @@ class Owned(ExtensionClass.Base):
} }
return d return d
getOwner__roles__=() security.declarePrivate('getOwner')
def getOwner(self, info=0, def getOwner(self, info=0,
aq_get=aq_get, aq_get=aq_get,
UnownableOwner=UnownableOwner, UnownableOwner=UnownableOwner,
...@@ -101,7 +102,7 @@ class Owned(ExtensionClass.Base): ...@@ -101,7 +102,7 @@ class Owned(ExtensionClass.Base):
if user is None: user = SpecialUsers.nobody if user is None: user = SpecialUsers.nobody
return user return user
getOwnerTuple__roles__=() security.declarePrivate('getOwnerTuple')
def getOwnerTuple(self): def getOwnerTuple(self):
"""Return a tuple, (userdb_path, user_id) for the owner. """Return a tuple, (userdb_path, user_id) for the owner.
...@@ -111,7 +112,7 @@ class Owned(ExtensionClass.Base): ...@@ -111,7 +112,7 @@ class Owned(ExtensionClass.Base):
""" """
return aq_get(self, '_owner', None, 1) return aq_get(self, '_owner', None, 1)
getWrappedOwner__roles__=() security.declarePrivate('getWrappedOwner')
def getWrappedOwner(self): def getWrappedOwner(self):
"""Get the owner, modestly wrapped in the user folder. """Get the owner, modestly wrapped in the user folder.
...@@ -141,7 +142,7 @@ class Owned(ExtensionClass.Base): ...@@ -141,7 +142,7 @@ class Owned(ExtensionClass.Base):
return user.__of__(udb) return user.__of__(udb)
changeOwnership__roles__=() security.declarePrivate('changeOwnership')
def changeOwnership(self, user, recursive=0): def changeOwnership(self, user, recursive=0):
"""Change the ownership to the given user. """Change the ownership to the given user.
...@@ -174,6 +175,7 @@ class Owned(ExtensionClass.Base): ...@@ -174,6 +175,7 @@ class Owned(ExtensionClass.Base):
if owner == info: return 0 if owner == info: return 0
return security.checkPermission('Take ownership', self) return security.checkPermission('Take ownership', self)
security.declareProtected(take_ownership, 'manage_takeOwnership')
def manage_takeOwnership(self, REQUEST, RESPONSE, recursive=0): def manage_takeOwnership(self, REQUEST, RESPONSE, recursive=0):
"""Take ownership (responsibility) for an object. """Take ownership (responsibility) for an object.
...@@ -193,6 +195,7 @@ class Owned(ExtensionClass.Base): ...@@ -193,6 +195,7 @@ class Owned(ExtensionClass.Base):
RESPONSE.redirect(REQUEST['HTTP_REFERER']) RESPONSE.redirect(REQUEST['HTTP_REFERER'])
security.declareProtected(take_ownership, 'manage_changeOwnershipType')
def manage_changeOwnershipType(self, explicit=1, def manage_changeOwnershipType(self, explicit=1,
RESPONSE=None, REQUEST=None): RESPONSE=None, REQUEST=None):
"""Change the type (implicit or explicit) of ownership. """Change the type (implicit or explicit) of ownership.
...@@ -269,7 +272,7 @@ class Owned(ExtensionClass.Base): ...@@ -269,7 +272,7 @@ class Owned(ExtensionClass.Base):
except: pass except: pass
if s is None: object._p_deactivate() if s is None: object._p_deactivate()
Globals.default__class_init__(Owned) InitializeClass(Owned)
class EmergencyUserCannotOwn(Exception): class EmergencyUserCannotOwn(Exception):
......
lib/python/AccessControl/Role.py
View file @ 41049f78
...@@ -18,7 +18,10 @@ from cgi import escape ...@@ -18,7 +18,10 @@ from cgi import escape
from Globals import DTMLFile, MessageDialog, Dictionary from Globals import DTMLFile, MessageDialog, Dictionary
from Acquisition import Implicit, Acquired, aq_get from Acquisition import Implicit, Acquired, aq_get
import Globals, ExtensionClass, PermissionMapping, Products from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import change_permissions
import ExtensionClass, PermissionMapping, Products
from App.Common import aq_base from App.Common import aq_base
from zope.interface import implements from zope.interface import implements
...@@ -41,21 +44,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -41,21 +44,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
implements(IRoleManager) implements(IRoleManager)
__ac_permissions__=( security = ClassSecurityInfo()
('Change permissions',
('manage_access', 'permission_settings',
'ac_inherited_permissions',
'manage_roleForm', 'manage_role',
'manage_acquiredForm', 'manage_acquiredPermissions',
'manage_permissionForm', 'manage_permission',
'manage_changePermissions', 'permissionsOfRole',
'rolesOfPermission', 'acquiredRolesAreUsedBy',
'manage_defined_roles', 'userdefined_roles',
'manage_listLocalRoles', 'manage_editLocalRoles',
'manage_setLocalRoles', 'manage_addLocalRoles',
'manage_delLocalRoles'
)),
)
manage_options=( manage_options=(
{'label':'Security', 'action':'manage_access', {'label':'Security', 'action':'manage_access',
...@@ -74,6 +63,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -74,6 +63,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
#------------------------------------------------------------ #------------------------------------------------------------
security.declareProtected(change_permissions, 'ac_inherited_permissions')
def ac_inherited_permissions(self, all=0): def ac_inherited_permissions(self, all=0):
# Get all permissions not defined in ourself that are inherited # Get all permissions not defined in ourself that are inherited
# This will be a sequence of tuples with a name as the first item and # This will be a sequence of tuples with a name as the first item and
...@@ -96,6 +86,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -96,6 +86,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
return tuple(r) return tuple(r)
security.declareProtected(change_permissions, 'permission_settings')
def permission_settings(self, permission=None): def permission_settings(self, permission=None):
"""Return user-role permission settings. """Return user-role permission settings.
...@@ -130,11 +121,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -130,11 +121,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
result.append(d) result.append(d)
return result return result
security.declareProtected(change_permissions, 'manage_roleForm')
manage_roleForm=DTMLFile('dtml/roleEdit', globals(), manage_roleForm=DTMLFile('dtml/roleEdit', globals(),
management_view='Security', management_view='Security',
help_topic='Security_Manage-Role.stx', help_topic='Security_Manage-Role.stx',
help_product='OFSP') help_product='OFSP')
security.declareProtected(change_permissions, 'manage_role')
def manage_role(self, role_to_manage, permissions=[], REQUEST=None): def manage_role(self, role_to_manage, permissions=[], REQUEST=None):
"""Change the permissions given to the given role. """Change the permissions given to the given role.
""" """
...@@ -146,11 +139,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -146,11 +139,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
if REQUEST is not None: return self.manage_access(REQUEST) if REQUEST is not None: return self.manage_access(REQUEST)
security.declareProtected(change_permissions, 'manage_acquiredForm')
manage_acquiredForm=DTMLFile('dtml/acquiredEdit', globals(), manage_acquiredForm=DTMLFile('dtml/acquiredEdit', globals(),
management_view='Security', management_view='Security',
help_topic='Security_Manage-Acquisition.stx', help_topic='Security_Manage-Acquisition.stx',
help_product='OFSP') help_product='OFSP')
security.declareProtected(change_permissions, 'manage_acquiredPermissions')
def manage_acquiredPermissions(self, permissions=[], REQUEST=None): def manage_acquiredPermissions(self, permissions=[], REQUEST=None):
"""Change the permissions that acquire. """Change the permissions that acquire.
""" """
...@@ -165,11 +160,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -165,11 +160,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
if REQUEST is not None: return self.manage_access(REQUEST) if REQUEST is not None: return self.manage_access(REQUEST)
security.declareProtected(change_permissions, 'manage_permissionForm')
manage_permissionForm=DTMLFile('dtml/permissionEdit', globals(), manage_permissionForm=DTMLFile('dtml/permissionEdit', globals(),
management_view='Security', management_view='Security',
help_topic='Security_Manage-Permission.stx', help_topic='Security_Manage-Permission.stx',
help_product='OFSP') help_product='OFSP')
security.declareProtected(change_permissions, 'manage_permission')
def manage_permission(self, permission_to_manage, def manage_permission(self, permission_to_manage,
roles=[], acquire=0, REQUEST=None): roles=[], acquire=0, REQUEST=None):
"""Change the settings for the given permission. """Change the settings for the given permission.
...@@ -197,6 +194,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -197,6 +194,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
_method_manage_access=DTMLFile('dtml/methodAccess', globals()) _method_manage_access=DTMLFile('dtml/methodAccess', globals())
security.declareProtected(change_permissions, 'manage_access')
def manage_access(self, REQUEST, **kw): def manage_access(self, REQUEST, **kw):
"""Return an interface for making permissions settings. """Return an interface for making permissions settings.
""" """
...@@ -206,6 +204,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -206,6 +204,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
else: else:
return apply(self._normal_manage_access,(), kw) return apply(self._normal_manage_access,(), kw)
security.declareProtected(change_permissions, 'manage_changePermissions')
def manage_changePermissions(self, REQUEST): def manage_changePermissions(self, REQUEST):
"""Change all permissions settings, called by management screen. """Change all permissions settings, called by management screen.
""" """
...@@ -237,6 +236,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -237,6 +236,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
message='Your changes have been saved', message='Your changes have been saved',
action ='manage_access') action ='manage_access')
security.declareProtected(change_permissions, 'permissionsOfRole')
def permissionsOfRole(self, role): def permissionsOfRole(self, role):
"""Used by management screen. """Used by management screen.
""" """
...@@ -250,6 +250,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -250,6 +250,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
}) })
return r return r
security.declareProtected(change_permissions, 'rolesOfPermission')
def rolesOfPermission(self, permission): def rolesOfPermission(self, permission):
"""Used by management screen. """Used by management screen.
""" """
...@@ -269,6 +270,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -269,6 +270,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
raise ValueError, ( raise ValueError, (
"The permission <em>%s</em> is invalid." % escape(permission)) "The permission <em>%s</em> is invalid." % escape(permission))
security.declareProtected(change_permissions, 'acquiredRolesAreUsedBy')
def acquiredRolesAreUsedBy(self, permission): def acquiredRolesAreUsedBy(self, permission):
"""Used by management screen. """Used by management screen.
""" """
...@@ -293,11 +295,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -293,11 +295,13 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
__ac_local_roles__=None __ac_local_roles__=None
security.declareProtected(change_permissions, 'manage_listLocalRoles')
manage_listLocalRoles=DTMLFile('dtml/listLocalRoles', globals(), manage_listLocalRoles=DTMLFile('dtml/listLocalRoles', globals(),
management_view='Security', management_view='Security',
help_topic='Security_Local-Roles.stx', help_topic='Security_Local-Roles.stx',
help_product='OFSP') help_product='OFSP')
security.declareProtected(change_permissions, 'manage_editLocalRoles')
manage_editLocalRoles=DTMLFile('dtml/editLocalRoles', globals(), manage_editLocalRoles=DTMLFile('dtml/editLocalRoles', globals(),
management_view='Security', management_view='Security',
help_topic='Security_User-Local-Roles.stx', help_topic='Security_User-Local-Roles.stx',
...@@ -353,6 +357,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -353,6 +357,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
dict=self.__ac_local_roles__ or {} dict=self.__ac_local_roles__ or {}
return tuple(dict.get(userid, [])) return tuple(dict.get(userid, []))
security.declareProtected(change_permissions, 'manage_addLocalRoles')
def manage_addLocalRoles(self, userid, roles, REQUEST=None): def manage_addLocalRoles(self, userid, roles, REQUEST=None):
"""Set local roles for a user.""" """Set local roles for a user."""
if not roles: if not roles:
...@@ -370,6 +375,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -370,6 +375,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
stat='Your changes have been saved.' stat='Your changes have been saved.'
return self.manage_listLocalRoles(self, REQUEST, stat=stat) return self.manage_listLocalRoles(self, REQUEST, stat=stat)
security.declareProtected(change_permissions, 'manage_setLocalRoles')
def manage_setLocalRoles(self, userid, roles, REQUEST=None): def manage_setLocalRoles(self, userid, roles, REQUEST=None):
"""Set local roles for a user.""" """Set local roles for a user."""
if not roles: if not roles:
...@@ -383,6 +389,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -383,6 +389,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
stat='Your changes have been saved.' stat='Your changes have been saved.'
return self.manage_listLocalRoles(self, REQUEST, stat=stat) return self.manage_listLocalRoles(self, REQUEST, stat=stat)
security.declareProtected(change_permissions, 'manage_delLocalRoles')
def manage_delLocalRoles(self, userids, REQUEST=None): def manage_delLocalRoles(self, userids, REQUEST=None):
"""Remove all local roles for a user.""" """Remove all local roles for a user."""
dict=self.__ac_local_roles__ dict=self.__ac_local_roles__
...@@ -398,7 +405,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -398,7 +405,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
#------------------------------------------------------------ #------------------------------------------------------------
access_debug_info__roles__=() security.declarePrivate('access_debug_info')
def access_debug_info(self): def access_debug_info(self):
"""Return debug info. """Return debug info.
""" """
...@@ -450,6 +457,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -450,6 +457,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
return 0 return 0
return 1 return 1
security.declareProtected(change_permissions, 'userdefined_roles')
def userdefined_roles(self): def userdefined_roles(self):
"""Return list of user-defined roles. """Return list of user-defined roles.
""" """
...@@ -459,6 +467,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -459,6 +467,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
except: pass except: pass
return tuple(roles) return tuple(roles)
security.declareProtected(change_permissions, 'manage_defined_roles')
def manage_defined_roles(self, submit=None, REQUEST=None): def manage_defined_roles(self, submit=None, REQUEST=None):
"""Called by management screen. """Called by management screen.
""" """
...@@ -534,7 +543,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager): ...@@ -534,7 +543,7 @@ class RoleManager(ExtensionClass.Base, PermissionMapping.RoleManager):
return d return d
Globals.default__class_init__(RoleManager) InitializeClass(RoleManager)
def reqattr(request, attr): def reqattr(request, attr):
......
lib/python/AccessControl/User.py
View file @ 41049f78
...@@ -20,10 +20,12 @@ import re ...@@ -20,10 +20,12 @@ import re
import socket import socket
from base64 import decodestring from base64 import decodestring
import Globals
from Acquisition import Implicit from Acquisition import Implicit
from App.Management import Navigation, Tabs from App.Management import Navigation, Tabs
from Globals import DTMLFile, MessageDialog, Persistent, PersistentMapping from Globals import DTMLFile, MessageDialog, Persistent, PersistentMapping
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import manage_users as ManageUsers
from OFS.SimpleItem import Item from OFS.SimpleItem import Item
from zExceptions import Unauthorized, BadRequest from zExceptions import Unauthorized, BadRequest
from zope.interface import implements from zope.interface import implements
...@@ -459,6 +461,8 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -459,6 +461,8 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
encrypt_passwords = 1 encrypt_passwords = 1
security = ClassSecurityInfo()
manage_options=( manage_options=(
( (
{'label':'Contents', 'action':'manage_main', {'label':'Contents', 'action':'manage_main',
...@@ -470,32 +474,26 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -470,32 +474,26 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
+Item.manage_options +Item.manage_options
) )
__ac_permissions__=(
('Manage users',
('manage_users','getUserNames', 'getUser', 'getUsers',
'getUserById', 'user_names', 'setDomainAuthenticationMode',
'userFolderAddUser', 'userFolderEditUser', 'userFolderDelUsers',
)
),
)
# ---------------------------------- # ----------------------------------
# Public UserFolder object interface # Public UserFolder object interface
# ---------------------------------- # ----------------------------------
security.declareProtected(ManageUsers, 'getUserNames')
def getUserNames(self): def getUserNames(self):
"""Return a list of usernames""" """Return a list of usernames"""
raise NotImplementedError raise NotImplementedError
security.declareProtected(ManageUsers, 'getUsers')
def getUsers(self): def getUsers(self):
"""Return a list of user objects""" """Return a list of user objects"""
raise NotImplementedError raise NotImplementedError
security.declareProtected(ManageUsers, 'getUser')
def getUser(self, name): def getUser(self, name):
"""Return the named user object or None""" """Return the named user object or None"""
raise NotImplementedError raise NotImplementedError
security.declareProtected(ManageUsers, 'getUserById')
def getUserById(self, id, default=None): def getUserById(self, id, default=None):
"""Return the user corresponding to the given id. """Return the user corresponding to the given id.
""" """
...@@ -534,6 +532,8 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -534,6 +532,8 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
# Authors of custom user folders don't need to do anything special to # Authors of custom user folders don't need to do anything special to
# support these - they will just call the appropriate '_' methods that # support these - they will just call the appropriate '_' methods that
# user folder subclasses already implement. # user folder subclasses already implement.
security.declareProtected(ManageUsers, 'userFolderAddUser')
def userFolderAddUser(self, name, password, roles, domains, **kw): def userFolderAddUser(self, name, password, roles, domains, **kw):
"""API method for creating a new user object. Note that not all """API method for creating a new user object. Note that not all
user folder implementations support dynamic creation of user user folder implementations support dynamic creation of user
...@@ -542,6 +542,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -542,6 +542,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
return self._doAddUser(name, password, roles, domains, **kw) return self._doAddUser(name, password, roles, domains, **kw)
raise NotImplementedError raise NotImplementedError
security.declareProtected(ManageUsers, 'userFolderEditUser')
def userFolderEditUser(self, name, password, roles, domains, **kw): def userFolderEditUser(self, name, password, roles, domains, **kw):
"""API method for changing user object attributes. Note that not """API method for changing user object attributes. Note that not
all user folder implementations support changing of user object all user folder implementations support changing of user object
...@@ -550,6 +551,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -550,6 +551,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
return self._doChangeUser(name, password, roles, domains, **kw) return self._doChangeUser(name, password, roles, domains, **kw)
raise NotImplementedError raise NotImplementedError
security.declareProtected(ManageUsers, 'userFolderDelUsers')
def userFolderDelUsers(self, names): def userFolderDelUsers(self, names):
"""API method for deleting one or more user objects. Note that not """API method for deleting one or more user objects. Note that not
all user folder implementations support deletion of user objects.""" all user folder implementations support deletion of user objects."""
...@@ -929,6 +931,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -929,6 +931,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
self._doDelUsers(names) self._doDelUsers(names)
if REQUEST: return self._mainUser(self, REQUEST) if REQUEST: return self._mainUser(self, REQUEST)
security.declareProtected(ManageUsers, 'manage_users')
def manage_users(self,submit=None,REQUEST=None,RESPONSE=None): def manage_users(self,submit=None,REQUEST=None,RESPONSE=None):
"""This method handles operations on users for the web based forms """This method handles operations on users for the web based forms
of the ZMI. Application code (code that is outside of the forms of the ZMI. Application code (code that is outside of the forms
...@@ -968,6 +971,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -968,6 +971,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
return self._mainUser(self, REQUEST) return self._mainUser(self, REQUEST)
security.declareProtected(ManageUsers, 'user_names')
def user_names(self): def user_names(self):
return self.getUserNames() return self.getUserNames()
...@@ -994,6 +998,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager, ...@@ -994,6 +998,7 @@ class BasicUserFolder(Implicit, Persistent, Navigation, Tabs, RoleManager,
# Domain authentication support. This is a good candidate to # Domain authentication support. This is a good candidate to
# become deprecated in future Zope versions. # become deprecated in future Zope versions.
security.declareProtected(ManageUsers, 'setDomainAuthenticationMode')
def setDomainAuthenticationMode(self, domain_auth_mode): def setDomainAuthenticationMode(self, domain_auth_mode):
"""Set the domain-based authentication mode. By default, this """Set the domain-based authentication mode. By default, this
mode is off due to the high overhead of the operation that mode is off due to the high overhead of the operation that
...@@ -1098,7 +1103,7 @@ class UserFolder(BasicUserFolder): ...@@ -1098,7 +1103,7 @@ class UserFolder(BasicUserFolder):
pass pass
Globals.default__class_init__(UserFolder) InitializeClass(UserFolder)
def manage_addUserFolder(self,dtself=None,REQUEST=None,**ignored): def manage_addUserFolder(self,dtself=None,REQUEST=None,**ignored):
......
lib/python/App/ApplicationManager.py
View file @ 41049f78
...@@ -15,6 +15,7 @@ __doc__="""System management components""" ...@@ -15,6 +15,7 @@ __doc__="""System management components"""
__version__='$Revision: 1.94 $'[11:-2] __version__='$Revision: 1.94 $'[11:-2]
import sys,os,time,Globals, Acquisition, os, Undo import sys,os,time,Globals, Acquisition, os, Undo
from Globals import InitializeClass
from Globals import DTMLFile from Globals import DTMLFile
from OFS.ObjectManager import ObjectManager from OFS.ObjectManager import ObjectManager
from OFS.Folder import Folder from OFS.Folder import Folder
...@@ -69,8 +70,8 @@ class DatabaseManager(Fake, SimpleItem.Item, Acquisition.Implicit): ...@@ -69,8 +70,8 @@ class DatabaseManager(Fake, SimpleItem.Item, Acquisition.Implicit):
manage_cacheParameters=Globals.DTMLFile('dtml/cacheParameters', globals()) manage_cacheParameters=Globals.DTMLFile('dtml/cacheParameters', globals())
manage_cacheGC=Globals.DTMLFile('dtml/cacheGC', globals()) manage_cacheGC=Globals.DTMLFile('dtml/cacheGC', globals())
InitializeClass(DatabaseManager)
Globals.default__class_init__(DatabaseManager)
class FakeConnection: class FakeConnection:
# Supports the methods of Connection that CacheManager needs # Supports the methods of Connection that CacheManager needs
...@@ -133,7 +134,7 @@ class DatabaseChooser (SimpleItem.SimpleItem): ...@@ -133,7 +134,7 @@ class DatabaseChooser (SimpleItem.SimpleItem):
res.append(m.__of__(self)) res.append(m.__of__(self))
return res return res
Globals.InitializeClass(DatabaseChooser) InitializeClass(DatabaseChooser)
class VersionManager(Fake, SimpleItem.Item, Acquisition.Implicit): class VersionManager(Fake, SimpleItem.Item, Acquisition.Implicit):
...@@ -152,7 +153,7 @@ class VersionManager(Fake, SimpleItem.Item, Acquisition.Implicit): ...@@ -152,7 +153,7 @@ class VersionManager(Fake, SimpleItem.Item, Acquisition.Implicit):
) )
) )
Globals.default__class_init__(VersionManager) InitializeClass(VersionManager)
...@@ -264,7 +265,7 @@ class DebugManager(Fake, SimpleItem.Item, Acquisition.Implicit): ...@@ -264,7 +265,7 @@ class DebugManager(Fake, SimpleItem.Item, Acquisition.Implicit):
def manage_getSysPath(self): def manage_getSysPath(self):
return list(sys.path) return list(sys.path)
Globals.default__class_init__(DebugManager) InitializeClass(DebugManager)
......
lib/python/App/CacheManager.py
View file @ 41049f78
...@@ -20,6 +20,7 @@ __version__='$Revision: 1.31 $'[11:-2] ...@@ -20,6 +20,7 @@ __version__='$Revision: 1.31 $'[11:-2]
import time import time
import Globals import Globals
from Globals import InitializeClass
from DateTime import DateTime from DateTime import DateTime
class CacheManager: class CacheManager:
...@@ -294,5 +295,4 @@ class CacheManager: ...@@ -294,5 +295,4 @@ class CacheManager:
} }
return res return res
InitializeClass(CacheManager)
Globals.default__class_init__(CacheManager)
lib/python/App/DavLockManager.py
View file @ 41049f78
...@@ -14,6 +14,7 @@ ...@@ -14,6 +14,7 @@
__version__ = "$Revision: 1.8 $"[11:-2] __version__ = "$Revision: 1.8 $"[11:-2]
import OFS, Acquisition, Globals import OFS, Acquisition, Globals
from Globals import InitializeClass
from AccessControl import getSecurityManager, ClassSecurityInfo from AccessControl import getSecurityManager, ClassSecurityInfo
from webdav.Lockable import wl_isLocked from webdav.Lockable import wl_isLocked
...@@ -104,5 +105,4 @@ class DavLockManager(OFS.SimpleItem.Item, Acquisition.Implicit): ...@@ -104,5 +105,4 @@ class DavLockManager(OFS.SimpleItem.Item, Acquisition.Implicit):
return result return result
InitializeClass(DavLockManager)
Globals.default__class_init__(DavLockManager)
lib/python/App/Factory.py
View file @ 41049f78
...@@ -16,6 +16,10 @@ $Id$''' ...@@ -16,6 +16,10 @@ $Id$'''
__version__='$Revision: 1.27 $'[11:-2] __version__='$Revision: 1.27 $'[11:-2]
import OFS.SimpleItem, Acquisition, Globals, AccessControl.Role import OFS.SimpleItem, Acquisition, Globals, AccessControl.Role
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import edit_factories
from AccessControl.Permissions import use_factories
class Factory( class Factory(
AccessControl.Role.RoleManager, AccessControl.Role.RoleManager,
...@@ -25,15 +29,13 @@ class Factory( ...@@ -25,15 +29,13 @@ class Factory(
meta_type='Zope Factory' meta_type='Zope Factory'
icon='p_/Factory_icon' icon='p_/Factory_icon'
security = ClassSecurityInfo()
security.declareObjectProtected(use_factories)
permission='' # Waaaa permission='' # Waaaa
_setObject=_getOb=Acquisition.Acquired _setObject=_getOb=Acquisition.Acquired
__ac_permissions__=(
('Edit Factories', ('manage_edit','manage_main')),
('Use Factories', ('index_html','')),
)
manage_options=( manage_options=(
( (
{'label':'Edit', 'action':'manage_main', {'label':'Edit', 'action':'manage_main',
...@@ -50,11 +52,12 @@ class Factory( ...@@ -50,11 +52,12 @@ class Factory(
self.initial=initial self.initial=initial
self.permission=permission self.permission=permission
initializePermission__roles__ = () security.declarePrivate('initializePermission')
def initializePermission(self): def initializePermission(self):
self.manage_setPermissionMapping(('Use Factories',), self.manage_setPermissionMapping((use_factories,),
(self.permission,)) (self.permission,))
security.declareProtected(edit_factories, 'manage_edit')
def manage_edit(self, title, object_type, initial, permission='', def manage_edit(self, title, object_type, initial, permission='',
REQUEST=None): REQUEST=None):
"Modify factory properties." "Modify factory properties."
...@@ -63,7 +66,7 @@ class Factory( ...@@ -63,7 +66,7 @@ class Factory(
self.object_type=object_type self.object_type=object_type
self.initial=initial self.initial=initial
self.permission=permission self.permission=permission
self.manage_setPermissionMapping(('Use Factories',), (permission,)) self.manage_setPermissionMapping((use_factories,), (permission,))
self._register() self._register()
if REQUEST is not None: return self.manage_main(self, REQUEST) if REQUEST is not None: return self.manage_main(self, REQUEST)
...@@ -100,8 +103,10 @@ class Factory( ...@@ -100,8 +103,10 @@ class Factory(
product.aq_acquire('_manage_remove_product_meta_type')( product.aq_acquire('_manage_remove_product_meta_type')(
product, self.id, self.object_type) product, self.id, self.object_type)
security.declareProtected(edit_factories, 'manage_main')
manage_main=Globals.DTMLFile('dtml/editFactory',globals()) manage_main=Globals.DTMLFile('dtml/editFactory',globals())
security.declareProtected(use_factories, 'index_html')
def index_html(self, REQUEST): def index_html(self, REQUEST):
" " " "
return getattr(self, self.initial)(self.aq_parent, REQUEST) return getattr(self, self.initial)(self.aq_parent, REQUEST)
...@@ -112,4 +117,7 @@ class Factory( ...@@ -112,4 +117,7 @@ class Factory(
self.aq_parent.objectIds() self.aq_parent.objectIds()
) )
InitializeClass(Factory)
class ProductFactory(Factory): pass class ProductFactory(Factory): pass
lib/python/App/FactoryDispatcher.py
View file @ 41049f78
...@@ -14,6 +14,8 @@ ...@@ -14,6 +14,8 @@
# Implement the manage_addProduct method of object managers # Implement the manage_addProduct method of object managers
import Acquisition, sys, Products import Acquisition, sys, Products
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.PermissionMapping import aqwrap from AccessControl.PermissionMapping import aqwrap
from AccessControl.Owned import UnownableOwner from AccessControl.Owned import UnownableOwner
...@@ -41,6 +43,8 @@ class FactoryDispatcher(Acquisition.Implicit): ...@@ -41,6 +43,8 @@ class FactoryDispatcher(Acquisition.Implicit):
"""Provide a namespace for product "methods" """Provide a namespace for product "methods"
""" """
security = ClassSecurityInfo()
_owner=UnownableOwner _owner=UnownableOwner
def __init__(self, product, dest, REQUEST=None): def __init__(self, product, dest, REQUEST=None):
...@@ -55,13 +59,15 @@ class FactoryDispatcher(Acquisition.Implicit): ...@@ -55,13 +59,15 @@ class FactoryDispatcher(Acquisition.Implicit):
v=v[:v.rfind('/')] v=v[:v.rfind('/')]
self._u=v[:v.rfind('/')] self._u=v[:v.rfind('/')]
security.declarePublic('Destination')
def Destination(self): def Destination(self):
"Return the destination for factory output" "Return the destination for factory output"
return self.__dict__['_d'] # we don't want to wrap the result! return self.__dict__['_d'] # we don't want to wrap the result!
this=Destination
this__roles__=Destination__roles__=None
security.declarePublic('this')
this=Destination
security.declarePublic('DestinationURL')
def DestinationURL(self): def DestinationURL(self):
"Return the URL for the destination for factory output" "Return the URL for the destination for factory output"
url=getattr(self, '_u', None) url=getattr(self, '_u', None)
...@@ -69,8 +75,6 @@ class FactoryDispatcher(Acquisition.Implicit): ...@@ -69,8 +75,6 @@ class FactoryDispatcher(Acquisition.Implicit):
url=self.Destination().absolute_url() url=self.Destination().absolute_url()
return url return url
DestinationURL__roles__=None
def __getattr__(self, name): def __getattr__(self, name):
p=self.__dict__['_product'] p=self.__dict__['_product']
d=p.__dict__ d=p.__dict__
...@@ -102,3 +106,4 @@ class FactoryDispatcher(Acquisition.Implicit): ...@@ -102,3 +106,4 @@ class FactoryDispatcher(Acquisition.Implicit):
d = update_menu and '/manage_main?update_menu=1' or '/manage_main' d = update_menu and '/manage_main?update_menu=1' or '/manage_main'
REQUEST['RESPONSE'].redirect(self.DestinationURL()+d) REQUEST['RESPONSE'].redirect(self.DestinationURL()+d)
InitializeClass(FactoryDispatcher)
lib/python/App/ImageFile.py
View file @ 41049f78
...@@ -17,6 +17,8 @@ __version__='$Revision: 1.20 $'[11:-2] ...@@ -17,6 +17,8 @@ __version__='$Revision: 1.20 $'[11:-2]
import os import os
import time import time
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from App.config import getConfiguration from App.config import getConfiguration
from OFS.content_types import guess_content_type from OFS.content_types import guess_content_type
from Globals import package_home from Globals import package_home
...@@ -28,6 +30,8 @@ import Globals ...@@ -28,6 +30,8 @@ import Globals
class ImageFile(Acquisition.Explicit): class ImageFile(Acquisition.Explicit):
"""Image objects stored in external files.""" """Image objects stored in external files."""
security = ClassSecurityInfo()
def __init__(self,path,_prefix=None): def __init__(self,path,_prefix=None):
if _prefix is None: if _prefix is None:
_prefix=getConfiguration().softwarehome _prefix=getConfiguration().softwarehome
...@@ -84,7 +88,7 @@ class ImageFile(Acquisition.Explicit): ...@@ -84,7 +88,7 @@ class ImageFile(Acquisition.Explicit):
return open(self.path,'rb').read() return open(self.path,'rb').read()
HEAD__roles__=None security.declarePublic('HEAD')
def HEAD(self, REQUEST, RESPONSE): def HEAD(self, REQUEST, RESPONSE):
""" """ """ """
RESPONSE.setHeader('Content-Type', self.content_type) RESPONSE.setHeader('Content-Type', self.content_type)
...@@ -97,3 +101,5 @@ class ImageFile(Acquisition.Explicit): ...@@ -97,3 +101,5 @@ class ImageFile(Acquisition.Explicit):
def __str__(self): def __str__(self):
return '<img src="%s" alt="" />' % self.__name__ return '<img src="%s" alt="" />' % self.__name__
InitializeClass(ImageFile)
lib/python/App/Management.py
View file @ 41049f78
...@@ -15,10 +15,13 @@ ...@@ -15,10 +15,13 @@
$Id$ $Id$
""" """
import sys, Globals, ExtensionClass, urllib import sys, ExtensionClass, urllib
from Globals import DTMLFile, HTMLFile from Globals import DTMLFile, HTMLFile
from Globals import InitializeClass
from zExceptions import Redirect from zExceptions import Redirect
from AccessControl import getSecurityManager, Unauthorized from AccessControl import getSecurityManager, Unauthorized
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
from cgi import escape from cgi import escape
from zope.interface import implements from zope.interface import implements
...@@ -28,13 +31,15 @@ from interfaces import INavigation ...@@ -28,13 +31,15 @@ from interfaces import INavigation
class Tabs(ExtensionClass.Base): class Tabs(ExtensionClass.Base):
"""Mix-in provides management folder tab support.""" """Mix-in provides management folder tab support."""
manage_tabs__roles__=('Anonymous',) security = ClassSecurityInfo()
security.declarePublic('manage_tabs')
manage_tabs=DTMLFile('dtml/manage_tabs', globals()) manage_tabs=DTMLFile('dtml/manage_tabs', globals())
manage_options =() manage_options =()
filtered_manage_options__roles__=None security.declarePublic('filtered_manage_options')
def filtered_manage_options(self, REQUEST=None): def filtered_manage_options(self, REQUEST=None):
validate=getSecurityManager().validate validate=getSecurityManager().validate
...@@ -131,7 +136,7 @@ class Tabs(ExtensionClass.Base): ...@@ -131,7 +136,7 @@ class Tabs(ExtensionClass.Base):
out.append(last) out.append(last)
return '/'.join(out) return '/'.join(out)
class_manage_path__roles__=None security.declarePublic('class_manage_path')
def class_manage_path(self): def class_manage_path(self):
if self.__class__.__module__[:1] != '*': if self.__class__.__module__[:1] != '*':
return return
...@@ -150,7 +155,7 @@ class Tabs(ExtensionClass.Base): ...@@ -150,7 +155,7 @@ class Tabs(ExtensionClass.Base):
if path: if path:
return '/Control_Panel/Products/%s/manage_workspace' % path return '/Control_Panel/Products/%s/manage_workspace' % path
Globals.default__class_init__(Tabs) InitializeClass(Tabs)
class Navigation(ExtensionClass.Base): class Navigation(ExtensionClass.Base):
...@@ -158,36 +163,38 @@ class Navigation(ExtensionClass.Base): ...@@ -158,36 +163,38 @@ class Navigation(ExtensionClass.Base):
implements(INavigation) implements(INavigation)
__ac_permissions__=( security = ClassSecurityInfo()
('View management screens',
('manage', 'manage_menu', 'manage_top_frame',
'manage_page_header',
'manage_page_footer',
)),
)
security.declareProtected(view_management_screens, 'manage')
manage =DTMLFile('dtml/manage', globals()) manage =DTMLFile('dtml/manage', globals())
security.declareProtected(view_management_screens, 'manage_menu')
manage_menu =DTMLFile('dtml/menu', globals()) manage_menu =DTMLFile('dtml/menu', globals())
security.declareProtected(view_management_screens, 'manage_top_frame')
manage_top_frame =DTMLFile('dtml/manage_top_frame', globals()) manage_top_frame =DTMLFile('dtml/manage_top_frame', globals())
security.declareProtected(view_management_screens, 'manage_page_header')
manage_page_header=DTMLFile('dtml/manage_page_header', globals()) manage_page_header=DTMLFile('dtml/manage_page_header', globals())
security.declareProtected(view_management_screens, 'manage_page_footer')
manage_page_footer=DTMLFile('dtml/manage_page_footer', globals()) manage_page_footer=DTMLFile('dtml/manage_page_footer', globals())
security.declarePublic('manage_form_title')
manage_form_title =DTMLFile('dtml/manage_form_title', globals(), manage_form_title =DTMLFile('dtml/manage_form_title', globals(),
form_title='Add Form', form_title='Add Form',
help_product=None, help_product=None,
help_topic=None) help_topic=None)
manage_form_title._setFuncSignature( manage_form_title._setFuncSignature(
varnames=('form_title', 'help_product', 'help_topic') ) varnames=('form_title', 'help_product', 'help_topic') )
manage_form_title__roles__ = None
security.declarePublic('zope_quick_start')
zope_quick_start=DTMLFile('dtml/zope_quick_start', globals()) zope_quick_start=DTMLFile('dtml/zope_quick_start', globals())
zope_quick_start__roles__=None
security.declarePublic('manage_copyright')
manage_copyright=DTMLFile('dtml/copyright', globals()) manage_copyright=DTMLFile('dtml/copyright', globals())
manage_copyright__roles__ = None
manage_zmi_logout__roles__ = None security.declarePublic('manage_zmi_logout')
def manage_zmi_logout(self, REQUEST, RESPONSE): def manage_zmi_logout(self, REQUEST, RESPONSE):
"""Logout current user""" """Logout current user"""
p = getattr(REQUEST, '_logout_path', None) p = getattr(REQUEST, '_logout_path', None)
...@@ -207,12 +214,14 @@ You have been logged out. ...@@ -207,12 +214,14 @@ You have been logged out.
</html>""") </html>""")
return return
security.declarePublic('manage_zmi_prefs')
manage_zmi_prefs=DTMLFile('dtml/manage_zmi_prefs', globals()) manage_zmi_prefs=DTMLFile('dtml/manage_zmi_prefs', globals())
manage_zmi_prefs__roles__ = None
# Navigation doesn't have an inherited __class_init__ so doesn't get
# initialized automatically.
file = DTMLFile('dtml/manage_page_style.css', globals()) file = DTMLFile('dtml/manage_page_style.css', globals())
Navigation.security.declarePublic('manage_page_style.css')
setattr(Navigation, 'manage_page_style.css', file) setattr(Navigation, 'manage_page_style.css', file)
setattr(Navigation, 'manage_page_style.css__roles__', None)
Globals.default__class_init__(Navigation) InitializeClass(Navigation)
lib/python/App/Product.py
View file @ 41049f78
...@@ -41,10 +41,12 @@ from urllib import quote ...@@ -41,10 +41,12 @@ from urllib import quote
import transaction import transaction
import Globals, OFS.Folder, OFS.SimpleItem, Acquisition, Products import Globals, OFS.Folder, OFS.SimpleItem, Acquisition, Products
from Globals import InitializeClass
import ZClasses, AccessControl.Owned import ZClasses, AccessControl.Owned
from OFS.Folder import Folder from OFS.Folder import Folder
from HelpSys.HelpSys import ProductHelp from HelpSys.HelpSys import ProductHelp
from AccessControl import Unauthorized from AccessControl import Unauthorized
from AccessControl import ClassSecurityInfo
from Factory import Factory from Factory import Factory
from Permission import PermissionManager from Permission import PermissionManager
...@@ -79,12 +81,15 @@ class ProductFolder(Folder): ...@@ -79,12 +81,15 @@ class ProductFolder(Folder):
def _canCopy(self, op=0): def _canCopy(self, op=0):
return 0 return 0
Globals.InitializeClass(ProductFolder) InitializeClass(ProductFolder)
class Product(Folder, PermissionManager): class Product(Folder, PermissionManager):
"""Model a product that can be created through the web. """Model a product that can be created through the web.
""" """
security = ClassSecurityInfo()
meta_type='Product' meta_type='Product'
icon='p_/Product_icon' icon='p_/Product_icon'
version='' version=''
...@@ -171,15 +176,15 @@ class Product(Folder, PermissionManager): ...@@ -171,15 +176,15 @@ class Product(Folder, PermissionManager):
except: except:
pass pass
security.declarePublic('Destination')
def Destination(self): def Destination(self):
"Return the destination for factory output" "Return the destination for factory output"
return self return self
Destination__roles__=None
security.declarePublic('DestinationURL')
def DestinationURL(self): def DestinationURL(self):
"Return the URL for the destination for factory output" "Return the URL for the destination for factory output"
return self.REQUEST['BASE4'] return self.REQUEST['BASE4']
DestinationURL__roles__=None
def manage_distribute(self, version, RESPONSE, configurable_objects=[], def manage_distribute(self, version, RESPONSE, configurable_objects=[],
redistributable=0): redistributable=0):
...@@ -419,7 +424,7 @@ class Product(Folder, PermissionManager): ...@@ -419,7 +424,7 @@ class Product(Folder, PermissionManager):
if REQUEST is not None: if REQUEST is not None:
return self.manage_refresh(REQUEST) return self.manage_refresh(REQUEST)
Globals.InitializeClass(Product) InitializeClass(Product)
class CompressedOutputFile: class CompressedOutputFile:
......
lib/python/App/Undo.py
View file @ 41049f78
...@@ -16,7 +16,10 @@ $Id$ ...@@ -16,7 +16,10 @@ $Id$
""" """
from Acquisition import aq_base, aq_parent, aq_inner from Acquisition import aq_base, aq_parent, aq_inner
from Globals import InitializeClass
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import undo_changes
from DateTime import DateTime from DateTime import DateTime
import Globals, ExtensionClass import Globals, ExtensionClass
from ZopeUndo.Prefix import Prefix from ZopeUndo.Prefix import Prefix
...@@ -30,19 +33,14 @@ class UndoSupport(ExtensionClass.Base): ...@@ -30,19 +33,14 @@ class UndoSupport(ExtensionClass.Base):
implements(IUndoSupport) implements(IUndoSupport)
__ac_permissions__=( security = ClassSecurityInfo()
('Undo changes', (
'manage_undo_transactions',
'undoable_transactions',
'manage_UndoForm',
)),
)
manage_options=( manage_options=(
{'label':'Undo', 'action':'manage_UndoForm', {'label':'Undo', 'action':'manage_UndoForm',
'help':('OFSP','Undo.stx')}, 'help':('OFSP','Undo.stx')},
) )
security.declareProtected(undo_changes, 'manage_UndoForm')
manage_UndoForm=Globals.DTMLFile( manage_UndoForm=Globals.DTMLFile(
'dtml/undo', 'dtml/undo',
globals(), globals(),
...@@ -64,6 +62,7 @@ class UndoSupport(ExtensionClass.Base): ...@@ -64,6 +62,7 @@ class UndoSupport(ExtensionClass.Base):
else: v=default else: v=default
return v return v
security.declareProtected(undo_changes, 'undoable_transactions')
def undoable_transactions(self, first_transaction=None, def undoable_transactions(self, first_transaction=None,
last_transaction=None, last_transaction=None,
PrincipiaUndoBatchSize=None): PrincipiaUndoBatchSize=None):
...@@ -123,6 +122,7 @@ class UndoSupport(ExtensionClass.Base): ...@@ -123,6 +122,7 @@ class UndoSupport(ExtensionClass.Base):
return r return r
security.declareProtected(undo_changes, 'manage_undo_transactions')
def manage_undo_transactions(self, transaction_info=(), REQUEST=None): def manage_undo_transactions(self, transaction_info=(), REQUEST=None):
""" """
""" """
...@@ -139,7 +139,7 @@ class UndoSupport(ExtensionClass.Base): ...@@ -139,7 +139,7 @@ class UndoSupport(ExtensionClass.Base):
REQUEST['RESPONSE'].redirect("%s/manage_UndoForm" % REQUEST['URL1']) REQUEST['RESPONSE'].redirect("%s/manage_UndoForm" % REQUEST['URL1'])
return '' return ''
Globals.default__class_init__(UndoSupport) InitializeClass(UndoSupport)
######################################################################## ########################################################################
# Blech, need this cause binascii.b2a_base64 is too pickly # Blech, need this cause binascii.b2a_base64 is too pickly
......
lib/python/Globals/__init__.py
View file @ 41049f78
...@@ -26,12 +26,12 @@ import TreeDisplay ...@@ -26,12 +26,12 @@ import TreeDisplay
from App.Common import package_home, attrget, Dictionary from App.Common import package_home, attrget, Dictionary
from App.config import getConfiguration as _getConfiguration from App.config import getConfiguration as _getConfiguration
from Persistence import Persistent, PersistentMapping from Persistence import Persistent, PersistentMapping
from App.special_dtml import HTML, HTMLFile, DTMLFile
from App.class_init import default__class_init__, ApplicationDefaultPermissions from App.class_init import default__class_init__, ApplicationDefaultPermissions
# Nicer alias for class initializer. # Nicer alias for class initializer.
InitializeClass = default__class_init__ InitializeClass = default__class_init__
from App.special_dtml import HTML, HTMLFile, DTMLFile
from App.Dialogs import MessageDialog from App.Dialogs import MessageDialog
from App.ImageFile import ImageFile from App.ImageFile import ImageFile
......
lib/python/HelpSys/HelpSys.py
View file @ 41049f78
...@@ -15,12 +15,16 @@ import Acquisition ...@@ -15,12 +15,16 @@ import Acquisition
from OFS.SimpleItem import Item from OFS.SimpleItem import Item
from OFS.ObjectManager import ObjectManager from OFS.ObjectManager import ObjectManager
from Globals import Persistent, DTMLFile, HTML from Globals import Persistent, DTMLFile, HTML
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import access_contents_information
from AccessControl.Permissions import add_documents_images_and_files
from AccessControl.Permissions import view as View
from Products.ZCatalog.ZCatalog import ZCatalog from Products.ZCatalog.ZCatalog import ZCatalog
from Products.ZCatalog.Lazy import LazyCat from Products.ZCatalog.Lazy import LazyCat
from cgi import escape from cgi import escape
import Products import Products
import HelpTopic import HelpTopic
import Globals
class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent): class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent):
""" """
...@@ -30,22 +34,18 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -30,22 +34,18 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent):
""" """
meta_type='Help System' meta_type='Help System'
security = ClassSecurityInfo()
security.declareObjectProtected(View)
manage_options=( manage_options=(
{'label' : 'Contents', 'action' : 'menu'}, {'label' : 'Contents', 'action' : 'menu'},
{'label' : 'Search', 'action' : 'search'}, {'label' : 'Search', 'action' : 'search'},
) )
__ac_permissions__=(
('View',
('__call__', 'searchResults', 'HelpButton', '',
'index_html', 'menu', 'search', 'results', 'main',
'helpLink')),
('Access contents information', ('helpValues',)),
)
def __init__(self, id='HelpSys'): def __init__(self, id='HelpSys'):
self.id=id self.id=id
security.declareProtected(access_contents_information, 'helpValues')
def helpValues(self, spec=None): def helpValues(self, spec=None):
"ProductHelp objects of all Products that have help" "ProductHelp objects of all Products that have help"
hv=[] hv=[]
...@@ -59,6 +59,8 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -59,6 +59,8 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent):
# Seaching does an aggregated search of all ProductHelp # Seaching does an aggregated search of all ProductHelp
# objects. Only Help Topics for which the user has permissions # objects. Only Help Topics for which the user has permissions
# are returned. # are returned.
security.declareProtected(View, '__call__')
def __call__(self, REQUEST=None, **kw): def __call__(self, REQUEST=None, **kw):
"Searchable interface" "Searchable interface"
if REQUEST is not None: if REQUEST is not None:
...@@ -73,18 +75,29 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -73,18 +75,29 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent):
results.append(apply(getattr(ph, '__call__'), (REQUEST,) , kw)) results.append(apply(getattr(ph, '__call__'), (REQUEST,) , kw))
return LazyCat(results) return LazyCat(results)
security.declareProtected(View, 'searchResults')
searchResults=__call__ searchResults=__call__
security.declareProtected(View, 'index_html')
index_html=DTMLFile('dtml/frame', globals()) index_html=DTMLFile('dtml/frame', globals())
security.declareProtected(View, 'menu')
menu=DTMLFile('dtml/menu', globals()) menu=DTMLFile('dtml/menu', globals())
security.declareProtected(View, 'search')
search=DTMLFile('dtml/search', globals()) search=DTMLFile('dtml/search', globals())
security.declareProtected(View, 'results')
results=DTMLFile('dtml/results', globals()) results=DTMLFile('dtml/results', globals())
security.declareProtected(View, 'main')
main=HTML("""<html></html>""") main=HTML("""<html></html>""")
standard_html_header=DTMLFile('dtml/menu_header', globals()) standard_html_header=DTMLFile('dtml/menu_header', globals())
standard_html_footer=DTMLFile('dtml/menu_footer', globals()) standard_html_footer=DTMLFile('dtml/menu_footer', globals())
button=DTMLFile('dtml/button', globals()) button=DTMLFile('dtml/button', globals())
security.declareProtected(View, 'HelpButton')
def HelpButton(self, topic, product): def HelpButton(self, topic, product):
""" """
Insert a help button linked to a help topic. Insert a help button linked to a help topic.
...@@ -93,6 +106,7 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -93,6 +106,7 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent):
helpURL=DTMLFile('dtml/helpURL',globals()) helpURL=DTMLFile('dtml/helpURL',globals())
security.declareProtected(View, 'helpLink')
def helpLink(self, product='OFSP', topic='ObjectManager_Contents.stx'): def helpLink(self, product='OFSP', topic='ObjectManager_Contents.stx'):
# Generate an <a href...> tag linking to a help topic. This # Generate an <a href...> tag linking to a help topic. This
# is a little lighter weight than the help button approach. # is a little lighter weight than the help button approach.
...@@ -133,7 +147,7 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -133,7 +147,7 @@ class HelpSys(Acquisition.Implicit, ObjectManager, Item, Persistent):
cols.append(TreeCollection(k,v,0)) cols.append(TreeCollection(k,v,0))
return cols return cols
Globals.default__class_init__(HelpSys) InitializeClass(HelpSys)
class TreeCollection: class TreeCollection:
...@@ -188,6 +202,8 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -188,6 +202,8 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent):
meta_type='Product Help' meta_type='Product Help'
icon='p_/ProductHelp_icon' icon='p_/ProductHelp_icon'
security = ClassSecurityInfo()
lastRegistered=None lastRegistered=None
meta_types=({'name':'Help Topic', meta_types=({'name':'Help Topic',
...@@ -200,10 +216,6 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -200,10 +216,6 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent):
Item.manage_options Item.manage_options
) )
__ac_permissions__=(
('Add Documents, Images, and Files', ('addTopicForm', 'addTopic')),
)
def __init__(self, id='Help', title=''): def __init__(self, id='Help', title=''):
self.id=id self.id=id
self.title=title self.title=title
...@@ -222,8 +234,10 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -222,8 +234,10 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent):
c.addColumn('url') c.addColumn('url')
c.addColumn('id') c.addColumn('id')
security.declareProtected(add_documents_images_and_files, 'addTopicForm')
addTopicForm=DTMLFile('dtml/addTopic', globals()) addTopicForm=DTMLFile('dtml/addTopic', globals())
security.declareProtected(add_documents_images_and_files, 'addTopic')
def addTopic(self, id, title, REQUEST=None): def addTopic(self, id, title, REQUEST=None):
"Add a Help Topic" "Add a Help Topic"
topic=HelpTopic.DTMLDocumentTopic( topic=HelpTopic.DTMLDocumentTopic(
...@@ -295,5 +309,4 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent): ...@@ -295,5 +309,4 @@ class ProductHelp(Acquisition.Implicit, ObjectManager, Item, Persistent):
standard_html_header=DTMLFile('dtml/topic_header', globals()) standard_html_header=DTMLFile('dtml/topic_header', globals())
standard_html_footer=DTMLFile('dtml/topic_footer', globals()) standard_html_footer=DTMLFile('dtml/topic_footer', globals())
InitializeClass(ProductHelp)
Globals.default__class_init__(ProductHelp)
lib/python/HelpSys/HelpTopic.py
View file @ 41049f78
...@@ -15,6 +15,10 @@ import Acquisition ...@@ -15,6 +15,10 @@ import Acquisition
from ComputedAttribute import ComputedAttribute from ComputedAttribute import ComputedAttribute
from OFS.SimpleItem import Item from OFS.SimpleItem import Item
from Globals import Persistent, HTML, DTMLFile, ImageFile from Globals import Persistent, HTML, DTMLFile, ImageFile
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import access_contents_information
from AccessControl.Permissions import view as View
from OFS.DTMLDocument import DTMLDocument from OFS.DTMLDocument import DTMLDocument
from OFS.PropertyManager import PropertyManager from OFS.PropertyManager import PropertyManager
import os.path import os.path
...@@ -115,15 +119,18 @@ class HelpTopic(Acquisition.Implicit, HelpTopicBase, Item, PropertyManager, Pers ...@@ -115,15 +119,18 @@ class HelpTopic(Acquisition.Implicit, HelpTopicBase, Item, PropertyManager, Pers
icon='p_/HelpTopic_icon' icon='p_/HelpTopic_icon'
_v_last_read = 0 _v_last_read = 0
security = ClassSecurityInfo()
manage_options=( manage_options=(
{'label':'Properties', 'action':'manage_propertiesForm'}, {'label':'Properties', 'action':'manage_propertiesForm'},
{'label':'View', 'action':'index_html'}, {'label':'View', 'action':'index_html'},
) )
__ac_permissions__=( security.declareProtected(View, 'SearchableText')
('View', ('index_html', 'SearchableText', 'url')),
('Access contents information', ('helpValues',)), security.declareProtected(View, 'url')
)
security.declareProtected(access_contents_information, 'helpValues')
def _set_last_read(self, filepath): def _set_last_read(self, filepath):
try: mtime = os.stat(filepath)[8] try: mtime = os.stat(filepath)[8]
...@@ -141,10 +148,13 @@ class HelpTopic(Acquisition.Implicit, HelpTopicBase, Item, PropertyManager, Pers ...@@ -141,10 +148,13 @@ class HelpTopic(Acquisition.Implicit, HelpTopicBase, Item, PropertyManager, Pers
self._v_last_read=mtime self._v_last_read=mtime
self.reindex_object() self.reindex_object()
security.declareProtected(View, 'index_html')
def index_html(self, REQUEST, RESPONSE): def index_html(self, REQUEST, RESPONSE):
"View the Help Topic" "View the Help Topic"
raise NotImplementedError raise NotImplementedError
InitializeClass(HelpTopic)
class DTMLDocumentTopic(HelpTopicBase, DTMLDocument): class DTMLDocumentTopic(HelpTopicBase, DTMLDocument):
""" """
......
lib/python/HelpSys/ObjectRef.py
View file @ 41049f78
...@@ -15,6 +15,8 @@ ...@@ -15,6 +15,8 @@
__version__='$Revision: 1.10 $'[11:-2] __version__='$Revision: 1.10 $'[11:-2]
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
import sys, os, Globals, Acquisition import sys, os, Globals, Acquisition
from HelpUtil import HelpBase, classobject from HelpUtil import HelpBase, classobject
from HelpUtil import is_class, is_module from HelpUtil import is_class, is_module
...@@ -26,7 +28,8 @@ from urllib import quote ...@@ -26,7 +28,8 @@ from urllib import quote
class ObjectItem(HelpBase, classobject): class ObjectItem(HelpBase, classobject):
""" """ """ """
__roles__=None security = ClassSecurityInfo()
security.declareObjectPublic()
hs_main=DTMLFile('dtml/objectitem', globals()) hs_main=DTMLFile('dtml/objectitem', globals())
...@@ -75,16 +78,19 @@ class ObjectItem(HelpBase, classobject): ...@@ -75,16 +78,19 @@ class ObjectItem(HelpBase, classobject):
del mdict del mdict
return mlist return mlist
hs_objectvalues__roles__=None security.declarePublic('hs_objectvalues')
def hs_objectvalues(self): def hs_objectvalues(self):
return [] return []
InitializeClass(ObjectItem)
class ObjectRef(HelpBase): class ObjectRef(HelpBase):
""" """ """ """
security = ClassSecurityInfo()
security.declareObjectPublic()
__names__=None __names__=None
__roles__=None
hs_main=DTMLFile('dtml/objectref', globals()) hs_main=DTMLFile('dtml/objectref', globals())
...@@ -129,7 +135,7 @@ class ObjectRef(HelpBase): ...@@ -129,7 +135,7 @@ class ObjectRef(HelpBase):
dict=self.hs_search_mod(v, dict) dict=self.hs_search_mod(v, dict)
return dict return dict
hs_objectvalues__roles__=None security.declarePublic('hs_objectvalues')
def hs_objectvalues(self): def hs_objectvalues(self):
if self.__names__ is None: if self.__names__ is None:
self.hs_deferred__init__() self.hs_deferred__init__()
...@@ -140,3 +146,5 @@ class ObjectRef(HelpBase): ...@@ -140,3 +146,5 @@ class ObjectRef(HelpBase):
def __getitem__(self, key): def __getitem__(self, key):
return self.__dict__[key].__of__(self) return self.__dict__[key].__of__(self)
InitializeClass(ObjectRef)
lib/python/OFS/Application.py
View file @ 41049f78
...@@ -22,6 +22,8 @@ from warnings import warn ...@@ -22,6 +22,8 @@ from warnings import warn
import Globals, Products, App.Product, App.ProductRegistry import Globals, Products, App.Product, App.ProductRegistry
import transaction import transaction
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.User import UserFolder from AccessControl.User import UserFolder
from Acquisition import aq_base from Acquisition import aq_base
from App.ApplicationManager import ApplicationManager from App.ApplicationManager import ApplicationManager
...@@ -51,8 +53,9 @@ class Application(Globals.ApplicationDefaultPermissions, ...@@ -51,8 +53,9 @@ class Application(Globals.ApplicationDefaultPermissions,
implements(IApplication) implements(IApplication)
security = ClassSecurityInfo()
title ='Zope' title ='Zope'
#__roles__=['Manager', 'Anonymous']
__defined_roles__=('Manager','Anonymous','Owner') __defined_roles__=('Manager','Anonymous','Owner')
web__form__method='GET' web__form__method='GET'
isTopLevelPrincipiaApplicationObject=1 isTopLevelPrincipiaApplicationObject=1
...@@ -103,7 +106,7 @@ class Application(Globals.ApplicationDefaultPermissions, ...@@ -103,7 +106,7 @@ class Application(Globals.ApplicationDefaultPermissions,
return self.title return self.title
def __class_init__(self): def __class_init__(self):
Globals.default__class_init__(self) InitializeClass(self)
def PrincipiaRedirect(self, destination, URL1): def PrincipiaRedirect(self, destination, URL1):
"""Utility function to allow user-controlled redirects""" """Utility function to allow user-controlled redirects"""
...@@ -135,7 +138,7 @@ class Application(Globals.ApplicationDefaultPermissions, ...@@ -135,7 +138,7 @@ class Application(Globals.ApplicationDefaultPermissions,
ZopeTime = PrincipiaTime ZopeTime = PrincipiaTime
ZopeAttributionButton__roles__=None security.declarePublic('ZopeAttributionButton')
def ZopeAttributionButton(self): def ZopeAttributionButton(self):
"""Returns an HTML fragment that displays the 'powered by zope' """Returns an HTML fragment that displays the 'powered by zope'
button along with a link to the Zope site.""" button along with a link to the Zope site."""
...@@ -194,7 +197,7 @@ class Application(Globals.ApplicationDefaultPermissions, ...@@ -194,7 +197,7 @@ class Application(Globals.ApplicationDefaultPermissions,
# We're at the base of the path. # We're at the base of the path.
return ('',) return ('',)
fixupZClassDependencies__roles__=() security.declarePrivate('fixupZClassDependencies')
def fixupZClassDependencies(self, rebuild=0): def fixupZClassDependencies(self, rebuild=0):
# Note that callers should not catch exceptions from this method # Note that callers should not catch exceptions from this method
# to ensure that the transaction gets aborted if the registry # to ensure that the transaction gets aborted if the registry
...@@ -252,7 +255,7 @@ class Application(Globals.ApplicationDefaultPermissions, ...@@ -252,7 +255,7 @@ class Application(Globals.ApplicationDefaultPermissions,
return result return result
checkGlobalRegistry__roles__=() security.declarePrivate('checkGlobalRegistry')
def checkGlobalRegistry(self): def checkGlobalRegistry(self):
"""Check the global (zclass) registry for problems, which can """Check the global (zclass) registry for problems, which can
be caused by things like disk-based products being deleted. be caused by things like disk-based products being deleted.
...@@ -268,19 +271,21 @@ class Application(Globals.ApplicationDefaultPermissions, ...@@ -268,19 +271,21 @@ class Application(Globals.ApplicationDefaultPermissions,
return 1 return 1
return 0 return 0
_setInitializerRegistry__roles__ = () security.declarePrivate('_setInitializerFlag')
def _setInitializerFlag(self, flag): def _setInitializerFlag(self, flag):
if self._initializer_registry is None: if self._initializer_registry is None:
self._initializer_registry = {} self._initializer_registry = {}
self._initializer_registry[flag] = 1 self._initializer_registry[flag] = 1
_getInitializerRegistry__roles__ = () security.declarePrivate('_getInitializerFlag')
def _getInitializerFlag(self, flag): def _getInitializerFlag(self, flag):
reg = self._initializer_registry reg = self._initializer_registry
if reg is None: if reg is None:
reg = {} reg = {}
return reg.get(flag) return reg.get(flag)
InitializeClass(Application)
class Expired(Globals.Persistent): class Expired(Globals.Persistent):
...@@ -645,7 +650,7 @@ def install_products(app): ...@@ -645,7 +650,7 @@ def install_products(app):
folder_permissions, raise_exc=debug_mode) folder_permissions, raise_exc=debug_mode)
Products.meta_types=Products.meta_types+tuple(meta_types) Products.meta_types=Products.meta_types+tuple(meta_types)
Globals.default__class_init__(Folder.Folder) InitializeClass(Folder.Folder)
def get_products(): def get_products():
""" Return a list of tuples in the form: """ Return a list of tuples in the form:
...@@ -923,7 +928,7 @@ def reinstall_product(app, product_name): ...@@ -923,7 +928,7 @@ def reinstall_product(app, product_name):
break break
Products.meta_types=Products.meta_types+tuple(meta_types) Products.meta_types=Products.meta_types+tuple(meta_types)
Globals.default__class_init__(Folder.Folder) InitializeClass(Folder.Folder)
def reimport_product(product_name): def reimport_product(product_name):
......
lib/python/OFS/Cache.py
View file @ 41049f78
...@@ -16,16 +16,19 @@ $Id$ ...@@ -16,16 +16,19 @@ $Id$
""" """
import time, sys import time, sys
import Globals import Globals
from Globals import InitializeClass
from Globals import DTMLFile from Globals import DTMLFile
from Acquisition import aq_get, aq_acquire, aq_inner, aq_parent, aq_base from Acquisition import aq_get, aq_acquire, aq_inner, aq_parent, aq_base
from zLOG import LOG, WARNING from zLOG import LOG, WARNING
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.Role import _isBeingUsedAsAMethod from AccessControl.Role import _isBeingUsedAsAMethod
from AccessControl import Unauthorized from AccessControl import Unauthorized
from AccessControl.Permissions import view_management_screens
ZCM_MANAGERS = '__ZCacheManager_ids__' ZCM_MANAGERS = '__ZCacheManager_ids__'
ViewManagementScreensPermission = 'View management screens' ViewManagementScreensPermission = view_management_screens
ChangeCacheSettingsPermission = 'Change cache settings' ChangeCacheSettingsPermission = 'Change cache settings'
...@@ -86,21 +89,11 @@ class Cacheable: ...@@ -86,21 +89,11 @@ class Cacheable:
'help':('OFSP','Cacheable-properties.stx'), 'help':('OFSP','Cacheable-properties.stx'),
},) },)
__ac_permissions__ = ( security = ClassSecurityInfo()
(ViewManagementScreensPermission, security.setPermissionDefault(ChangeCacheSettingsPermission, ('Manager',))
('ZCacheable_manage',
'ZCacheable_invalidate',
'ZCacheable_enabled',
'ZCacheable_getManagerId',
'ZCacheable_getManagerIds',
'ZCacheable_configHTML',
)),
(ChangeCacheSettingsPermission,
('ZCacheable_setManagerId',
'ZCacheable_setEnabled',
), ('Manager',)),
)
security.declareProtected(ViewManagementScreensPermission,
'ZCacheable_manage')
ZCacheable_manage = DTMLFile('dtml/cacheable', globals()) ZCacheable_manage = DTMLFile('dtml/cacheable', globals())
_v_ZCacheable_cache = None _v_ZCacheable_cache = None
...@@ -109,7 +102,7 @@ class Cacheable: ...@@ -109,7 +102,7 @@ class Cacheable:
__enabled = 1 __enabled = 1
_isCacheable = 1 _isCacheable = 1
ZCacheable_getManager__roles__ = () security.declarePrivate('ZCacheable_getManager')
def ZCacheable_getManager(self): def ZCacheable_getManager(self):
'''Returns the currently associated cache manager.''' '''Returns the currently associated cache manager.'''
manager_id = self.__manager_id manager_id = self.__manager_id
...@@ -122,7 +115,7 @@ class Cacheable: ...@@ -122,7 +115,7 @@ class Cacheable:
except AttributeError: except AttributeError:
return None return None
ZCacheable_getCache__roles__ = () security.declarePrivate('ZCacheable_getCache')
def ZCacheable_getCache(self): def ZCacheable_getCache(self):
'''Gets the cache associated with this object. '''Gets the cache associated with this object.
''' '''
...@@ -143,7 +136,7 @@ class Cacheable: ...@@ -143,7 +136,7 @@ class Cacheable:
self._v_ZCacheable_manager_timestamp = manager_timestamp self._v_ZCacheable_manager_timestamp = manager_timestamp
return c return c
ZCacheable_isCachingEnabled__roles__ = () security.declarePrivate('ZCacheable_isCachingEnabled')
def ZCacheable_isCachingEnabled(self): def ZCacheable_isCachingEnabled(self):
''' '''
Returns true only if associated with a cache manager and Returns true only if associated with a cache manager and
...@@ -158,7 +151,7 @@ class Cacheable: ...@@ -158,7 +151,7 @@ class Cacheable:
m = _isBeingUsedAsAMethod(self) m = _isBeingUsedAsAMethod(self)
return m return m
ZCacheable_getObAndView__roles__ = () security.declarePrivate('ZCacheable_getObAndView')
def ZCacheable_getObAndView(self, view_name): def ZCacheable_getObAndView(self, view_name):
""" """
If this object is a method of a ZClass and we're working If this object is a method of a ZClass and we're working
...@@ -178,7 +171,7 @@ class Cacheable: ...@@ -178,7 +171,7 @@ class Cacheable:
ob = self ob = self
return ob, view_name return ob, view_name
ZCacheable_get__roles__ = () security.declarePrivate('ZCacheable_get')
def ZCacheable_get(self, view_name='', keywords=None, def ZCacheable_get(self, view_name='', keywords=None,
mtime_func=None, default=None): mtime_func=None, default=None):
'''Retrieves the cached view for the object under the '''Retrieves the cached view for the object under the
...@@ -198,7 +191,7 @@ class Cacheable: ...@@ -198,7 +191,7 @@ class Cacheable:
return default return default
return default return default
ZCacheable_set__roles__ = () security.declarePrivate('ZCacheable_set')
def ZCacheable_set(self, data, view_name='', keywords=None, def ZCacheable_set(self, data, view_name='', keywords=None,
mtime_func=None): mtime_func=None):
'''Cacheable views should call this method after generating '''Cacheable views should call this method after generating
...@@ -214,6 +207,8 @@ class Cacheable: ...@@ -214,6 +207,8 @@ class Cacheable:
LOG('Cache', WARNING, 'ZCache_set() exception', LOG('Cache', WARNING, 'ZCache_set() exception',
error=sys.exc_info()) error=sys.exc_info())
security.declareProtected(ViewManagementScreensPermission,
'ZCacheable_invalidate')
def ZCacheable_invalidate(self, view_name='', REQUEST=None): def ZCacheable_invalidate(self, view_name='', REQUEST=None):
'''Called after a cacheable object is edited. Causes all '''Called after a cacheable object is edited. Causes all
cache entries that apply to the view_name to be removed. cache entries that apply to the view_name to be removed.
...@@ -243,7 +238,7 @@ class Cacheable: ...@@ -243,7 +238,7 @@ class Cacheable:
else: else:
return message return message
ZCacheable_getModTime__roles__=() security.declarePrivate('ZCacheable_getModTime')
def ZCacheable_getModTime(self, mtime_func=None): def ZCacheable_getModTime(self, mtime_func=None):
'''Returns the highest of the last mod times.''' '''Returns the highest of the last mod times.'''
# Based on: # Based on:
...@@ -271,6 +266,8 @@ class Cacheable: ...@@ -271,6 +266,8 @@ class Cacheable:
mtime = max(getattr(klass, '_p_mtime', mtime), mtime) mtime = max(getattr(klass, '_p_mtime', mtime), mtime)
return mtime return mtime
security.declareProtected(ViewManagementScreensPermission,
'ZCacheable_getManagerId')
def ZCacheable_getManagerId(self): def ZCacheable_getManagerId(self):
'''Returns the id of the current ZCacheManager.''' '''Returns the id of the current ZCacheManager.'''
return self.__manager_id return self.__manager_id
...@@ -282,6 +279,8 @@ class Cacheable: ...@@ -282,6 +279,8 @@ class Cacheable:
return manager.absolute_url() return manager.absolute_url()
return None return None
security.declareProtected(ViewManagementScreensPermission,
'ZCacheable_getManagerIds')
def ZCacheable_getManagerIds(self): def ZCacheable_getManagerIds(self):
'''Returns a list of mappings containing the id and title '''Returns a list of mappings containing the id and title
of the available ZCacheManagers.''' of the available ZCacheManagers.'''
...@@ -303,6 +302,8 @@ class Cacheable: ...@@ -303,6 +302,8 @@ class Cacheable:
ob = aq_parent(aq_inner(ob)) ob = aq_parent(aq_inner(ob))
return tuple(rval) return tuple(rval)
security.declareProtected(ChangeCacheSettingsPermission,
'ZCacheable_setManagerId')
def ZCacheable_setManagerId(self, manager_id, REQUEST=None): def ZCacheable_setManagerId(self, manager_id, REQUEST=None):
'''Changes the manager_id for this object.''' '''Changes the manager_id for this object.'''
self.ZCacheable_invalidate() self.ZCacheable_invalidate()
...@@ -319,11 +320,15 @@ class Cacheable: ...@@ -319,11 +320,15 @@ class Cacheable:
self, REQUEST, management_view='Cache', self, REQUEST, management_view='Cache',
manage_tabs_message='Cache settings changed.') manage_tabs_message='Cache settings changed.')
security.declareProtected(ViewManagementScreensPermission,
'ZCacheable_enabled')
def ZCacheable_enabled(self): def ZCacheable_enabled(self):
'''Returns true if caching is enabled for this object '''Returns true if caching is enabled for this object
or method.''' or method.'''
return self.__enabled return self.__enabled
security.declareProtected(ChangeCacheSettingsPermission,
'ZCacheable_setEnabled')
def ZCacheable_setEnabled(self, enabled=0, REQUEST=None): def ZCacheable_setEnabled(self, enabled=0, REQUEST=None):
'''Changes the enabled flag. Normally used only when '''Changes the enabled flag. Normally used only when
setting up cacheable ZClass methods.''' setting up cacheable ZClass methods.'''
...@@ -333,6 +338,8 @@ class Cacheable: ...@@ -333,6 +338,8 @@ class Cacheable:
self, REQUEST, management_view='Cache', self, REQUEST, management_view='Cache',
manage_tabs_message='Cache settings changed.') manage_tabs_message='Cache settings changed.')
security.declareProtected(ViewManagementScreensPermission,
'ZCacheable_configHTML')
def ZCacheable_configHTML(self): def ZCacheable_configHTML(self):
'''Override to provide configuration of caching '''Override to provide configuration of caching
behavior that can only be specific to the cacheable object. behavior that can only be specific to the cacheable object.
...@@ -340,7 +347,7 @@ class Cacheable: ...@@ -340,7 +347,7 @@ class Cacheable:
return '' return ''
Globals.default__class_init__(Cacheable) InitializeClass(Cacheable)
def findCacheables(ob, manager_id, require_assoc, subfolders, def findCacheables(ob, manager_id, require_assoc, subfolders,
...@@ -432,19 +439,15 @@ class CacheManager: ...@@ -432,19 +439,15 @@ class CacheManager:
A base class for cache managers. Implement ZCacheManager_getCache(). A base class for cache managers. Implement ZCacheManager_getCache().
''' '''
ZCacheManager_getCache__roles__ = () security = ClassSecurityInfo()
security.setPermissionDefault(ChangeCacheSettingsPermission, ('Manager',))
security.declarePrivate('ZCacheManager_getCache')
def ZCacheManager_getCache(self): def ZCacheManager_getCache(self):
raise NotImplementedError raise NotImplementedError
_isCacheManager = 1 _isCacheManager = 1
__ac_permissions__ = (
('Change cache settings', ('ZCacheManager_locate',
'ZCacheManager_setAssociations',
'ZCacheManager_associate'),
('Manager',)),
)
manage_options = ( manage_options = (
{'label':'Associate', {'label':'Associate',
'action':'ZCacheManager_associate', 'action':'ZCacheManager_associate',
...@@ -473,8 +476,12 @@ class CacheManager: ...@@ -473,8 +476,12 @@ class CacheManager:
global manager_timestamp global manager_timestamp
manager_timestamp = time.time() manager_timestamp = time.time()
security.declareProtected(ChangeCacheSettingsPermission,
'ZCacheManager_associate')
ZCacheManager_associate = DTMLFile('dtml/cmassoc', globals()) ZCacheManager_associate = DTMLFile('dtml/cmassoc', globals())
security.declareProtected(ChangeCacheSettingsPermission,
'ZCacheManager_locate')
def ZCacheManager_locate(self, require_assoc, subfolders, def ZCacheManager_locate(self, require_assoc, subfolders,
meta_types=[], REQUEST=None): meta_types=[], REQUEST=None):
'''Locates cacheable objects. '''Locates cacheable objects.
...@@ -494,6 +501,8 @@ class CacheManager: ...@@ -494,6 +501,8 @@ class CacheManager:
else: else:
return rval return rval
security.declareProtected(ChangeCacheSettingsPermission,
'ZCacheManager_setAssociations')
def ZCacheManager_setAssociations(self, props=None, REQUEST=None): def ZCacheManager_setAssociations(self, props=None, REQUEST=None):
'''Associates and un-associates cacheable objects with this '''Associates and un-associates cacheable objects with this
cache manager. cache manager.
...@@ -530,4 +539,4 @@ class CacheManager: ...@@ -530,4 +539,4 @@ class CacheManager:
(addcount, remcount) (addcount, remcount)
) )
Globals.default__class_init__(CacheManager) InitializeClass(CacheManager)
lib/python/OFS/CopySupport.py
View file @ 41049f78
...@@ -23,8 +23,12 @@ from zlib import compress, decompress ...@@ -23,8 +23,12 @@ from zlib import compress, decompress
import Globals, Moniker, ExtensionClass import Globals, Moniker, ExtensionClass
import transaction import transaction
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.Permissions import delete_objects as DeleteObjects from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import copy_or_move
from AccessControl.Permissions import delete_objects
from Acquisition import aq_base, aq_inner, aq_parent from Acquisition import aq_base, aq_inner, aq_parent
from App.Dialogs import MessageDialog from App.Dialogs import MessageDialog
from webdav.Lockable import ResourceLockedError from webdav.Lockable import ResourceLockedError
...@@ -54,13 +58,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -54,13 +58,7 @@ class CopyContainer(ExtensionClass.Base):
implements(ICopyContainer) implements(ICopyContainer)
__ac_permissions__=( security = ClassSecurityInfo()
('View management screens',
('manage_copyObjects', 'manage_pasteObjects',
'manage_renameForm', 'manage_renameObject', 'manage_renameObjects',)),
('Delete objects',
('manage_cutObjects',)),
)
# The following three methods should be overridden to store sub-objects # The following three methods should be overridden to store sub-objects
# as non-attributes. # as non-attributes.
...@@ -83,6 +81,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -83,6 +81,7 @@ class CopyContainer(ExtensionClass.Base):
def manage_CopyContainerAllItems(self, REQUEST): def manage_CopyContainerAllItems(self, REQUEST):
return map(lambda i, s=self: s._getOb(i), tuple(REQUEST['ids'])) return map(lambda i, s=self: s._getOb(i), tuple(REQUEST['ids']))
security.declareProtected(delete_objects, 'manage_cutObjects')
def manage_cutObjects(self, ids=None, REQUEST=None): def manage_cutObjects(self, ids=None, REQUEST=None):
"""Put a reference to the objects named in ids in the clip board""" """Put a reference to the objects named in ids in the clip board"""
if ids is None and REQUEST is not None: if ids is None and REQUEST is not None:
...@@ -112,6 +111,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -112,6 +111,7 @@ class CopyContainer(ExtensionClass.Base):
return self.manage_main(self, REQUEST) return self.manage_main(self, REQUEST)
return cp return cp
security.declareProtected(view_management_screens, 'manage_copyObjects')
def manage_copyObjects(self, ids=None, REQUEST=None, RESPONSE=None): def manage_copyObjects(self, ids=None, REQUEST=None, RESPONSE=None):
"""Put a reference to the objects named in ids in the clip board""" """Put a reference to the objects named in ids in the clip board"""
if ids is None and REQUEST is not None: if ids is None and REQUEST is not None:
...@@ -154,6 +154,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -154,6 +154,7 @@ class CopyContainer(ExtensionClass.Base):
id='copy%s_of_%s' % (n and n+1 or '', orig_id) id='copy%s_of_%s' % (n and n+1 or '', orig_id)
n=n+1 n=n+1
security.declareProtected(view_management_screens, 'manage_pasteObjects')
def manage_pasteObjects(self, cb_copy_data=None, REQUEST=None): def manage_pasteObjects(self, cb_copy_data=None, REQUEST=None):
"""Paste previously copied objects into the current object. """Paste previously copied objects into the current object.
...@@ -287,8 +288,10 @@ class CopyContainer(ExtensionClass.Base): ...@@ -287,8 +288,10 @@ class CopyContainer(ExtensionClass.Base):
return result return result
security.declareProtected(view_management_screens, 'manage_renameForm')
manage_renameForm=Globals.DTMLFile('dtml/renameForm', globals()) manage_renameForm=Globals.DTMLFile('dtml/renameForm', globals())
security.declareProtected(view_management_screens, 'manage_renameObjects')
def manage_renameObjects(self, ids=[], new_ids=[], REQUEST=None): def manage_renameObjects(self, ids=[], new_ids=[], REQUEST=None):
"""Rename several sub-objects""" """Rename several sub-objects"""
if len(ids) != len(new_ids): if len(ids) != len(new_ids):
...@@ -300,6 +303,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -300,6 +303,7 @@ class CopyContainer(ExtensionClass.Base):
return self.manage_main(self, REQUEST, update_menu=1) return self.manage_main(self, REQUEST, update_menu=1)
return None return None
security.declareProtected(view_management_screens, 'manage_renameObject')
def manage_renameObject(self, id, new_id, REQUEST=None): def manage_renameObject(self, id, new_id, REQUEST=None):
"""Rename a particular sub-object. """Rename a particular sub-object.
""" """
...@@ -353,7 +357,8 @@ class CopyContainer(ExtensionClass.Base): ...@@ -353,7 +357,8 @@ class CopyContainer(ExtensionClass.Base):
# supposed to be public since it does its own auth ? # supposed to be public since it does its own auth ?
# #
# Because it's still a "management" function. # Because it's still a "management" function.
manage_clone__roles__=None
security.declarePublic('manage_clone')
def manage_clone(self, ob, id, REQUEST=None): def manage_clone(self, ob, id, REQUEST=None):
"""Clone an object, creating a new object with the given id. """Clone an object, creating a new object with the given id.
""" """
...@@ -497,7 +502,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -497,7 +502,7 @@ class CopyContainer(ExtensionClass.Base):
raise Unauthorized, absattr(object.id) raise Unauthorized, absattr(object.id)
if validate_src == 2: # moving if validate_src == 2: # moving
if not sm.checkPermission(DeleteObjects, parent): if not sm.checkPermission(delete_objects, parent):
raise Unauthorized, 'Delete not allowed.' raise Unauthorized, 'Delete not allowed.'
else: # /if method_name else: # /if method_name
...@@ -507,7 +512,7 @@ class CopyContainer(ExtensionClass.Base): ...@@ -507,7 +512,7 @@ class CopyContainer(ExtensionClass.Base):
'operation.' % escape(absattr(object.id))), 'operation.' % escape(absattr(object.id))),
action = 'manage_main') action = 'manage_main')
Globals.default__class_init__(CopyContainer) InitializeClass(CopyContainer)
class CopySource(ExtensionClass.Base): class CopySource(ExtensionClass.Base):
...@@ -518,9 +523,8 @@ class CopySource(ExtensionClass.Base): ...@@ -518,9 +523,8 @@ class CopySource(ExtensionClass.Base):
# declare a dummy permission for Copy or Move here that we check # declare a dummy permission for Copy or Move here that we check
# in cb_isCopyable. # in cb_isCopyable.
__ac_permissions__=( security = ClassSecurityInfo()
('Copy or Move', (), ('Anonymous', 'Manager',)), security.setPermissionDefault(copy_or_move, ('Anonymous', 'Manager'))
)
def _canCopy(self, op=0): def _canCopy(self, op=0):
"""Called to make sure this object is copyable. """Called to make sure this object is copyable.
...@@ -593,10 +597,10 @@ class CopySource(ExtensionClass.Base): ...@@ -593,10 +597,10 @@ class CopySource(ExtensionClass.Base):
return 1 return 1
def cb_userHasCopyOrMovePermission(self): def cb_userHasCopyOrMovePermission(self):
if getSecurityManager().checkPermission('Copy or Move', self): if getSecurityManager().checkPermission(copy_or_move, self):
return 1 return 1
Globals.default__class_init__(CopySource) InitializeClass(CopySource)
def sanity_check(c, ob): def sanity_check(c, ob):
......
lib/python/OFS/DTMLDocument.py
View file @ 41049f78
...@@ -14,6 +14,7 @@ ...@@ -14,6 +14,7 @@
$Id$ $Id$
""" """
from Globals import InitializeClass
from ZPublisher.Converters import type_converters from ZPublisher.Converters import type_converters
from Globals import HTML, DTMLFile, MessageDialog from Globals import HTML, DTMLFile, MessageDialog
from OFS.content_types import guess_content_type from OFS.content_types import guess_content_type
...@@ -24,8 +25,9 @@ from webdav.Lockable import ResourceLockedError ...@@ -24,8 +25,9 @@ from webdav.Lockable import ResourceLockedError
from webdav.WriteLockInterface import WriteLockInterface from webdav.WriteLockInterface import WriteLockInterface
from sgmllib import SGMLParser from sgmllib import SGMLParser
from urllib import quote from urllib import quote
import Globals
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.Permissions import change_dtml_methods
from AccessControl.Permissions import change_dtml_documents
from zExceptions.TracebackSupplement import PathTracebackSupplement from zExceptions.TracebackSupplement import PathTracebackSupplement
done='done' done='done'
...@@ -45,11 +47,13 @@ class DTMLDocument(PropertyManager, DTMLMethod): ...@@ -45,11 +47,13 @@ class DTMLDocument(PropertyManager, DTMLMethod):
PropertyManager.manage_options + PropertyManager.manage_options +
DTMLMethod.manage_options[2:] DTMLMethod.manage_options[2:]
) )
ps = DTMLMethod.__ac_permissions__ # Replace change_dtml_methods by change_dtml_documents
__ac_permissions__=( __ac_permissions__ = tuple([
ps[0], ('Change DTML Documents', ps[1][1]), ps[2], ps[3], ps[4]) (perms[0] == change_dtml_methods)
del ps and (change_dtml_documents, perms[1])
or perms
for perms in DTMLMethod.__ac_permissions__])
def manage_edit(self,data,title,SUBMIT='Change',dtpref_cols='100%', def manage_edit(self,data,title,SUBMIT='Change',dtpref_cols='100%',
dtpref_rows='20',REQUEST=None): dtpref_rows='20',REQUEST=None):
...@@ -146,7 +150,7 @@ class DTMLDocument(PropertyManager, DTMLMethod): ...@@ -146,7 +150,7 @@ class DTMLDocument(PropertyManager, DTMLMethod):
return result return result
Globals.default__class_init__(DTMLDocument) InitializeClass(DTMLDocument)
default_dd_html="""<dtml-var standard_html_header> default_dd_html="""<dtml-var standard_html_header>
......
lib/python/OFS/DTMLMethod.py
View file @ 41049f78
...@@ -16,9 +16,11 @@ $Id$ ...@@ -16,9 +16,11 @@ $Id$
""" """
import History import History
from Globals import HTML, DTMLFile, MessageDialog from Globals import HTML, DTMLFile, MessageDialog
from Globals import InitializeClass
from SimpleItem import Item_w__name__, pretty_tb from SimpleItem import Item_w__name__, pretty_tb
from OFS.content_types import guess_content_type from OFS.content_types import guess_content_type
from PropertyManager import PropertyManager from PropertyManager import PropertyManager
from AccessControl import ClassSecurityInfo
from AccessControl.Role import RoleManager from AccessControl.Role import RoleManager
from webdav.common import rfc1123_date from webdav.common import rfc1123_date
from webdav.Lockable import ResourceLockedError from webdav.Lockable import ResourceLockedError
...@@ -28,6 +30,11 @@ from DateTime.DateTime import DateTime ...@@ -28,6 +30,11 @@ from DateTime.DateTime import DateTime
from urllib import quote from urllib import quote
import Globals, sys, Acquisition import Globals, sys, Acquisition
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.Permissions import change_dtml_methods
from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import change_proxy_roles
from AccessControl.Permissions import view as View
from AccessControl.Permissions import ftp_access
from AccessControl.DTML import RestrictedDTML from AccessControl.DTML import RestrictedDTML
from Cache import Cacheable from Cache import Cacheable
from zExceptions import Forbidden from zExceptions import Forbidden
...@@ -50,6 +57,9 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -50,6 +57,9 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
__implements__ = (WriteLockInterface,) __implements__ = (WriteLockInterface,)
security = ClassSecurityInfo()
security.declareObjectProtected(View)
# Documents masquerade as functions: # Documents masquerade as functions:
class func_code: pass class func_code: pass
func_code=func_code() func_code=func_code()
...@@ -74,28 +84,17 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -74,28 +84,17 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
+Cacheable.manage_options +Cacheable.manage_options
) )
# Careful in changes--used by DTMLDocument! # Careful in permissiong changes--used by DTMLDocument!
__ac_permissions__=(
('View management screens', security.declareProtected(change_dtml_methods, 'manage_historyCopy')
('document_src', 'PrincipiaSearchSource')), security.declareProtected(change_dtml_methods, 'manage_beforeHistoryCopy')
('Change DTML Methods', security.declareProtected(change_dtml_methods, 'manage_afterHistoryCopy')
('manage_editForm', 'manage', 'manage_main',
'manage_edit', 'manage_upload', 'PUT',
'manage_historyCopy',
'manage_beforeHistoryCopy', 'manage_afterHistoryCopy',
'ZCacheable_configHTML', 'getCacheNamespaceKeys',
'setCacheNamespaceKeys',
)
),
('Change proxy roles', ('manage_proxyForm', 'manage_proxy')),
('View', ('__call__', 'get_size', '')),
('FTP access', ('manage_FTPstat','manage_FTPget','manage_FTPlist')),
)
# support a more reasonable default for content-type # support a more reasonable default for content-type
# for http HEAD requests. # for http HEAD requests.
default_content_type='text/html' default_content_type='text/html'
security.declareProtected(View, '__call__')
def __call__(self, client=None, REQUEST={}, RESPONSE=None, **kw): def __call__(self, client=None, REQUEST={}, RESPONSE=None, **kw):
"""Render the document given a client object, REQUEST mapping, """Render the document given a client object, REQUEST mapping,
Response, and key word arguments.""" Response, and key word arguments."""
...@@ -190,14 +189,17 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -190,14 +189,17 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
kw[key] = val kw[key] = val
self.ZCacheable_set(result, keywords=kw) self.ZCacheable_set(result, keywords=kw)
security.declareProtected(change_dtml_methods, 'ZCacheable_configHTML')
ZCacheable_configHTML = DTMLFile('dtml/cacheNamespaceKeys', globals()) ZCacheable_configHTML = DTMLFile('dtml/cacheNamespaceKeys', globals())
security.declareProtected(change_dtml_methods, 'getCacheNamespaceKeys')
def getCacheNamespaceKeys(self): def getCacheNamespaceKeys(self):
''' '''
Returns the cacheNamespaceKeys. Returns the cacheNamespaceKeys.
''' '''
return self._cache_namespace_keys return self._cache_namespace_keys
security.declareProtected(change_dtml_methods, 'setCacheNamespaceKeys')
def setCacheNamespaceKeys(self, keys, REQUEST=None): def setCacheNamespaceKeys(self, keys, REQUEST=None):
''' '''
Sets the list of names that should be looked up in the Sets the list of names that should be looked up in the
...@@ -212,19 +214,26 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -212,19 +214,26 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
if REQUEST is not None: if REQUEST is not None:
return self.ZCacheable_manage(self, REQUEST) return self.ZCacheable_manage(self, REQUEST)
security.declareProtected(View, 'get_size')
def get_size(self): def get_size(self):
return len(self.raw) return len(self.raw)
# deprecated; use get_size! # deprecated; use get_size!
getSize=get_size getSize=get_size
security.declareProtected(change_dtml_methods, 'manage')
security.declareProtected(change_dtml_methods, 'manage_editForm')
manage_editForm=DTMLFile('dtml/documentEdit', globals()) manage_editForm=DTMLFile('dtml/documentEdit', globals())
manage_editForm._setName('manage_editForm') manage_editForm._setName('manage_editForm')
# deprecated! # deprecated!
manage_uploadForm=manage_editForm manage_uploadForm=manage_editForm
security.declareProtected(change_dtml_methods, 'manage_main')
manage=manage_main=manage_editDocument=manage_editForm manage=manage_main=manage_editDocument=manage_editForm
security.declareProtected(change_proxy_roles, 'manage_proxyForm')
manage_proxyForm=DTMLFile('dtml/documentProxy', globals()) manage_proxyForm=DTMLFile('dtml/documentProxy', globals())
_size_changes={ _size_changes={
...@@ -252,6 +261,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -252,6 +261,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
return self.manage_main(self, REQUEST, title=title, return self.manage_main(self, REQUEST, title=title,
__str__=self.quotedHTML(data)) __str__=self.quotedHTML(data))
security.declareProtected(change_dtml_methods, 'manage_edit')
def manage_edit(self,data,title,SUBMIT='Change',dtpref_cols='100%', def manage_edit(self,data,title,SUBMIT='Change',dtpref_cols='100%',
dtpref_rows='20',REQUEST=None): dtpref_rows='20',REQUEST=None):
""" """
...@@ -277,6 +287,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -277,6 +287,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
message="Saved changes." message="Saved changes."
return self.manage_main(self,REQUEST,manage_tabs_message=message) return self.manage_main(self,REQUEST,manage_tabs_message=message)
security.declareProtected(change_dtml_methods, 'manage_upload')
def manage_upload(self,file='', REQUEST=None): def manage_upload(self,file='', REQUEST=None):
"""Replace the contents of the document with the text in file.""" """Replace the contents of the document with the text in file."""
self._validateProxy(REQUEST) self._validateProxy(REQUEST)
...@@ -315,6 +326,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -315,6 +326,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
'do not have proxy roles.\n<!--%s, %s-->' % (self.__name__, u, roles)) 'do not have proxy roles.\n<!--%s, %s-->' % (self.__name__, u, roles))
security.declareProtected(change_proxy_roles, 'manage_proxy')
def manage_proxy(self, roles=(), REQUEST=None): def manage_proxy(self, roles=(), REQUEST=None):
"Change Proxy Roles" "Change Proxy Roles"
self._validateProxy(REQUEST, roles) self._validateProxy(REQUEST, roles)
...@@ -325,10 +337,12 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -325,10 +337,12 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
message="Saved changes." message="Saved changes."
return self.manage_proxyForm(self,REQUEST,manage_tabs_message=message) return self.manage_proxyForm(self,REQUEST,manage_tabs_message=message)
security.declareProtected(view_management_screens, 'PrincipiaSearchSource')
def PrincipiaSearchSource(self): def PrincipiaSearchSource(self):
"Support for searching - the document's contents are searched." "Support for searching - the document's contents are searched."
return self.read() return self.read()
security.declareProtected(view_management_screens, 'document_src')
def document_src(self, REQUEST=None, RESPONSE=None): def document_src(self, REQUEST=None, RESPONSE=None):
"""Return unprocessed document source.""" """Return unprocessed document source."""
if RESPONSE is not None: if RESPONSE is not None:
...@@ -337,6 +351,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -337,6 +351,7 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
## Protocol handlers ## Protocol handlers
security.declareProtected(change_dtml_methods, 'PUT')
def PUT(self, REQUEST, RESPONSE): def PUT(self, REQUEST, RESPONSE):
"""Handle HTTP PUT requests.""" """Handle HTTP PUT requests."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -348,6 +363,10 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -348,6 +363,10 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
RESPONSE.setStatus(204) RESPONSE.setStatus(204)
return RESPONSE return RESPONSE
security.declareProtected(ftp_access, 'manage_FTPstat')
security.declareProtected(ftp_access, 'manage_FTPlist')
security.declareProtected(ftp_access, 'manage_FTPget')
def manage_FTPget(self): def manage_FTPget(self):
"Get source for FTP download" "Get source for FTP download"
return self.read() return self.read()
...@@ -361,6 +380,8 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager, ...@@ -361,6 +380,8 @@ class DTMLMethod(RestrictedDTML, HTML, Acquisition.Implicit, RoleManager,
rev1.read(), rev2.read() rev1.read(), rev2.read()
)) ))
InitializeClass(DTMLMethod)
import re import re
token = "[a-zA-Z0-9!#$%&'*+\-.\\\\^_`|~]+" token = "[a-zA-Z0-9!#$%&'*+\-.\\\\^_`|~]+"
hdr_start = re.compile(r'(%s):(.*)' % token).match hdr_start = re.compile(r'(%s):(.*)' % token).match
......
lib/python/OFS/FindSupport.py
View file @ 41049f78
...@@ -17,14 +17,16 @@ $Id$ ...@@ -17,14 +17,16 @@ $Id$
from string import translate from string import translate
import Globals, ExtensionClass import ExtensionClass
from AccessControl import ClassSecurityInfo from AccessControl import ClassSecurityInfo
from AccessControl.DTML import RestrictedDTML from AccessControl.DTML import RestrictedDTML
from AccessControl.Permission import name_trans from AccessControl.Permission import name_trans
from AccessControl.Permissions import view_management_screens
from DateTime import DateTime from DateTime import DateTime
from DocumentTemplate.DT_Util import Eval from DocumentTemplate.DT_Util import Eval
from DocumentTemplate.DT_Util import InstanceDict, TemplateDict from DocumentTemplate.DT_Util import InstanceDict, TemplateDict
from Globals import DTMLFile from Globals import DTMLFile
from Globals import InitializeClass
from zope.interface import implements from zope.interface import implements
from interfaces import IFindSupport from interfaces import IFindSupport
...@@ -36,31 +38,32 @@ class FindSupport(ExtensionClass.Base): ...@@ -36,31 +38,32 @@ class FindSupport(ExtensionClass.Base):
implements(IFindSupport) implements(IFindSupport)
#findframe is deprecated security = ClassSecurityInfo()
#findframe is deprecated
security.declareProtected(view_management_screens, 'manage_findFrame')
manage_findFrame=DTMLFile('dtml/findFrame', globals()) manage_findFrame=DTMLFile('dtml/findFrame', globals())
security.declareProtected(view_management_screens, 'manage_findForm')
manage_findForm=DTMLFile('dtml/findForm', globals(), manage_findForm=DTMLFile('dtml/findForm', globals(),
management_view='Find') management_view='Find')
security.declareProtected(view_management_screens, 'manage_findAdv')
manage_findAdv=DTMLFile('dtml/findAdv', globals(), manage_findAdv=DTMLFile('dtml/findAdv', globals(),
management_view='Find', management_view='Find',
help_topic='Find_Advanced.stx', help_topic='Find_Advanced.stx',
help_product='OFSP') help_product='OFSP')
security.declareProtected(view_management_screens, 'manage_findResult')
manage_findResult=DTMLFile('dtml/findResult', globals(), manage_findResult=DTMLFile('dtml/findResult', globals(),
management_view='Find') management_view='Find')
__ac_permissions__=(
('View management screens',
('manage_findFrame', 'manage_findForm', 'manage_findAdv',
'manage_findResult')),
)
manage_options=( manage_options=(
{'label':'Find', 'action':'manage_findForm', {'label':'Find', 'action':'manage_findForm',
'help':('OFSP','Find.stx')}, 'help':('OFSP','Find.stx')},
) )
security = ClassSecurityInfo() security.declareProtected(view_management_screens, 'ZopeFind')
security.declareProtected('View management screens', 'ZopeFind')
def ZopeFind(self, obj, obj_ids=None, obj_metatypes=None, def ZopeFind(self, obj, obj_ids=None, obj_metatypes=None,
obj_searchterm=None, obj_expr=None, obj_searchterm=None, obj_expr=None,
obj_mtime=None, obj_mspec=None, obj_mtime=None, obj_mspec=None,
...@@ -164,10 +167,10 @@ class FindSupport(ExtensionClass.Base): ...@@ -164,10 +167,10 @@ class FindSupport(ExtensionClass.Base):
security.declareProtected('View management screens', 'PrincipiaFind') security.declareProtected(view_management_screens, 'PrincipiaFind')
PrincipiaFind=ZopeFind PrincipiaFind=ZopeFind
security.declareProtected('View management screens', 'ZopeFindAndApply') security.declareProtected(view_management_screens, 'ZopeFindAndApply')
def ZopeFindAndApply(self, obj, obj_ids=None, obj_metatypes=None, def ZopeFindAndApply(self, obj, obj_ids=None, obj_metatypes=None,
obj_searchterm=None, obj_expr=None, obj_searchterm=None, obj_expr=None,
obj_mtime=None, obj_mspec=None, obj_mtime=None, obj_mspec=None,
...@@ -259,7 +262,7 @@ class FindSupport(ExtensionClass.Base): ...@@ -259,7 +262,7 @@ class FindSupport(ExtensionClass.Base):
return result return result
Globals.InitializeClass(FindSupport) InitializeClass(FindSupport)
class td(RestrictedDTML, TemplateDict): class td(RestrictedDTML, TemplateDict):
......
lib/python/OFS/Folder.py
View file @ 41049f78
...@@ -18,7 +18,7 @@ $Id$ ...@@ -18,7 +18,7 @@ $Id$
""" """
import AccessControl.Role, webdav.Collection import AccessControl.Role, webdav.Collection
import Globals from Globals import InitializeClass
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl import Unauthorized from AccessControl import Unauthorized
from AccessControl.Permissions import add_page_templates from AccessControl.Permissions import add_page_templates
...@@ -108,4 +108,4 @@ class Folder( ...@@ -108,4 +108,4 @@ class Folder(
if id is not None: if id is not None:
self.id = str(id) self.id = str(id)
Globals.default__class_init__(Folder) InitializeClass(Folder)
lib/python/OFS/History.py
View file @ 41049f78
...@@ -15,11 +15,14 @@ ...@@ -15,11 +15,14 @@
$Id$ $Id$
""" """
import Globals, ExtensionClass, difflib import Globals, ExtensionClass, difflib
from Globals import InitializeClass
from DateTime import DateTime from DateTime import DateTime
from Acquisition import Implicit, aq_base from Acquisition import Implicit, aq_base
from struct import pack, unpack from struct import pack, unpack
from cgi import escape from cgi import escape
from zExceptions import Redirect from zExceptions import Redirect
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_history
class TemporalParadox(Exception): pass class TemporalParadox(Exception): pass
...@@ -84,26 +87,22 @@ class Historical(ExtensionClass.Base): ...@@ -84,26 +87,22 @@ class Historical(ExtensionClass.Base):
they don't have persistent sub-objects. they don't have persistent sub-objects.
""" """
HistoricalRevisions=Historian() security = ClassSecurityInfo()
__ac_permissions__=( HistoricalRevisions=Historian()
('View History',
('manage_change_history_page','manage_change_history',
'manage_historyCompare', 'manage_historicalComparison',
)
),
)
manage_options=({'label':'History', 'action':'manage_change_history_page', manage_options=({'label':'History', 'action':'manage_change_history_page',
'help':('OFSP','History.stx') 'help':('OFSP','History.stx')
}, },
) )
security.declareProtected(view_history, 'manage_change_history_page')
manage_change_history_page=Globals.DTMLFile( manage_change_history_page=Globals.DTMLFile(
'dtml/history', globals(), 'dtml/history', globals(),
HistoryBatchSize=20, HistoryBatchSize=20,
first_transaction=0, last_transaction=20) first_transaction=0, last_transaction=20)
security.declareProtected(view_history, 'manage_change_history')
def manage_change_history(self): def manage_change_history(self):
first=0 first=0
last=20 last=20
...@@ -161,6 +160,7 @@ class Historical(ExtensionClass.Base): ...@@ -161,6 +160,7 @@ class Historical(ExtensionClass.Base):
_manage_historyComparePage=Globals.DTMLFile( _manage_historyComparePage=Globals.DTMLFile(
'dtml/historyCompare', globals(), management_view='History') 'dtml/historyCompare', globals(), management_view='History')
security.declareProtected(view_history, 'manage_historyCompare')
def manage_historyCompare(self, rev1, rev2, REQUEST, def manage_historyCompare(self, rev1, rev2, REQUEST,
historyComparisonResults=''): historyComparisonResults=''):
dt1=DateTime(rev1._p_mtime) dt1=DateTime(rev1._p_mtime)
...@@ -170,6 +170,7 @@ class Historical(ExtensionClass.Base): ...@@ -170,6 +170,7 @@ class Historical(ExtensionClass.Base):
dt1=dt1, dt2=dt2, dt1=dt1, dt2=dt2,
historyComparisonResults=historyComparisonResults) historyComparisonResults=historyComparisonResults)
security.declareProtected(view_history, 'manage_historicalComparison')
def manage_historicalComparison(self, REQUEST, keys=[]): def manage_historicalComparison(self, REQUEST, keys=[]):
"Compare two selected revisions" "Compare two selected revisions"
if not keys: if not keys:
...@@ -192,7 +193,8 @@ class Historical(ExtensionClass.Base): ...@@ -192,7 +193,8 @@ class Historical(ExtensionClass.Base):
return self.manage_historyCompare(rev1, rev2, REQUEST) return self.manage_historyCompare(rev1, rev2, REQUEST)
Globals.default__class_init__(Historical) InitializeClass(Historical)
def dump(tag, x, lo, hi, r): def dump(tag, x, lo, hi, r):
r1=[] r1=[]
......
lib/python/OFS/Image.py
View file @ 41049f78
...@@ -14,11 +14,18 @@ ...@@ -14,11 +14,18 @@
$Id$ $Id$
""" """
import Globals, struct import struct
from OFS.content_types import guess_content_type from OFS.content_types import guess_content_type
from Globals import DTMLFile from Globals import DTMLFile
from Globals import InitializeClass
from PropertyManager import PropertyManager from PropertyManager import PropertyManager
from AccessControl import ClassSecurityInfo
from AccessControl.Role import RoleManager from AccessControl.Role import RoleManager
from AccessControl.Permissions import change_images_and_files
from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import view as View
from AccessControl.Permissions import ftp_access
from AccessControl.Permissions import delete_objects
from webdav.common import rfc1123_date from webdav.common import rfc1123_date
from webdav.Lockable import ResourceLockedError from webdav.Lockable import ResourceLockedError
from webdav.WriteLockInterface import WriteLockInterface from webdav.WriteLockInterface import WriteLockInterface
...@@ -74,6 +81,8 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -74,6 +81,8 @@ class File(Persistent, Implicit, PropertyManager,
__implements__ = (WriteLockInterface, HTTPRangeSupport.HTTPRangeInterface) __implements__ = (WriteLockInterface, HTTPRangeSupport.HTTPRangeInterface)
meta_type='File' meta_type='File'
security = ClassSecurityInfo()
security.declareObjectProtected(View)
precondition='' precondition=''
size=None size=None
...@@ -82,6 +91,9 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -82,6 +91,9 @@ class File(Persistent, Implicit, PropertyManager,
manage_editForm =DTMLFile('dtml/fileEdit',globals(), manage_editForm =DTMLFile('dtml/fileEdit',globals(),
Kind='File',kind='file') Kind='File',kind='file')
manage_editForm._setName('manage_editForm') manage_editForm._setName('manage_editForm')
security.declareProtected(view_management_screens, 'manage')
security.declareProtected(view_management_screens, 'manage_main')
manage=manage_main=manage_editForm manage=manage_main=manage_editForm
manage_uploadForm=manage_editForm manage_uploadForm=manage_editForm
...@@ -98,22 +110,6 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -98,22 +110,6 @@ class File(Persistent, Implicit, PropertyManager,
+ Cacheable.manage_options + Cacheable.manage_options
) )
__ac_permissions__=(
('View management screens',
('manage', 'manage_main',)),
('Change Images and Files',
('manage_edit','manage_upload','PUT')),
('View',
('index_html', 'view_image_or_file', 'get_size',
'getContentType', 'PrincipiaSearchSource', '')),
('FTP access',
('manage_FTPstat','manage_FTPget','manage_FTPlist')),
('Delete objects',
('DELETE',)),
)
_properties=({'id':'title', 'type': 'string'}, _properties=({'id':'title', 'type': 'string'},
{'id':'alt', 'type':'string'}, {'id':'alt', 'type':'string'},
{'id':'content_type', 'type':'string'}, {'id':'content_type', 'type':'string'},
...@@ -355,6 +351,7 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -355,6 +351,7 @@ class File(Persistent, Implicit, PropertyManager,
RESPONSE.write('\r\n--%s--\r\n' % boundary) RESPONSE.write('\r\n--%s--\r\n' % boundary)
return True return True
security.declareProtected(View, 'index_html')
def index_html(self, REQUEST, RESPONSE): def index_html(self, REQUEST, RESPONSE):
""" """
The default view of the contents of a File or Image. The default view of the contents of a File or Image.
...@@ -414,12 +411,14 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -414,12 +411,14 @@ class File(Persistent, Implicit, PropertyManager,
return '' return ''
security.declareProtected(View, 'view_image_or_file')
def view_image_or_file(self, URL1): def view_image_or_file(self, URL1):
""" """
The default view of the contents of the File or Image. The default view of the contents of the File or Image.
""" """
raise Redirect, URL1 raise Redirect, URL1
security.declareProtected(View, 'PrincipiaSearchSource')
def PrincipiaSearchSource(self): def PrincipiaSearchSource(self):
""" Allow file objects to be searched. """ Allow file objects to be searched.
""" """
...@@ -427,8 +426,7 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -427,8 +426,7 @@ class File(Persistent, Implicit, PropertyManager,
return str(self.data) return str(self.data)
return '' return ''
# private security.declarePrivate('update_data')
update_data__roles__=()
def update_data(self, data, content_type=None, size=None): def update_data(self, data, content_type=None, size=None):
if content_type is not None: self.content_type=content_type if content_type is not None: self.content_type=content_type
if size is None: size=len(data) if size is None: size=len(data)
...@@ -438,6 +436,7 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -438,6 +436,7 @@ class File(Persistent, Implicit, PropertyManager,
self.ZCacheable_set(None) self.ZCacheable_set(None)
self.http__refreshEtag() self.http__refreshEtag()
security.declareProtected(change_images_and_files, 'manage_edit')
def manage_edit(self, title, content_type, precondition='', def manage_edit(self, title, content_type, precondition='',
filedata=None, REQUEST=None): filedata=None, REQUEST=None):
""" """
...@@ -458,6 +457,7 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -458,6 +457,7 @@ class File(Persistent, Implicit, PropertyManager,
message="Saved changes." message="Saved changes."
return self.manage_main(self,REQUEST,manage_tabs_message=message) return self.manage_main(self,REQUEST,manage_tabs_message=message)
security.declareProtected(change_images_and_files, 'manage_upload')
def manage_upload(self,file='',REQUEST=None): def manage_upload(self,file='',REQUEST=None):
""" """
Replaces the current contents of the File or Image object with file. Replaces the current contents of the File or Image object with file.
...@@ -553,6 +553,9 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -553,6 +553,9 @@ class File(Persistent, Implicit, PropertyManager,
return next, size return next, size
security.declareProtected(delete_objects, 'DELETE')
security.declareProtected(change_images_and_files, 'PUT')
def PUT(self, REQUEST, RESPONSE): def PUT(self, REQUEST, RESPONSE):
"""Handle HTTP PUT requests""" """Handle HTTP PUT requests"""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -569,6 +572,7 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -569,6 +572,7 @@ class File(Persistent, Implicit, PropertyManager,
RESPONSE.setStatus(204) RESPONSE.setStatus(204)
return RESPONSE return RESPONSE
security.declareProtected(View, 'get_size')
def get_size(self): def get_size(self):
"""Get the size of a file or image. """Get the size of a file or image.
...@@ -581,6 +585,7 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -581,6 +585,7 @@ class File(Persistent, Implicit, PropertyManager,
# deprecated; use get_size! # deprecated; use get_size!
getSize=get_size getSize=get_size
security.declareProtected(View, 'getContentType')
def getContentType(self): def getContentType(self):
"""Get the content type of a file or image. """Get the content type of a file or image.
...@@ -592,6 +597,10 @@ class File(Persistent, Implicit, PropertyManager, ...@@ -592,6 +597,10 @@ class File(Persistent, Implicit, PropertyManager,
def __str__(self): return str(self.data) def __str__(self): return str(self.data)
def __len__(self): return 1 def __len__(self): return 1
security.declareProtected(ftp_access, 'manage_FTPstat')
security.declareProtected(ftp_access, 'manage_FTPlist')
security.declareProtected(ftp_access, 'manage_FTPget')
def manage_FTPget(self): def manage_FTPget(self):
"""Return body for ftp.""" """Return body for ftp."""
RESPONSE = self.REQUEST.RESPONSE RESPONSE = self.REQUEST.RESPONSE
...@@ -719,23 +728,23 @@ class Image(File): ...@@ -719,23 +728,23 @@ class Image(File):
__implements__ = (WriteLockInterface,) __implements__ = (WriteLockInterface,)
meta_type='Image' meta_type='Image'
security = ClassSecurityInfo()
security.declareObjectProtected(View)
height='' height=''
width='' width=''
__ac_permissions__=( # FIXME: Redundant, already in base class
('View management screens', security.declareProtected(change_images_and_files, 'manage_edit')
('manage', 'manage_main',)), security.declareProtected(change_images_and_files, 'manage_upload')
('Change Images and Files', security.declareProtected(change_images_and_files, 'PUT')
('manage_edit','manage_upload','PUT')), security.declareProtected(View, 'index_html')
('View', security.declareProtected(View, 'get_size')
('index_html', 'tag', 'view_image_or_file', 'get_size', security.declareProtected(View, 'getContentType')
'getContentType', '')), security.declareProtected(ftp_access, 'manage_FTPstat')
('FTP access', security.declareProtected(ftp_access, 'manage_FTPlist')
('manage_FTPstat','manage_FTPget','manage_FTPlist')), security.declareProtected(ftp_access, 'manage_FTPget')
('Delete objects', security.declareProtected(delete_objects, 'DELETE')
('DELETE',)),
)
_properties=({'id':'title', 'type': 'string'}, _properties=({'id':'title', 'type': 'string'},
{'id':'content_type', 'type':'string','mode':'w'}, {'id':'content_type', 'type':'string','mode':'w'},
...@@ -756,13 +765,17 @@ class Image(File): ...@@ -756,13 +765,17 @@ class Image(File):
manage_editForm =DTMLFile('dtml/imageEdit',globals(), manage_editForm =DTMLFile('dtml/imageEdit',globals(),
Kind='Image',kind='image') Kind='Image',kind='image')
view_image_or_file =DTMLFile('dtml/imageView',globals())
manage_editForm._setName('manage_editForm') manage_editForm._setName('manage_editForm')
security.declareProtected(View, 'view_image_or_file')
view_image_or_file =DTMLFile('dtml/imageView',globals())
security.declareProtected(view_management_screens, 'manage')
security.declareProtected(view_management_screens, 'manage_main')
manage=manage_main=manage_editForm manage=manage_main=manage_editForm
manage_uploadForm=manage_editForm manage_uploadForm=manage_editForm
# private security.declarePrivate('update_data')
update_data__roles__=()
def update_data(self, data, content_type=None, size=None): def update_data(self, data, content_type=None, size=None):
if size is None: size=len(data) if size is None: size=len(data)
...@@ -785,6 +798,7 @@ class Image(File): ...@@ -785,6 +798,7 @@ class Image(File):
def __str__(self): def __str__(self):
return self.tag() return self.tag()
security.declareProtected(View, 'tag')
def tag(self, height=None, width=None, alt=None, def tag(self, height=None, width=None, alt=None,
scale=0, xscale=0, yscale=0, css_class=None, title=None, **args): scale=0, xscale=0, yscale=0, css_class=None, title=None, **args):
""" """
......
lib/python/OFS/ObjectManager.py
View file @ 41049f78
...@@ -24,13 +24,20 @@ from types import StringType, UnicodeType ...@@ -24,13 +24,20 @@ from types import StringType, UnicodeType
import App.Common import App.Common
import App.FactoryDispatcher, Products import App.FactoryDispatcher, Products
import App.Management, Acquisition, Globals, Products import App.Management, Acquisition
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import access_contents_information
from AccessControl.Permissions import delete_objects
from AccessControl.Permissions import ftp_access
from AccessControl.Permissions import import_export_objects
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.ZopeSecurityPolicy import getRoles from AccessControl.ZopeSecurityPolicy import getRoles
from Acquisition import aq_base from Acquisition import aq_base
from App.config import getConfiguration from App.config import getConfiguration
from Globals import InitializeClass
from Globals import DTMLFile, Persistent from Globals import DTMLFile, Persistent
from Globals import MessageDialog, default__class_init__ from Globals import MessageDialog
from Globals import REPLACEABLE, NOT_REPLACEABLE, UNIQUE from Globals import REPLACEABLE, NOT_REPLACEABLE, UNIQUE
from webdav.Collection import Collection from webdav.Collection import Collection
from webdav.Lockable import ResourceLockedError from webdav.Lockable import ResourceLockedError
...@@ -133,20 +140,10 @@ class ObjectManager( ...@@ -133,20 +140,10 @@ class ObjectManager(
implements(IObjectManager) implements(IObjectManager)
__ac_permissions__=( security = ClassSecurityInfo()
('View management screens', ('manage_main',)), security.declareObjectProtected(access_contents_information)
('Access contents information', security.setPermissionDefault(access_contents_information,
('objectIds', 'objectValues', 'objectItems',''), ('Anonymous', 'Manager'))
('Anonymous', 'Manager'),
),
('Delete objects', ('manage_delObjects',)),
('FTP access', ('manage_FTPstat','manage_FTPlist')),
('Import/Export objects',
('manage_importObject','manage_importExportForm',
'manage_exportObject')
),
)
meta_type = 'Object Manager' meta_type = 'Object Manager'
...@@ -154,7 +151,9 @@ class ObjectManager( ...@@ -154,7 +151,9 @@ class ObjectManager(
_objects = () _objects = ()
security.declareProtected(view_management_screens, 'manage_main')
manage_main=DTMLFile('dtml/main', globals()) manage_main=DTMLFile('dtml/main', globals())
manage_index_main=DTMLFile('dtml/index_main', globals()) manage_index_main=DTMLFile('dtml/index_main', globals())
manage_options=( manage_options=(
...@@ -177,7 +176,7 @@ class ObjectManager( ...@@ -177,7 +176,7 @@ class ObjectManager(
mt.sort() mt.sort()
self.meta_types=tuple(mt) self.meta_types=tuple(mt)
default__class_init__(self) InitializeClass(self) # default__class_init__
def all_meta_types(self, interfaces=None): def all_meta_types(self, interfaces=None):
# A list of products registered elsewhere # A list of products registered elsewhere
...@@ -362,6 +361,7 @@ class ObjectManager( ...@@ -362,6 +361,7 @@ class ObjectManager(
if not suppress_events: if not suppress_events:
notify(ObjectRemovedEvent(ob, self, id)) notify(ObjectRemovedEvent(ob, self, id))
security.declareProtected(access_contents_information, 'objectIds')
def objectIds(self, spec=None): def objectIds(self, spec=None):
# Returns a list of subobject ids of the current object. # Returns a list of subobject ids of the current object.
# If 'spec' is specified, returns objects whose meta_type # If 'spec' is specified, returns objects whose meta_type
...@@ -376,12 +376,14 @@ class ObjectManager( ...@@ -376,12 +376,14 @@ class ObjectManager(
return set return set
return [ o['id'] for o in self._objects ] return [ o['id'] for o in self._objects ]
security.declareProtected(access_contents_information, 'objectValues')
def objectValues(self, spec=None): def objectValues(self, spec=None):
# Returns a list of actual subobjects of the current object. # Returns a list of actual subobjects of the current object.
# If 'spec' is specified, returns only objects whose meta_type # If 'spec' is specified, returns only objects whose meta_type
# match 'spec'. # match 'spec'.
return [ self._getOb(id) for id in self.objectIds(spec) ] return [ self._getOb(id) for id in self.objectIds(spec) ]
security.declareProtected(access_contents_information, 'objectItems')
def objectItems(self, spec=None): def objectItems(self, spec=None):
# Returns a list of (id, subobject) tuples of the current object. # Returns a list of (id, subobject) tuples of the current object.
# If 'spec' is specified, returns only objects whose meta_type match # If 'spec' is specified, returns only objects whose meta_type match
...@@ -456,6 +458,7 @@ class ObjectManager( ...@@ -456,6 +458,7 @@ class ObjectManager(
manage_addProduct=App.FactoryDispatcher.ProductDispatcher() manage_addProduct=App.FactoryDispatcher.ProductDispatcher()
security.declareProtected(delete_objects, 'manage_delObjects')
def manage_delObjects(self, ids=[], REQUEST=None): def manage_delObjects(self, ids=[], REQUEST=None):
"""Delete a subordinate object """Delete a subordinate object
...@@ -512,6 +515,7 @@ class ObjectManager( ...@@ -512,6 +515,7 @@ class ObjectManager(
r.append(o) r.append(o)
return r return r
security.declareProtected(import_export_objects, 'manage_exportObject')
def manage_exportObject(self, id='', download=None, toxml=None, def manage_exportObject(self, id='', download=None, toxml=None,
RESPONSE=None,REQUEST=None): RESPONSE=None,REQUEST=None):
"""Exports an object to a file and returns that file.""" """Exports an object to a file and returns that file."""
...@@ -548,8 +552,10 @@ class ObjectManager( ...@@ -548,8 +552,10 @@ class ObjectManager(
title = 'Object exported') title = 'Object exported')
security.declareProtected(import_export_objects, 'manage_importExportForm')
manage_importExportForm=DTMLFile('dtml/importExport',globals()) manage_importExportForm=DTMLFile('dtml/importExport',globals())
security.declareProtected(import_export_objects, 'manage_importObject')
def manage_importObject(self, file, REQUEST=None, set_owner=1): def manage_importObject(self, file, REQUEST=None, set_owner=1):
"""Import an object from a file""" """Import an object from a file"""
dirname, file=os.path.split(file) dirname, file=os.path.split(file)
...@@ -608,6 +614,7 @@ class ObjectManager( ...@@ -608,6 +614,7 @@ class ObjectManager(
# FTP support methods # FTP support methods
security.declareProtected(ftp_access, 'manage_FTPlist')
def manage_FTPlist(self, REQUEST): def manage_FTPlist(self, REQUEST):
"""Directory listing for FTP. """Directory listing for FTP.
""" """
...@@ -672,6 +679,7 @@ class ObjectManager( ...@@ -672,6 +679,7 @@ class ObjectManager(
if not REQUEST['id'] in self.objectIds(): if not REQUEST['id'] in self.objectIds():
raise KeyError(REQUEST['id']) raise KeyError(REQUEST['id'])
security.declareProtected(ftp_access, 'manage_FTPstat')
def manage_FTPstat(self,REQUEST): def manage_FTPstat(self,REQUEST):
"""Psuedo stat, used by FTP for directory listings. """Psuedo stat, used by FTP for directory listings.
""" """
...@@ -710,6 +718,9 @@ class ObjectManager( ...@@ -710,6 +718,9 @@ class ObjectManager(
return NullResource(self, key, request).__of__(self) return NullResource(self, key, request).__of__(self)
raise KeyError, key raise KeyError, key
# Don't InitializeClass, there is a specific __class_init__ on ObjectManager
# InitializeClass(ObjectManager)
def findChildren(obj,dirname=''): def findChildren(obj,dirname=''):
""" recursive walk through the object hierarchy to """ recursive walk through the object hierarchy to
...@@ -738,5 +749,3 @@ class IFAwareObjectManager: ...@@ -738,5 +749,3 @@ class IFAwareObjectManager:
except: pass # Bleah generic pass is bad except: pass # Bleah generic pass is bad
return ObjectManager.all_meta_types(self, interfaces) return ObjectManager.all_meta_types(self, interfaces)
Globals.default__class_init__(ObjectManager)
lib/python/OFS/PropertyManager.py
View file @ 41049f78
...@@ -18,7 +18,11 @@ $Id$ ...@@ -18,7 +18,11 @@ $Id$
from cgi import escape from cgi import escape
from types import ListType from types import ListType
import ExtensionClass, Globals import ExtensionClass
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import access_contents_information
from AccessControl.Permissions import manage_properties
from Acquisition import aq_base from Acquisition import aq_base
from Globals import DTMLFile, MessageDialog from Globals import DTMLFile, MessageDialog
from Globals import Persistent from Globals import Persistent
...@@ -97,35 +101,26 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -97,35 +101,26 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
implements(IPropertyManager) implements(IPropertyManager)
security = ClassSecurityInfo()
security.declareObjectProtected(access_contents_information)
security.setPermissionDefault(access_contents_information,
('Anonymous', 'Manager'))
manage_options=( manage_options=(
{'label':'Properties', 'action':'manage_propertiesForm', {'label':'Properties', 'action':'manage_propertiesForm',
'help':('OFSP','Properties.stx')}, 'help':('OFSP','Properties.stx')},
) )
security.declareProtected(manage_properties, 'manage_propertiesForm')
manage_propertiesForm=DTMLFile('dtml/properties', globals(), manage_propertiesForm=DTMLFile('dtml/properties', globals(),
property_extensible_schema__=1) property_extensible_schema__=1)
security.declareProtected(manage_properties, 'manage_propertyTypeForm')
manage_propertyTypeForm=DTMLFile('dtml/propertyType', globals()) manage_propertyTypeForm=DTMLFile('dtml/propertyType', globals())
title='' title=''
_properties=({'id':'title', 'type': 'string', 'mode':'wd'},) _properties=({'id':'title', 'type': 'string', 'mode':'wd'},)
_reserved_names=() _reserved_names=()
__ac_permissions__=(
('Manage properties', ('manage_addProperty',
'manage_editProperties',
'manage_delProperties',
'manage_changeProperties',
'manage_propertiesForm',
'manage_propertyTypeForm',
'manage_changePropertyTypes',
)),
('Access contents information',
('hasProperty', 'propertyIds', 'propertyValues','propertyItems',
'getProperty', 'getPropertyType', 'propertyMap', ''),
('Anonymous', 'Manager'),
),
)
__propsets__=() __propsets__=()
propertysheets=vps(DefaultPropertySheets) propertysheets=vps(DefaultPropertySheets)
...@@ -135,6 +130,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -135,6 +130,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
return 0 return 0
return 1 return 1
security.declareProtected(access_contents_information, 'hasProperty')
def hasProperty(self, id): def hasProperty(self, id):
"""Return true if object has a property 'id'. """Return true if object has a property 'id'.
""" """
...@@ -143,6 +139,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -143,6 +139,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
return 1 return 1
return 0 return 0
security.declareProtected(access_contents_information, 'getProperty')
def getProperty(self, id, d=None): def getProperty(self, id, d=None):
"""Get the property 'id'. """Get the property 'id'.
...@@ -153,6 +150,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -153,6 +150,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
return getattr(self, id) return getattr(self, id)
return d return d
security.declareProtected(access_contents_information, 'getPropertyType')
def getPropertyType(self, id): def getPropertyType(self, id):
"""Get the type of property 'id'. """Get the type of property 'id'.
...@@ -220,16 +218,19 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -220,16 +218,19 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
self._properties=tuple(filter(lambda i, n=id: i['id'] != n, self._properties=tuple(filter(lambda i, n=id: i['id'] != n,
self._properties)) self._properties))
security.declareProtected(access_contents_information, 'propertyIds')
def propertyIds(self): def propertyIds(self):
"""Return a list of property ids. """Return a list of property ids.
""" """
return map(lambda i: i['id'], self._properties) return map(lambda i: i['id'], self._properties)
security.declareProtected(access_contents_information, 'propertyValues')
def propertyValues(self): def propertyValues(self):
"""Return a list of actual property objects. """Return a list of actual property objects.
""" """
return map(lambda i,s=self: getattr(s,i['id']), self._properties) return map(lambda i,s=self: getattr(s,i['id']), self._properties)
security.declareProtected(access_contents_information, 'propertyItems')
def propertyItems(self): def propertyItems(self):
"""Return a list of (id,property) tuples. """Return a list of (id,property) tuples.
""" """
...@@ -240,6 +241,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -240,6 +241,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
""" """
return self._properties return self._properties
security.declareProtected(access_contents_information, 'propertyMap')
def propertyMap(self): def propertyMap(self):
"""Return a tuple of mappings, giving meta-data for properties. """Return a tuple of mappings, giving meta-data for properties.
...@@ -264,6 +266,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -264,6 +266,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
# Web interface # Web interface
security.declareProtected(manage_properties, 'manage_addProperty')
def manage_addProperty(self, id, value, type, REQUEST=None): def manage_addProperty(self, id, value, type, REQUEST=None):
"""Add a new property via the web. """Add a new property via the web.
...@@ -275,6 +278,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -275,6 +278,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
if REQUEST is not None: if REQUEST is not None:
return self.manage_propertiesForm(self, REQUEST) return self.manage_propertiesForm(self, REQUEST)
security.declareProtected(manage_properties, 'manage_editProperties')
def manage_editProperties(self, REQUEST): def manage_editProperties(self, REQUEST):
"""Edit object properties via the web. """Edit object properties via the web.
...@@ -296,6 +300,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -296,6 +300,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
return self.manage_propertiesForm(self,REQUEST, return self.manage_propertiesForm(self,REQUEST,
manage_tabs_message=message) manage_tabs_message=message)
security.declareProtected(manage_properties, 'manage_changeProperties')
def manage_changeProperties(self, REQUEST=None, **kw): def manage_changeProperties(self, REQUEST=None, **kw):
"""Change existing object properties. """Change existing object properties.
...@@ -321,6 +326,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -321,6 +326,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
# Note - this is experimental, pending some community input. # Note - this is experimental, pending some community input.
security.declareProtected(manage_properties, 'manage_changePropertyTypes')
def manage_changePropertyTypes(self, old_ids, props, REQUEST=None): def manage_changePropertyTypes(self, old_ids, props, REQUEST=None):
"""Replace one set of properties with another """Replace one set of properties with another
...@@ -340,6 +346,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -340,6 +346,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
return self.manage_propertiesForm(self, REQUEST) return self.manage_propertiesForm(self, REQUEST)
security.declareProtected(manage_properties, 'manage_delProperties')
def manage_delProperties(self, ids=None, REQUEST=None): def manage_delProperties(self, ids=None, REQUEST=None):
"""Delete one or more properties specified by 'ids'.""" """Delete one or more properties specified by 'ids'."""
if REQUEST: if REQUEST:
...@@ -367,4 +374,4 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes): ...@@ -367,4 +374,4 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
if REQUEST is not None: if REQUEST is not None:
return self.manage_propertiesForm(self, REQUEST) return self.manage_propertiesForm(self, REQUEST)
Globals.default__class_init__(PropertyManager) InitializeClass(PropertyManager)
lib/python/OFS/PropertySheets.py
View file @ 41049f78
...@@ -18,6 +18,7 @@ import time, App.Management, Globals, sys ...@@ -18,6 +18,7 @@ import time, App.Management, Globals, sys
from webdav.interfaces import IWriteLock from webdav.interfaces import IWriteLock
from webdav.WriteLockInterface import WriteLockInterface from webdav.WriteLockInterface import WriteLockInterface
from ZPublisher.Converters import type_converters from ZPublisher.Converters import type_converters
from Globals import InitializeClass
from Globals import DTMLFile, MessageDialog from Globals import DTMLFile, MessageDialog
from Acquisition import Implicit, Explicit from Acquisition import Implicit, Explicit
from App.Common import rfc1123_date, iso8601_date from App.Common import rfc1123_date, iso8601_date
...@@ -26,6 +27,10 @@ from ExtensionClass import Base ...@@ -26,6 +27,10 @@ from ExtensionClass import Base
from Globals import Persistent from Globals import Persistent
from Traversable import Traversable from Traversable import Traversable
from Acquisition import aq_base from Acquisition import aq_base
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import access_contents_information
from AccessControl.Permissions import manage_properties
from AccessControl.Permissions import view_management_screens
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from webdav.common import isDavCollection from webdav.common import isDavCollection
from zExceptions import BadRequest, Redirect from zExceptions import BadRequest, Redirect
...@@ -100,20 +105,10 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -100,20 +105,10 @@ class PropertySheet(Traversable, Persistent, Implicit):
_extensible=1 _extensible=1
icon='p_/Properties_icon' icon='p_/Properties_icon'
__ac_permissions__=( security = ClassSecurityInfo()
('Manage properties', ('manage_addProperty', security.declareObjectProtected(access_contents_information)
'manage_editProperties', security.setPermissionDefault(access_contents_information,
'manage_delProperties', ('Anonymous', 'Manager'))
'manage_changeProperties',
'manage_propertiesForm',
)),
('Access contents information',
('xml_namespace', 'hasProperty', 'getProperty', 'getPropertyType',
'propertyIds', 'propertyValues','propertyItems', 'propertyInfo',
'propertyMap', ''),
('Anonymous', 'Manager'),
),
)
__reserved_ids= ('values','items') __reserved_ids= ('values','items')
...@@ -139,6 +134,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -139,6 +134,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
def getId(self): def getId(self):
return self.id return self.id
security.declareProtected(access_contents_information, 'xml_namespace')
def xml_namespace(self): def xml_namespace(self):
# Return a namespace string usable as an xml namespace # Return a namespace string usable as an xml namespace
# for this property set. # for this property set.
...@@ -156,6 +152,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -156,6 +152,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
return 0 return 0
return 1 return 1
security.declareProtected(access_contents_information, 'hasProperty')
def hasProperty(self, id): def hasProperty(self, id):
# Return a true value if a property exists with the given id. # Return a true value if a property exists with the given id.
for prop in self._propertyMap(): for prop in self._propertyMap():
...@@ -163,6 +160,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -163,6 +160,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
return 1 return 1
return 0 return 0
security.declareProtected(access_contents_information, 'getProperty')
def getProperty(self, id, default=None): def getProperty(self, id, default=None):
# Return the property with the given id, returning the optional # Return the property with the given id, returning the optional
# second argument or None if no such property is found. # second argument or None if no such property is found.
...@@ -170,6 +168,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -170,6 +168,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
return getattr(self.v_self(), id) return getattr(self.v_self(), id)
return default return default
security.declareProtected(access_contents_information, 'getPropertyType')
def getPropertyType(self, id): def getPropertyType(self, id):
"""Get the type of property 'id', returning None if no """Get the type of property 'id', returning None if no
such property exists""" such property exists"""
...@@ -263,20 +262,24 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -263,20 +262,24 @@ class PropertySheet(Traversable, Persistent, Implicit):
pself._properties=tuple(filter(lambda i, n=id: i['id'] != n, pself._properties=tuple(filter(lambda i, n=id: i['id'] != n,
pself._properties)) pself._properties))
security.declareProtected(access_contents_information, 'propertyIds')
def propertyIds(self): def propertyIds(self):
# Return a list of property ids. # Return a list of property ids.
return map(lambda i: i['id'], self._propertyMap()) return map(lambda i: i['id'], self._propertyMap())
security.declareProtected(access_contents_information, 'propertyValues')
def propertyValues(self): def propertyValues(self):
# Return a list of property values. # Return a list of property values.
return map(lambda i, s=self: s.getProperty(i['id']), return map(lambda i, s=self: s.getProperty(i['id']),
self._propertyMap()) self._propertyMap())
security.declareProtected(access_contents_information, 'propertyItems')
def propertyItems(self): def propertyItems(self):
# Return a list of (id, property) tuples. # Return a list of (id, property) tuples.
return map(lambda i, s=self: (i['id'], s.getProperty(i['id'])), return map(lambda i, s=self: (i['id'], s.getProperty(i['id'])),
self._propertyMap()) self._propertyMap())
security.declareProtected(access_contents_information, 'propertyInfo')
def propertyInfo(self, id): def propertyInfo(self, id):
# Return a mapping containing property meta-data # Return a mapping containing property meta-data
for p in self._propertyMap(): for p in self._propertyMap():
...@@ -289,6 +292,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -289,6 +292,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
# we have to fake it... # we have to fake it...
return self.p_self()._properties return self.p_self()._properties
security.declareProtected(access_contents_information, 'propertyMap')
def propertyMap(self): def propertyMap(self):
# Returns a secure copy of the property definitions. # Returns a secure copy of the property definitions.
return tuple(map(lambda dict: dict.copy(), self._propertyMap())) return tuple(map(lambda dict: dict.copy(), self._propertyMap()))
...@@ -399,10 +403,13 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -399,10 +403,13 @@ class PropertySheet(Traversable, Persistent, Implicit):
# Web interface # Web interface
manage=DTMLFile('dtml/properties', globals()) manage=DTMLFile('dtml/properties', globals())
security.declareProtected(manage_properties, 'manage_propertiesForm')
def manage_propertiesForm(self, URL1): def manage_propertiesForm(self, URL1):
" " " "
raise Redirect, URL1+'/manage' raise Redirect, URL1+'/manage'
security.declareProtected(manage_properties, 'manage_addProperty')
def manage_addProperty(self, id, value, type, REQUEST=None): def manage_addProperty(self, id, value, type, REQUEST=None):
"""Add a new property via the web. Sets a new property with """Add a new property via the web. Sets a new property with
the given id, type, and value.""" the given id, type, and value."""
...@@ -412,6 +419,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -412,6 +419,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
if REQUEST is not None: if REQUEST is not None:
return self.manage(self, REQUEST) return self.manage(self, REQUEST)
security.declareProtected(manage_properties, 'manage_editProperties')
def manage_editProperties(self, REQUEST): def manage_editProperties(self, REQUEST):
"""Edit object properties via the web.""" """Edit object properties via the web."""
for prop in self._propertyMap(): for prop in self._propertyMap():
...@@ -424,6 +432,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -424,6 +432,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
message='Your changes have been saved', message='Your changes have been saved',
action ='manage') action ='manage')
security.declareProtected(manage_properties, 'manage_changeProperties')
def manage_changeProperties(self, REQUEST=None, **kw): def manage_changeProperties(self, REQUEST=None, **kw):
"""Change existing object properties by passing either a mapping """Change existing object properties by passing either a mapping
object of name:value pairs {'foo':6} or passing name=value object of name:value pairs {'foo':6} or passing name=value
...@@ -446,6 +455,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -446,6 +455,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
message='Your changes have been saved.', message='Your changes have been saved.',
action ='manage') action ='manage')
security.declareProtected(manage_properties, 'manage_delProperties')
def manage_delProperties(self, ids=None, REQUEST=None): def manage_delProperties(self, ids=None, REQUEST=None):
"""Delete one or more properties specified by 'ids'.""" """Delete one or more properties specified by 'ids'."""
if REQUEST: if REQUEST:
...@@ -462,7 +472,7 @@ class PropertySheet(Traversable, Persistent, Implicit): ...@@ -462,7 +472,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
if REQUEST is not None: if REQUEST is not None:
return self.manage(self, REQUEST) return self.manage(self, REQUEST)
Globals.default__class_init__(PropertySheet) InitializeClass(PropertySheet)
class Virtual: class Virtual:
...@@ -483,7 +493,7 @@ class DefaultProperties(Virtual, PropertySheet, View): ...@@ -483,7 +493,7 @@ class DefaultProperties(Virtual, PropertySheet, View):
id='default' id='default'
_md={'xmlns': 'http://www.zope.org/propsets/default'} _md={'xmlns': 'http://www.zope.org/propsets/default'}
Globals.default__class_init__(DefaultProperties) InitializeClass(DefaultProperties)
class DAVProperties(Virtual, PropertySheet, View): class DAVProperties(Virtual, PropertySheet, View):
...@@ -596,7 +606,7 @@ class DAVProperties(Virtual, PropertySheet, View): ...@@ -596,7 +606,7 @@ class DAVProperties(Virtual, PropertySheet, View):
return out return out
Globals.default__class_init__(DAVProperties) InitializeClass(DAVProperties)
class PropertySheets(Traversable, Implicit, App.Management.Tabs): class PropertySheets(Traversable, Implicit, App.Management.Tabs):
...@@ -605,18 +615,10 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -605,18 +615,10 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
id='propertysheets' id='propertysheets'
__ac_permissions__=( security = ClassSecurityInfo()
('Manage properties', ('manage_addPropertySheet', security.declareObjectProtected(access_contents_information)
'addPropertySheet', security.setPermissionDefault(access_contents_information,
'delPropertySheet' ('Anonymous', 'Manager'))
)),
('Access contents information',
('items', 'values', 'get', ''),
('Anonymous', 'Manager'),
),
('View management screens', ('manage',)),
)
# optionally to be overridden by derived classes # optionally to be overridden by derived classes
PropertySheetClass= PropertySheet PropertySheetClass= PropertySheet
...@@ -639,10 +641,12 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -639,10 +641,12 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
def __getitem__(self, n): def __getitem__(self, n):
return self.__propsets__()[n].__of__(self) return self.__propsets__()[n].__of__(self)
security.declareProtected(access_contents_information, 'values')
def values(self): def values(self):
propsets=self.__propsets__() propsets=self.__propsets__()
return map(lambda n, s=self: n.__of__(s), propsets) return map(lambda n, s=self: n.__of__(s), propsets)
security.declareProtected(access_contents_information, 'items')
def items(self): def items(self):
propsets=self.__propsets__() propsets=self.__propsets__()
r=[] r=[]
...@@ -653,6 +657,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -653,6 +657,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
return r return r
security.declareProtected(access_contents_information, 'get')
def get(self, name, default=None): def get(self, name, default=None):
for propset in self.__propsets__(): for propset in self.__propsets__():
if propset.id==name or (hasattr(propset, 'xml_namespace') and \ if propset.id==name or (hasattr(propset, 'xml_namespace') and \
...@@ -660,6 +665,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -660,6 +665,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
return propset.__of__(self) return propset.__of__(self)
return default return default
security.declareProtected(manage_properties, 'manage_addPropertySheet')
def manage_addPropertySheet(self, id, ns, REQUEST=None): def manage_addPropertySheet(self, id, ns, REQUEST=None):
""" """ """ """
md={'xmlns':ns} md={'xmlns':ns}
...@@ -669,11 +675,13 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -669,11 +675,13 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
ps= self.get(id) ps= self.get(id)
REQUEST.RESPONSE.redirect('%s/manage' % ps.absolute_url()) REQUEST.RESPONSE.redirect('%s/manage' % ps.absolute_url())
security.declareProtected(manage_properties, 'addPropertySheet')
def addPropertySheet(self, propset): def addPropertySheet(self, propset):
propsets=self.aq_parent.__propsets__ propsets=self.aq_parent.__propsets__
propsets=propsets+(propset,) propsets=propsets+(propset,)
self.aq_parent.__propsets__=propsets self.aq_parent.__propsets__=propsets
security.declareProtected(manage_properties, 'delPropertySheet')
def delPropertySheet(self, name): def delPropertySheet(self, name):
result=[] result=[]
for propset in self.aq_parent.__propsets__: for propset in self.aq_parent.__propsets__:
...@@ -709,6 +717,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -709,6 +717,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
# Management interface: # Management interface:
security.declareProtected(view_management_screens, 'manage')
manage=Globals.DTMLFile('dtml/propertysheets', globals()) manage=Globals.DTMLFile('dtml/propertysheets', globals())
def manage_options(self): def manage_options(self):
...@@ -737,7 +746,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs): ...@@ -737,7 +746,7 @@ class PropertySheets(Traversable, Implicit, App.Management.Tabs):
return PropertySheets.inheritedAttribute('tabs_path_info')( return PropertySheets.inheritedAttribute('tabs_path_info')(
self, script, path) self, script, path)
Globals.default__class_init__(PropertySheets) InitializeClass(PropertySheets)
class DefaultPropertySheets(PropertySheets): class DefaultPropertySheets(PropertySheets):
...@@ -749,7 +758,7 @@ class DefaultPropertySheets(PropertySheets): ...@@ -749,7 +758,7 @@ class DefaultPropertySheets(PropertySheets):
def _get_defaults(self): def _get_defaults(self):
return (self.default, self.webdav) return (self.default, self.webdav)
Globals.default__class_init__(DefaultPropertySheets) InitializeClass(DefaultPropertySheets)
class FixedSchema(PropertySheet): class FixedSchema(PropertySheet):
...@@ -786,7 +795,7 @@ class FixedSchema(PropertySheet): ...@@ -786,7 +795,7 @@ class FixedSchema(PropertySheet):
return 0 return 0
return self._base._extensible return self._base._extensible
Globals.default__class_init__(FixedSchema) InitializeClass(FixedSchema)
class vps(Base): class vps(Base):
......
lib/python/OFS/SimpleItem.py
View file @ 41049f78
...@@ -25,7 +25,10 @@ import marshal, re, sys, time ...@@ -25,7 +25,10 @@ import marshal, re, sys, time
import AccessControl.Role, AccessControl.Owned, App.Common import AccessControl.Role, AccessControl.Owned, App.Common
import Globals, App.Management, Acquisition, App.Undo import Globals, App.Management, Acquisition, App.Undo
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager, Unauthorized from AccessControl import getSecurityManager, Unauthorized
from AccessControl.Permissions import view as View
from AccessControl.ZopeSecurityPolicy import getRoles from AccessControl.ZopeSecurityPolicy import getRoles
from Acquisition import aq_base, aq_parent, aq_inner, aq_acquire from Acquisition import aq_base, aq_parent, aq_inner, aq_acquire
from ComputedAttribute import ComputedAttribute from ComputedAttribute import ComputedAttribute
...@@ -52,11 +55,12 @@ class Item(Base, Resource, CopySource, App.Management.Tabs, Traversable, ...@@ -52,11 +55,12 @@ class Item(Base, Resource, CopySource, App.Management.Tabs, Traversable,
AccessControl.Owned.Owned, AccessControl.Owned.Owned,
App.Undo.UndoSupport, App.Undo.UndoSupport,
): ):
"""A common base class for simple, non-container objects.""" """A common base class for simple, non-container objects."""
implements(IItem) implements(IItem)
security = ClassSecurityInfo()
isPrincipiaFolderish=0 isPrincipiaFolderish=0
isTopLevelPrincipiaApplicationObject=0 isTopLevelPrincipiaApplicationObject=0
...@@ -75,7 +79,7 @@ class Item(Base, Resource, CopySource, App.Management.Tabs, Traversable, ...@@ -75,7 +79,7 @@ class Item(Base, Resource, CopySource, App.Management.Tabs, Traversable,
# Direct use of the 'id' attribute is deprecated - use getId() # Direct use of the 'id' attribute is deprecated - use getId()
id='' id=''
getId__roles__=None security.declarePublic('getId')
def getId(self): def getId(self):
"""Return the id of the object as a string. """Return the id of the object as a string.
...@@ -350,7 +354,7 @@ class Item(Base, Resource, CopySource, App.Management.Tabs, Traversable, ...@@ -350,7 +354,7 @@ class Item(Base, Resource, CopySource, App.Management.Tabs, Traversable,
res += '>' res += '>'
return res return res
Globals.default__class_init__(Item) InitializeClass(Item)
class Item_w__name__(Item): class Item_w__name__(Item):
...@@ -414,11 +418,13 @@ class SimpleItem(Item, Globals.Persistent, ...@@ -414,11 +418,13 @@ class SimpleItem(Item, Globals.Persistent,
implements(ISimpleItem) implements(ISimpleItem)
security = ClassSecurityInfo()
security.setPermissionDefault(View, ('Manager',))
manage_options=Item.manage_options+( manage_options=Item.manage_options+(
{'label':'Security', {'label':'Security',
'action':'manage_access', 'action':'manage_access',
'help':('OFSP', 'Security.stx')}, 'help':('OFSP', 'Security.stx')},
) )
__ac_permissions__=(('View', ()),) InitializeClass(SimpleItem)
lib/python/OFS/Traversable.py
View file @ 41049f78
...@@ -17,6 +17,8 @@ $Id$ ...@@ -17,6 +17,8 @@ $Id$
from urllib import quote from urllib import quote
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl import Unauthorized from AccessControl import Unauthorized
from AccessControl.ZopeGuards import guarded_getattr from AccessControl.ZopeGuards import guarded_getattr
...@@ -34,7 +36,9 @@ class Traversable: ...@@ -34,7 +36,9 @@ class Traversable:
implements(ITraversable) implements(ITraversable)
absolute_url__roles__=None # Public security = ClassSecurityInfo()
security.declarePublic('absolute_url')
def absolute_url(self, relative=0): def absolute_url(self, relative=0):
"""Return the absolute URL of the object. """Return the absolute URL of the object.
...@@ -61,7 +65,7 @@ class Traversable: ...@@ -61,7 +65,7 @@ class Traversable:
return path2url(spp[1:]) return path2url(spp[1:])
return toUrl(spp) return toUrl(spp)
absolute_url_path__roles__=None # Public security.declarePublic('absolute_url_path')
def absolute_url_path(self): def absolute_url_path(self):
"""Return the path portion of the absolute URL of the object. """Return the path portion of the absolute URL of the object.
...@@ -75,7 +79,7 @@ class Traversable: ...@@ -75,7 +79,7 @@ class Traversable:
return path2url(spp) or '/' return path2url(spp) or '/'
return toUrl(spp, relative=1) or '/' return toUrl(spp, relative=1) or '/'
virtual_url_path__roles__=None # Public security.declarePublic('virtual_url_path')
def virtual_url_path(self): def virtual_url_path(self):
"""Return a URL for the object, relative to the site root. """Return a URL for the object, relative to the site root.
...@@ -90,10 +94,10 @@ class Traversable: ...@@ -90,10 +94,10 @@ class Traversable:
return path2url(spp[1:]) return path2url(spp[1:])
return path2url(toVirt(spp)) return path2url(toVirt(spp))
getPhysicalRoot__roles__=() # Private security.declarePrivate('getPhysicalRoot')
getPhysicalRoot=Acquired getPhysicalRoot=Acquired
getPhysicalPath__roles__=None # Public security.declarePublic('getPhysicalPath')
def getPhysicalPath(self): def getPhysicalPath(self):
"""Get the physical path of the object. """Get the physical path of the object.
...@@ -110,7 +114,7 @@ class Traversable: ...@@ -110,7 +114,7 @@ class Traversable:
return path return path
unrestrictedTraverse__roles__=() # Private security.declarePrivate('unrestrictedTraverse')
def unrestrictedTraverse(self, path, default=_marker, restricted=0): def unrestrictedTraverse(self, path, default=_marker, restricted=0):
"""Lookup an object by path. """Lookup an object by path.
...@@ -232,10 +236,13 @@ class Traversable: ...@@ -232,10 +236,13 @@ class Traversable:
else: else:
raise raise
restrictedTraverse__roles__=None # Public security.declarePublic('restrictedTraverse')
def restrictedTraverse(self, path, default=_marker): def restrictedTraverse(self, path, default=_marker):
# Trusted code traversal code, always enforces security # Trusted code traversal code, always enforces security
return self.unrestrictedTraverse(path, default, restricted=1) return self.unrestrictedTraverse(path, default, restricted=1)
InitializeClass(Traversable)
def path2url(path): def path2url(path):
return '/'.join(map(quote, path)) return '/'.join(map(quote, path))
lib/python/OFS/ZDOM.py
View file @ 41049f78
...@@ -16,6 +16,9 @@ DOM implementation in ZOPE : Read-Only methods ...@@ -16,6 +16,9 @@ DOM implementation in ZOPE : Read-Only methods
All standard Zope objects support DOM to a limited extent. All standard Zope objects support DOM to a limited extent.
""" """
import Acquisition import Acquisition
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import access_contents_information
# Node type codes # Node type codes
...@@ -82,61 +85,65 @@ class Node: ...@@ -82,61 +85,65 @@ class Node:
Node Interface Node Interface
""" """
__ac_permissions__=( security = ClassSecurityInfo()
('Access contents information',
('getNodeName', 'getNodeValue', 'getParentNode',
'getChildNodes', 'getFirstChild', 'getLastChild',
'getPreviousSibling', 'getNextSibling', 'getOwnerDocument',
'getAttributes', 'hasChildNodes'),
),
)
# DOM attributes # DOM attributes
# -------------- # --------------
security.declareProtected(access_contents_information, 'getNodeName')
def getNodeName(self): def getNodeName(self):
"""The name of this node, depending on its type""" """The name of this node, depending on its type"""
return None return None
security.declareProtected(access_contents_information, 'getNodeValue')
def getNodeValue(self): def getNodeValue(self):
"""The value of this node, depending on its type""" """The value of this node, depending on its type"""
return None return None
security.declareProtected(access_contents_information, 'getParentNode')
def getParentNode(self): def getParentNode(self):
"""The parent of this node. All nodes except Document """The parent of this node. All nodes except Document
DocumentFragment and Attr may have a parent""" DocumentFragment and Attr may have a parent"""
return None return None
security.declareProtected(access_contents_information, 'getChildNodes')
def getChildNodes(self): def getChildNodes(self):
"""Returns a NodeList that contains all children of this node. """Returns a NodeList that contains all children of this node.
If there are no children, this is a empty NodeList""" If there are no children, this is a empty NodeList"""
return NodeList() return NodeList()
security.declareProtected(access_contents_information, 'getFirstChild')
def getFirstChild(self): def getFirstChild(self):
"""The first child of this node. If there is no such node """The first child of this node. If there is no such node
this returns None.""" this returns None."""
return None return None
security.declareProtected(access_contents_information, 'getLastChild')
def getLastChild(self): def getLastChild(self):
"""The last child of this node. If there is no such node """The last child of this node. If there is no such node
this returns None.""" this returns None."""
return None return None
security.declareProtected(access_contents_information,
'getPreviousSibling')
def getPreviousSibling(self): def getPreviousSibling(self):
"""The node immediately preceding this node. If """The node immediately preceding this node. If
there is no such node, this returns None.""" there is no such node, this returns None."""
return None return None
security.declareProtected(access_contents_information, 'getNextSibling')
def getNextSibling(self): def getNextSibling(self):
"""The node immediately preceding this node. If """The node immediately preceding this node. If
there is no such node, this returns None.""" there is no such node, this returns None."""
return None return None
security.declareProtected(access_contents_information, 'getAttributes')
def getAttributes(self): def getAttributes(self):
"""Returns a NamedNodeMap containing the attributes """Returns a NamedNodeMap containing the attributes
of this node (if it is an element) or None otherwise.""" of this node (if it is an element) or None otherwise."""
return None return None
security.declareProtected(access_contents_information, 'getOwnerDocument')
def getOwnerDocument(self): def getOwnerDocument(self):
"""The Document object associated with this node. """The Document object associated with this node.
When this is a document this is None""" When this is a document this is None"""
...@@ -149,32 +156,33 @@ class Node: ...@@ -149,32 +156,33 @@ class Node:
# DOM Methods # DOM Methods
# ----------- # -----------
security.declareProtected(access_contents_information, 'hasChildNodes')
def hasChildNodes(self): def hasChildNodes(self):
"""Returns true if the node has any children, false """Returns true if the node has any children, false
if it doesn't. """ if it doesn't. """
return len(self.objectIds()) return len(self.objectIds())
InitializeClass(Node)
class Document(Acquisition.Explicit, Node): class Document(Acquisition.Explicit, Node):
""" """
Document Interface Document Interface
""" """
__ac_permissions__=( security = ClassSecurityInfo()
('Access contents information',
('getImplementation', 'getDoctype', 'getDocumentElement'),
),
)
# Document Methods # Document Methods
# ---------------- # ----------------
security.declareProtected(access_contents_information, 'getImplementation')
def getImplementation(self): def getImplementation(self):
""" """
The DOMImplementation object that handles this document. The DOMImplementation object that handles this document.
""" """
return DOMImplementation() return DOMImplementation()
security.declareProtected(access_contents_information, 'getDoctype')
def getDoctype(self): def getDoctype(self):
""" """
The Document Type Declaration associated with this document. The Document Type Declaration associated with this document.
...@@ -183,6 +191,8 @@ class Document(Acquisition.Explicit, Node): ...@@ -183,6 +191,8 @@ class Document(Acquisition.Explicit, Node):
""" """
return None return None
security.declareProtected(access_contents_information,
'getDocumentElement')
def getDocumentElement(self): def getDocumentElement(self):
""" """
This is a convenience attribute that allows direct access to This is a convenience attribute that allows direct access to
...@@ -226,18 +236,17 @@ class Document(Acquisition.Explicit, Node): ...@@ -226,18 +236,17 @@ class Document(Acquisition.Explicit, Node):
if it doesn't. """ if it doesn't. """
return 1 return 1
InitializeClass(Document)
class DOMImplementation: class DOMImplementation:
""" """
DOMImplementation Interface DOMImplementation Interface
""" """
__ac_permissions__=( security = ClassSecurityInfo()
('Access contents information',
('hasFeature',),
),
)
security.declareProtected(access_contents_information, 'hasFeature')
def hasFeature(self, feature, version = None): def hasFeature(self, feature, version = None):
""" """
hasFeature - Test if the DOM implementation implements a specific hasFeature - Test if the DOM implementation implements a specific
...@@ -256,22 +265,20 @@ class DOMImplementation: ...@@ -256,22 +265,20 @@ class DOMImplementation:
if version == '1.0': return 1 if version == '1.0': return 1
return 0 return 0
InitializeClass(DOMImplementation)
class Element(Node): class Element(Node):
""" """
Element interface Element interface
""" """
__ac_permissions__=( security = ClassSecurityInfo()
('Access contents information',
('getTagName', 'getAttribute', 'getAttributeNode',
'getElementsByTagName'),
),
)
# Element Attributes # Element Attributes
# ------------------ # ------------------
security.declareProtected(access_contents_information, 'getTagName')
def getTagName(self): def getTagName(self):
"""The name of the element""" """The name of the element"""
return self.__class__.__name__ return self.__class__.__name__
...@@ -344,15 +351,19 @@ class Element(Node): ...@@ -344,15 +351,19 @@ class Element(Node):
# Element Methods # Element Methods
# --------------- # ---------------
security.declareProtected(access_contents_information, 'getAttribute')
def getAttribute(self, name): def getAttribute(self, name):
"""Retrieves an attribute value by name.""" """Retrieves an attribute value by name."""
return None return None
security.declareProtected(access_contents_information, 'getAttributeNode')
def getAttributeNode(self, name): def getAttributeNode(self, name):
""" Retrieves an Attr node by name or None if """ Retrieves an Attr node by name or None if
there is no such attribute. """ there is no such attribute. """
return None return None
security.declareProtected(access_contents_information,
'getElementsByTagName')
def getElementsByTagName(self, tagname): def getElementsByTagName(self, tagname):
""" Returns a NodeList of all the Elements with a given tag """ Returns a NodeList of all the Elements with a given tag
name in the order in which they would be encountered in a name in the order in which they would be encountered in a
...@@ -370,6 +381,8 @@ class Element(Node): ...@@ -370,6 +381,8 @@ class Element(Node):
nodeList = nodeList + n1._data nodeList = nodeList + n1._data
return NodeList(nodeList) return NodeList(nodeList)
InitializeClass(Element)
class ElementWithAttributes(Element): class ElementWithAttributes(Element):
""" """
......
lib/python/OFS/misc_.py
View file @ 41049f78
...@@ -11,16 +11,22 @@ ...@@ -11,16 +11,22 @@
# #
############################################################################## ##############################################################################
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from App.ImageFile import ImageFile from App.ImageFile import ImageFile
class misc_: class misc_:
"Miscellaneous product information" "Miscellaneous product information"
__roles__=None security = ClassSecurityInfo()
security.declareObjectPublic()
InitializeClass(misc_)
class p_: class p_:
"Shared system information" "Shared system information"
__roles__=None security = ClassSecurityInfo()
security.declareObjectPublic()
broken=ImageFile('www/broken.gif', globals()) broken=ImageFile('www/broken.gif', globals())
...@@ -63,10 +69,12 @@ class p_: ...@@ -63,10 +69,12 @@ class p_:
ProductHelp_icon=ImageFile('HelpSys/images/productHelp.gif') ProductHelp_icon=ImageFile('HelpSys/images/productHelp.gif')
HelpTopic_icon=ImageFile('HelpSys/images/helpTopic.gif') HelpTopic_icon=ImageFile('HelpSys/images/helpTopic.gif')
InitializeClass(p_)
class Misc_: class Misc_:
"Miscellaneous product information" "Miscellaneous product information"
security = ClassSecurityInfo()
__roles__=None security.declareObjectPublic()
def __init__(self, name, dict): def __init__(self, name, dict):
self._d=dict self._d=dict
...@@ -75,3 +83,5 @@ class Misc_: ...@@ -75,3 +83,5 @@ class Misc_:
def __str__(self): return self.__name__ def __str__(self): return self.__name__
def __getitem__(self, name): return self._d[name] def __getitem__(self, name): return self._d[name]
def __setitem__(self, name, v): self._d[name]=v def __setitem__(self, name, v): self._d[name]=v
InitializeClass(Misc_)
lib/python/Products/ExternalMethod/ExternalMethod.py
View file @ 41049f78
...@@ -19,6 +19,11 @@ domain-specific customization of web environments. ...@@ -19,6 +19,11 @@ domain-specific customization of web environments.
__version__='$Revision: 1.52 $'[11:-2] __version__='$Revision: 1.52 $'[11:-2]
from Globals import Persistent, DTMLFile, MessageDialog, HTML from Globals import Persistent, DTMLFile, MessageDialog, HTML
import OFS.SimpleItem, Acquisition import OFS.SimpleItem, Acquisition
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import change_external_methods
from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import view as View
import AccessControl.Role, sys, os, stat, traceback import AccessControl.Role, sys, os, stat, traceback
from OFS.SimpleItem import pretty_tb from OFS.SimpleItem import pretty_tb
from App.Extensions import getObject, getPath, FuncCode from App.Extensions import getObject, getPath, FuncCode
...@@ -81,6 +86,9 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit, ...@@ -81,6 +86,9 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit,
meta_type = 'External Method' meta_type = 'External Method'
security = ClassSecurityInfo()
security.declareObjectProtected(View)
func_defaults = ComputedAttribute(lambda self: self.getFuncDefaults()) func_defaults = ComputedAttribute(lambda self: self.getFuncDefaults())
func_code = ComputedAttribute(lambda self: self.getFuncCode()) func_code = ComputedAttribute(lambda self: self.getFuncCode())
...@@ -100,17 +108,14 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit, ...@@ -100,17 +108,14 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit,
+AccessControl.Role.RoleManager.manage_options +AccessControl.Role.RoleManager.manage_options
) )
__ac_permissions__=(
('View management screens', ('manage_main',)),
('Change External Methods', ('manage_edit',)),
('View', ('__call__','')),
)
def __init__(self, id, title, module, function): def __init__(self, id, title, module, function):
self.id=id self.id=id
self.manage_edit(title, module, function) self.manage_edit(title, module, function)
security.declareProtected(view_management_screens, 'manage_main')
manage_main=DTMLFile('dtml/methodEdit', globals()) manage_main=DTMLFile('dtml/methodEdit', globals())
security.declareProtected(change_external_methods, 'manage_edit')
def manage_edit(self, title, module, function, REQUEST=None): def manage_edit(self, title, module, function, REQUEST=None):
"""Change the external method """Change the external method
...@@ -182,6 +187,7 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit, ...@@ -182,6 +187,7 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit,
self._v_f = self.getFunction() self._v_f = self.getFunction()
return self._v_func_code return self._v_func_code
security.declareProtected(View, '__call__')
def __call__(self, *args, **kw): def __call__(self, *args, **kw):
"""Call an ExternalMethod """Call an ExternalMethod
...@@ -243,3 +249,5 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit, ...@@ -243,3 +249,5 @@ class ExternalMethod(OFS.SimpleItem.Item, Persistent, Acquisition.Explicit,
self._v_filepath=getPath('Extensions', self._module, self._v_filepath=getPath('Extensions', self._module,
suffixes=('','py','pyc','pyp')) suffixes=('','py','pyc','pyp'))
return self._v_filepath return self._v_filepath
InitializeClass(ExternalMethod)
lib/python/Products/OFSP/Draft.py
View file @ 41049f78
...@@ -12,6 +12,8 @@ ...@@ -12,6 +12,8 @@
############################################################################## ##############################################################################
import Globals, AccessControl.User import Globals, AccessControl.User
from Globals import Persistent from Globals import Persistent
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from Acquisition import Implicit from Acquisition import Implicit
from OFS import SimpleItem from OFS import SimpleItem
...@@ -27,12 +29,7 @@ class Draft(Persistent, Implicit, SimpleItem.Item): ...@@ -27,12 +29,7 @@ class Draft(Persistent, Implicit, SimpleItem.Item):
_version='/version' _version='/version'
meta_type='Zope Draft' meta_type='Zope Draft'
__ac_permissions__=( security = ClassSecurityInfo()
('Approve draft changes',
('manage_approve__draft__',
'manage_Save__draft__','manage_Discard__draft__')
),
)
def __init__(self, id, baseid, PATH_INFO): def __init__(self, id, baseid, PATH_INFO):
self.id=id self.id=id
...@@ -102,8 +99,12 @@ class Draft(Persistent, Implicit, SimpleItem.Item): ...@@ -102,8 +99,12 @@ class Draft(Persistent, Implicit, SimpleItem.Item):
# ZODB 3 # ZODB 3
return not db.versionEmpty(self._version) return not db.versionEmpty(self._version)
security.declareProtected('Approve draft changes',
'manage_approve__draft__')
manage_approve__draft__=Globals.HTMLFile('dtml/draftApprove', globals()) manage_approve__draft__=Globals.HTMLFile('dtml/draftApprove', globals())
security.declareProtected('Approve draft changes',
'manage_Save__draft__')
def manage_Save__draft__(self, remark, REQUEST=None): def manage_Save__draft__(self, remark, REQUEST=None):
"""Make version changes permanent""" """Make version changes permanent"""
try: db=self._p_jar.db() try: db=self._p_jar.db()
...@@ -120,6 +121,8 @@ class Draft(Persistent, Implicit, SimpleItem.Item): ...@@ -120,6 +121,8 @@ class Draft(Persistent, Implicit, SimpleItem.Item):
if REQUEST: if REQUEST:
REQUEST['RESPONSE'].redirect(REQUEST['URL2']+'/manage_main') REQUEST['RESPONSE'].redirect(REQUEST['URL2']+'/manage_main')
security.declareProtected('Approve draft changes',
'manage_Discard__draft__')
def manage_Discard__draft__(self, REQUEST=None): def manage_Discard__draft__(self, REQUEST=None):
'Discard changes made during the version' 'Discard changes made during the version'
try: db=self._p_jar.db() try: db=self._p_jar.db()
...@@ -146,7 +149,8 @@ class Draft(Persistent, Implicit, SimpleItem.Item): ...@@ -146,7 +149,8 @@ class Draft(Persistent, Implicit, SimpleItem.Item):
'Attempt to %sdelete a non-empty version.<p>' 'Attempt to %sdelete a non-empty version.<p>'
((self is not item) and 'indirectly ' or '')) ((self is not item) and 'indirectly ' or ''))
Globals.default__class_init__(Draft) InitializeClass(Draft)
def getdraft(ob, jar): def getdraft(ob, jar):
......
lib/python/Products/OFSP/Version.py
View file @ 41049f78
...@@ -18,6 +18,12 @@ import Globals, time ...@@ -18,6 +18,12 @@ import Globals, time
from AccessControl.Role import RoleManager from AccessControl.Role import RoleManager
from Globals import MessageDialog from Globals import MessageDialog
from Globals import Persistent from Globals import Persistent
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import change_versions
from AccessControl.Permissions import join_leave_versions
from AccessControl.Permissions import save_discard_version_changes
from AccessControl.Permissions import view_management_screens
from Acquisition import Implicit from Acquisition import Implicit
from OFS.SimpleItem import Item from OFS.SimpleItem import Item
from Globals import HTML from Globals import HTML
...@@ -44,6 +50,9 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -44,6 +50,9 @@ class Version(Persistent,Implicit,RoleManager,Item):
""" """ """ """
meta_type='Version' meta_type='Version'
security = ClassSecurityInfo()
security.declareObjectProtected(view_management_screens)
manage_options=( manage_options=(
( (
{'label':'Join/Leave', 'action':'manage_main', {'label':'Join/Leave', 'action':'manage_main',
...@@ -57,14 +66,7 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -57,14 +66,7 @@ class Version(Persistent,Implicit,RoleManager,Item):
+Item.manage_options +Item.manage_options
) )
__ac_permissions__=( security.declareProtected(view_management_screens, 'manage')
('View management screens', ('manage','manage_editForm', '')),
('Change Versions', ('manage_edit',)),
('Join/leave Versions',
('manage_main', 'enter','leave','leave_another')),
('Save/discard Version changes',
('manage_end', 'save','discard')),
)
cookie='' cookie=''
...@@ -74,8 +76,13 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -74,8 +76,13 @@ class Version(Persistent,Implicit,RoleManager,Item):
self.id=id self.id=id
self.title=title self.title=title
security.declareProtected(join_leave_versions, 'manage_main')
manage_main=Globals.DTMLFile('dtml/version', globals()) manage_main=Globals.DTMLFile('dtml/version', globals())
security.declareProtected(save_discard_version_changes, 'manage_end')
manage_end=Globals.DTMLFile('dtml/versionEnd', globals()) manage_end=Globals.DTMLFile('dtml/versionEnd', globals())
security.declareProtected(view_management_screens, 'manage_editForm')
manage_editForm =Globals.DTMLFile('dtml/versionEdit', globals()) manage_editForm =Globals.DTMLFile('dtml/versionEdit', globals())
def title_and_id(self): def title_and_id(self):
...@@ -98,6 +105,7 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -98,6 +105,7 @@ class Version(Persistent,Implicit,RoleManager,Item):
'alt': 'Deprecated object', 'alt': 'Deprecated object',
'title': 'Version objects are deprecated and should not be used anyore.'},) 'title': 'Version objects are deprecated and should not be used anyore.'},)
security.declareProtected(change_versions, 'manage_edit')
def manage_edit(self, title, REQUEST=None): def manage_edit(self, title, REQUEST=None):
""" """ """ """
self.title=title self.title=title
...@@ -106,6 +114,7 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -106,6 +114,7 @@ class Version(Persistent,Implicit,RoleManager,Item):
message='Your changes have been saved', message='Your changes have been saved',
action ='manage_main') action ='manage_main')
security.declareProtected(join_leave_versions, 'enter')
def enter(self, REQUEST, RESPONSE): def enter(self, REQUEST, RESPONSE):
"""Begin working in a version""" """Begin working in a version"""
RESPONSE.setCookie( RESPONSE.setCookie(
...@@ -123,6 +132,7 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -123,6 +132,7 @@ class Version(Persistent,Implicit,RoleManager,Item):
) )
return RESPONSE.redirect(REQUEST['URL1']+'/manage_main') return RESPONSE.redirect(REQUEST['URL1']+'/manage_main')
security.declareProtected(join_leave_versions, 'leave')
def leave(self, REQUEST, RESPONSE): def leave(self, REQUEST, RESPONSE):
"""Temporarily stop working in a version""" """Temporarily stop working in a version"""
RESPONSE.setCookie( RESPONSE.setCookie(
...@@ -141,10 +151,12 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -141,10 +151,12 @@ class Version(Persistent,Implicit,RoleManager,Item):
) )
return RESPONSE.redirect(REQUEST['URL1']+'/manage_main') return RESPONSE.redirect(REQUEST['URL1']+'/manage_main')
security.declareProtected(join_leave_versions, 'leave_another')
def leave_another(self, REQUEST, RESPONSE): def leave_another(self, REQUEST, RESPONSE):
"""Leave a version that may not be the current version""" """Leave a version that may not be the current version"""
return self.leave(REQUEST, RESPONSE) return self.leave(REQUEST, RESPONSE)
security.declareProtected(save_discard_version_changes, 'save')
def save(self, remark, REQUEST=None): def save(self, remark, REQUEST=None):
"""Make version changes permanent""" """Make version changes permanent"""
try: db=self._p_jar.db() try: db=self._p_jar.db()
...@@ -162,6 +174,7 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -162,6 +174,7 @@ class Version(Persistent,Implicit,RoleManager,Item):
if REQUEST is not None: if REQUEST is not None:
REQUEST['RESPONSE'].redirect(REQUEST['URL1']+'/manage_main') REQUEST['RESPONSE'].redirect(REQUEST['URL1']+'/manage_main')
security.declareProtected(save_discard_version_changes, 'discard')
def discard(self, remark='', REQUEST=None): def discard(self, remark='', REQUEST=None):
'Discard changes made during the version' 'Discard changes made during the version'
try: db=self._p_jar.db() try: db=self._p_jar.db()
...@@ -219,3 +232,5 @@ class Version(Persistent,Implicit,RoleManager,Item): ...@@ -219,3 +232,5 @@ class Version(Persistent,Implicit,RoleManager,Item):
'version, because the version would no longer\n' 'version, because the version would no longer\n'
'be accessable.<p>\n' 'be accessable.<p>\n'
% (v,v,v)) % (v,v,v))
InitializeClass(Version)
lib/python/Products/PluginIndexes/TextIndex/Vocabulary.py
View file @ 41049f78
...@@ -16,7 +16,11 @@ $Id$ ...@@ -16,7 +16,11 @@ $Id$
""" """
from Globals import DTMLFile, MessageDialog from Globals import DTMLFile, MessageDialog
import Globals, AccessControl.Role import AccessControl.Role
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import manage_vocabulary
from AccessControl.Permissions import query_vocabulary
from Acquisition import Implicit from Acquisition import Implicit
from Persistence import Persistent from Persistence import Persistent
from OFS.SimpleItem import Item from OFS.SimpleItem import Item
...@@ -52,6 +56,10 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager): ...@@ -52,6 +56,10 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager):
implements(IVocabulary) implements(IVocabulary)
security = ClassSecurityInfo()
security.setPermissionDefault(manage_vocabulary, ('Manager',))
security.setPermissionDefault(query_vocabulary, ('Anonymous', 'Manager',))
meta_type = "Vocabulary" meta_type = "Vocabulary"
_isAVocabulary = 1 _isAVocabulary = 1
...@@ -66,18 +74,10 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager): ...@@ -66,18 +74,10 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager):
+AccessControl.Role.RoleManager.manage_options +AccessControl.Role.RoleManager.manage_options
) )
__ac_permissions__=( security.declareProtected(manage_vocabulary, 'manage_main')
('Manage Vocabulary',
['manage_main', 'manage_query'],
['Manager']),
('Query Vocabulary',
['query',],
['Anonymous', 'Manager']),
)
manage_main = DTMLFile('dtml/manage_vocab', globals()) manage_main = DTMLFile('dtml/manage_vocab', globals())
security.declareProtected(manage_vocabulary, 'manage_query')
manage_query = DTMLFile('dtml/vocab_query', globals()) manage_query = DTMLFile('dtml/vocab_query', globals())
def __init__(self, id, title='', globbing=None,splitter=None,extra=None): def __init__(self, id, title='', globbing=None,splitter=None,extra=None):
...@@ -106,6 +106,7 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager): ...@@ -106,6 +106,7 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager):
def getLexicon(self): def getLexicon(self):
return self.lexicon return self.lexicon
security.declareProtected(query_vocabulary, 'query')
def query(self, pattern): def query(self, pattern):
""" """ """ """
result = [] result = []
...@@ -132,3 +133,5 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager): ...@@ -132,3 +133,5 @@ class Vocabulary(Item, Persistent, Implicit, AccessControl.Role.RoleManager):
def words(self): def words(self):
return self.lexicon._lexicon.items() return self.lexicon._lexicon.items()
InitializeClass(Vocabulary)
lib/python/Products/SiteAccess/VirtualHostMonster.py
View file @ 41049f78
...@@ -4,6 +4,9 @@ Defines the VirtualHostMonster class ...@@ -4,6 +4,9 @@ Defines the VirtualHostMonster class
""" """
from Globals import DTMLFile, MessageDialog, Persistent from Globals import DTMLFile, MessageDialog, Persistent
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view as View
from OFS.SimpleItem import Item from OFS.SimpleItem import Item
from Acquisition import Implicit, aq_inner, aq_parent from Acquisition import Implicit, aq_inner, aq_parent
from ZPublisher import BeforeTraverse from ZPublisher import BeforeTraverse
...@@ -24,15 +27,19 @@ class VirtualHostMonster(Persistent, Item, Implicit): ...@@ -24,15 +27,19 @@ class VirtualHostMonster(Persistent, Item, Implicit):
lines = () lines = ()
have_map = 0 have_map = 0
__ac_permissions__=(('View', ('manage_main',)),('Add Site Roots', ('manage_edit', 'set_map'))) security = ClassSecurityInfo()
manage_options=({'label':'About', 'action':'manage_main'}, manage_options=({'label':'About', 'action':'manage_main'},
{'label':'Mappings', 'action':'manage_edit'}) {'label':'Mappings', 'action':'manage_edit'})
security.declareProtected(View, 'manage_main')
manage_main = DTMLFile('www/VirtualHostMonster', globals(), manage_main = DTMLFile('www/VirtualHostMonster', globals(),
__name__='manage_main') __name__='manage_main')
security.declareProtected('Add Site Roots', 'manage_edit')
manage_edit = DTMLFile('www/manage_edit', globals()) manage_edit = DTMLFile('www/manage_edit', globals())
security.declareProtected('Add Site Roots', 'set_map')
def set_map(self, map_text, RESPONSE=None): def set_map(self, map_text, RESPONSE=None):
"Set domain to path mappings." "Set domain to path mappings."
lines = map_text.split('\n') lines = map_text.split('\n')
...@@ -238,6 +245,9 @@ class VirtualHostMonster(Persistent, Item, Implicit): ...@@ -238,6 +245,9 @@ class VirtualHostMonster(Persistent, Item, Implicit):
request.setVirtualRoot([]) request.setVirtualRoot([])
return parents.pop() # He'll get put back on return parents.pop() # He'll get put back on
InitializeClass(VirtualHostMonster)
def manage_addVirtualHostMonster(self, id, REQUEST=None, **ignored): def manage_addVirtualHostMonster(self, id, REQUEST=None, **ignored):
""" """ """ """
vhm = VirtualHostMonster() vhm = VirtualHostMonster()
......
lib/python/Products/StandardCacheManagers/AcceleratedHTTPCacheManager.py
View file @ 41049f78
...@@ -21,8 +21,10 @@ $Id$ ...@@ -21,8 +21,10 @@ $Id$
from OFS.Cache import Cache, CacheManager from OFS.Cache import Cache, CacheManager
from OFS.SimpleItem import SimpleItem from OFS.SimpleItem import SimpleItem
import time import time
import Globals from Globals import InitializeClass
from Globals import DTMLFile from Globals import DTMLFile
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
import urlparse, httplib import urlparse, httplib
from cgi import escape from cgi import escape
from urllib import quote from urllib import quote
...@@ -108,14 +110,8 @@ PRODUCT_DIR = __name__.split('.')[-2] ...@@ -108,14 +110,8 @@ PRODUCT_DIR = __name__.split('.')[-2]
class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
' ' ' '
__ac_permissions__ = ( security = ClassSecurityInfo()
('View management screens', ('getSettings', security.setPermissionDefault('Change cache managers', ('Manager',))
'manage_main',
'manage_stats',
'getCacheReport',
'sort_link')),
('Change cache managers', ('manage_editProps',), ('Manager',)),
)
manage_options = ( manage_options = (
{'label':'Properties', 'action':'manage_main', {'label':'Properties', 'action':'manage_main',
...@@ -138,7 +134,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): ...@@ -138,7 +134,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
' ' ' '
return self.id return self.id
ZCacheManager_getCache__roles__ = () security.declarePrivate('ZCacheManager_getCache')
def ZCacheManager_getCache(self): def ZCacheManager_getCache(self):
cacheid = self.__cacheid cacheid = self.__cacheid
try: try:
...@@ -149,12 +145,15 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): ...@@ -149,12 +145,15 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
caches[cacheid] = cache caches[cacheid] = cache
return cache return cache
security.declareProtected(view_management_screens, 'getSettings')
def getSettings(self): def getSettings(self):
' ' ' '
return self._settings.copy() # Don't let DTML modify it. return self._settings.copy() # Don't let DTML modify it.
security.declareProtected(view_management_screens, 'manage_main')
manage_main = DTMLFile('dtml/propsAccel', globals()) manage_main = DTMLFile('dtml/propsAccel', globals())
security.declareProtected('Change cache managers', 'manage_editProps')
def manage_editProps(self, title, settings=None, REQUEST=None): def manage_editProps(self, title, settings=None, REQUEST=None):
' ' ' '
if settings is None: if settings is None:
...@@ -170,6 +169,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): ...@@ -170,6 +169,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
return self.manage_main( return self.manage_main(
self, REQUEST, manage_tabs_message='Properties changed.') self, REQUEST, manage_tabs_message='Properties changed.')
security.declareProtected(view_management_screens, 'manage_stats')
manage_stats = DTMLFile('dtml/statsAccel', globals()) manage_stats = DTMLFile('dtml/statsAccel', globals())
def _getSortInfo(self): def _getSortInfo(self):
...@@ -182,6 +182,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): ...@@ -182,6 +182,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
sort_reverse = int(req.get('sort_reverse', 1)) sort_reverse = int(req.get('sort_reverse', 1))
return sort_by, sort_reverse return sort_by, sort_reverse
security.declareProtected(view_management_screens, 'getCacheReport')
def getCacheReport(self): def getCacheReport(self):
""" """
Returns the list of objects in the cache, sorted according to Returns the list of objects in the cache, sorted according to
...@@ -201,6 +202,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): ...@@ -201,6 +202,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
rval.reverse() rval.reverse()
return rval return rval
security.declareProtected(view_management_screens, 'sort_link')
def sort_link(self, name, id): def sort_link(self, name, id):
""" """
Utility for generating a sort link. Utility for generating a sort link.
...@@ -215,7 +217,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem): ...@@ -215,7 +217,7 @@ class AcceleratedHTTPCacheManager (CacheManager, SimpleItem):
return '<a href="%s">%s</a>' % (escape(url, 1), escape(name)) return '<a href="%s">%s</a>' % (escape(url, 1), escape(name))
Globals.default__class_init__(AcceleratedHTTPCacheManager) InitializeClass(AcceleratedHTTPCacheManager)
manage_addAcceleratedHTTPCacheManagerForm = DTMLFile('dtml/addAccel', manage_addAcceleratedHTTPCacheManagerForm = DTMLFile('dtml/addAccel',
......
lib/python/Products/StandardCacheManagers/RAMCacheManager.py
View file @ 41049f78
...@@ -23,8 +23,10 @@ from OFS.SimpleItem import SimpleItem ...@@ -23,8 +23,10 @@ from OFS.SimpleItem import SimpleItem
from thread import allocate_lock from thread import allocate_lock
from cgi import escape from cgi import escape
import time import time
import Globals from Globals import InitializeClass
from Globals import DTMLFile from Globals import DTMLFile
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
try: from cPickle import Pickler, HIGHEST_PROTOCOL try: from cPickle import Pickler, HIGHEST_PROTOCOL
except: from pickle import Pickler, HIGHEST_PROTOCOL except: from pickle import Pickler, HIGHEST_PROTOCOL
...@@ -347,14 +349,8 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -347,14 +349,8 @@ class RAMCacheManager (CacheManager, SimpleItem):
caching. caching.
""" """
__ac_permissions__ = ( security = ClassSecurityInfo()
('View management screens', ('getSettings', security.setPermissionDefault('Change cache managers', ('Manager',))
'manage_main',
'manage_stats',
'getCacheReport',
'sort_link',)),
('Change cache managers', ('manage_editProps','manage_invalidate'), ('Manager',)),
)
manage_options = ( manage_options = (
{'label':'Properties', 'action':'manage_main', {'label':'Properties', 'action':'manage_main',
...@@ -391,6 +387,7 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -391,6 +387,7 @@ class RAMCacheManager (CacheManager, SimpleItem):
caches[cacheid] = cache caches[cacheid] = cache
return cache return cache
security.declareProtected(view_management_screens, 'getSettings')
def getSettings(self): def getSettings(self):
'Returns the current cache settings.' 'Returns the current cache settings.'
res = self._settings.copy() res = self._settings.copy()
...@@ -398,8 +395,10 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -398,8 +395,10 @@ class RAMCacheManager (CacheManager, SimpleItem):
res['max_age'] = 0 res['max_age'] = 0
return res return res
security.declareProtected(view_management_screens, 'manage_main')
manage_main = DTMLFile('dtml/propsRCM', globals()) manage_main = DTMLFile('dtml/propsRCM', globals())
security.declareProtected('Change cache managers', 'manage_editProps')
def manage_editProps(self, title, settings=None, REQUEST=None): def manage_editProps(self, title, settings=None, REQUEST=None):
'Changes the cache settings.' 'Changes the cache settings.'
if settings is None: if settings is None:
...@@ -419,6 +418,7 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -419,6 +418,7 @@ class RAMCacheManager (CacheManager, SimpleItem):
return self.manage_main( return self.manage_main(
self, REQUEST, manage_tabs_message='Properties changed.') self, REQUEST, manage_tabs_message='Properties changed.')
security.declareProtected(view_management_screens, 'manage_stats')
manage_stats = DTMLFile('dtml/statsRCM', globals()) manage_stats = DTMLFile('dtml/statsRCM', globals())
def _getSortInfo(self): def _getSortInfo(self):
...@@ -431,6 +431,7 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -431,6 +431,7 @@ class RAMCacheManager (CacheManager, SimpleItem):
sort_reverse = int(req.get('sort_reverse', 1)) sort_reverse = int(req.get('sort_reverse', 1))
return sort_by, sort_reverse return sort_by, sort_reverse
security.declareProtected(view_management_screens, 'getCacheReport')
def getCacheReport(self): def getCacheReport(self):
""" """
Returns the list of objects in the cache, sorted according to Returns the list of objects in the cache, sorted according to
...@@ -446,6 +447,7 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -446,6 +447,7 @@ class RAMCacheManager (CacheManager, SimpleItem):
rval.reverse() rval.reverse()
return rval return rval
security.declareProtected(view_management_screens, 'sort_link')
def sort_link(self, name, id): def sort_link(self, name, id):
""" """
Utility for generating a sort link. Utility for generating a sort link.
...@@ -458,6 +460,7 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -458,6 +460,7 @@ class RAMCacheManager (CacheManager, SimpleItem):
url = url + '&sort_reverse=' + (newsr and '1' or '0') url = url + '&sort_reverse=' + (newsr and '1' or '0')
return '<a href="%s">%s</a>' % (escape(url, 1), escape(name)) return '<a href="%s">%s</a>' % (escape(url, 1), escape(name))
security.declareProtected('Change cache managers', 'manage_invalidate')
def manage_invalidate(self, paths, REQUEST=None): def manage_invalidate(self, paths, REQUEST=None):
""" ZMI helper to invalidate an entry """ """ ZMI helper to invalidate an entry """
for path in paths: for path in paths:
...@@ -472,7 +475,7 @@ class RAMCacheManager (CacheManager, SimpleItem): ...@@ -472,7 +475,7 @@ class RAMCacheManager (CacheManager, SimpleItem):
msg = 'Cache entries invalidated' msg = 'Cache entries invalidated'
return self.manage_stats(manage_tabs_message=msg) return self.manage_stats(manage_tabs_message=msg)
Globals.default__class_init__(RAMCacheManager) InitializeClass(RAMCacheManager)
class _ByteCounter: class _ByteCounter:
......
lib/python/Products/ZCatalog/ZCatalog.py
View file @ 41049f78
...@@ -19,7 +19,7 @@ from warnings import warn ...@@ -19,7 +19,7 @@ from warnings import warn
import urllib, time, sys, string, logging import urllib, time, sys, string, logging
from Globals import DTMLFile, MessageDialog from Globals import DTMLFile, MessageDialog
import Globals from Globals import InitializeClass
from OFS.Folder import Folder from OFS.Folder import Folder
from OFS.ObjectManager import ObjectManager from OFS.ObjectManager import ObjectManager
from DateTime import DateTime from DateTime import DateTime
...@@ -27,6 +27,7 @@ from Acquisition import Implicit ...@@ -27,6 +27,7 @@ from Acquisition import Implicit
from Persistence import Persistent from Persistence import Persistent
from DocumentTemplate.DT_Util import InstanceDict, TemplateDict from DocumentTemplate.DT_Util import InstanceDict, TemplateDict
from DocumentTemplate.DT_Util import Eval from DocumentTemplate.DT_Util import Eval
from AccessControl import ClassSecurityInfo
from AccessControl.Permission import name_trans from AccessControl.Permission import name_trans
from AccessControl.DTML import RestrictedDTML from AccessControl.DTML import RestrictedDTML
from AccessControl.Permissions import \ from AccessControl.Permissions import \
...@@ -86,6 +87,11 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -86,6 +87,11 @@ class ZCatalog(Folder, Persistent, Implicit):
__implements__ = z2IZCatalog __implements__ = z2IZCatalog
implements(z3IZCatalog) implements(z3IZCatalog)
security = ClassSecurityInfo()
security.setPermissionDefault(manage_zcatalog_entries, ('Manager',))
security.setPermissionDefault(manage_zcatalog_indexes, ('Manager',))
security.setPermissionDefault(search_zcatalog, ('Anonymous', 'Manager'))
meta_type = "ZCatalog" meta_type = "ZCatalog"
icon='misc_/ZCatalog/ZCatalog.gif' icon='misc_/ZCatalog/ZCatalog.gif'
...@@ -122,46 +128,30 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -122,46 +128,30 @@ class ZCatalog(Folder, Persistent, Implicit):
'help': ('OFSP','Ownership.stx'),} 'help': ('OFSP','Ownership.stx'),}
) )
__ac_permissions__=( security.declareProtected(manage_zcatalog_entries, 'manage_main')
(manage_zcatalog_entries,
['manage_catalogObject', 'manage_uncatalogObject',
'catalog_object', 'uncatalog_object', 'refreshCatalog',
'manage_catalogView', 'manage_catalogFind',
'manage_catalogSchema', 'manage_catalogIndexes',
'manage_catalogAdvanced', 'manage_objectInformation',
'manage_catalogReindex', 'manage_catalogFoundItems',
'manage_catalogClear', 'manage_addColumn', 'manage_delColumn',
'manage_addIndex', 'manage_delIndex', 'manage_clearIndex',
'manage_reindexIndex', 'manage_main', 'availableSplitters',
'manage_setProgress',
# these two are deprecated:
'manage_delColumns', 'manage_deleteIndex'
],
['Manager']),
(search_zcatalog,
['searchResults', '__call__', 'uniqueValuesFor',
'getpath', 'schema', 'indexes', 'index_objects',
'all_meta_types', 'valid_roles', 'resolve_url',
'getobject', 'search'],
['Anonymous', 'Manager']),
(manage_zcatalog_indexes,
['getIndexObjects'],
['Manager']),
)
security.declareProtected(search_zcatalog, 'all_meta_types')
manage_catalogAddRowForm = DTMLFile('dtml/catalogAddRowForm', globals()) manage_catalogAddRowForm = DTMLFile('dtml/catalogAddRowForm', globals())
security.declareProtected(manage_zcatalog_entries, 'manage_catalogView')
manage_catalogView = DTMLFile('dtml/catalogView',globals()) manage_catalogView = DTMLFile('dtml/catalogView',globals())
security.declareProtected(manage_zcatalog_entries, 'manage_catalogFind')
manage_catalogFind = DTMLFile('dtml/catalogFind',globals()) manage_catalogFind = DTMLFile('dtml/catalogFind',globals())
security.declareProtected(manage_zcatalog_entries, 'manage_catalogSchema')
manage_catalogSchema = DTMLFile('dtml/catalogSchema', globals()) manage_catalogSchema = DTMLFile('dtml/catalogSchema', globals())
security.declareProtected(manage_zcatalog_entries, 'manage_catalogIndexes')
manage_catalogIndexes = DTMLFile('dtml/catalogIndexes', globals()) manage_catalogIndexes = DTMLFile('dtml/catalogIndexes', globals())
security.declareProtected(manage_zcatalog_entries,
'manage_catalogAdvanced')
manage_catalogAdvanced = DTMLFile('dtml/catalogAdvanced', globals()) manage_catalogAdvanced = DTMLFile('dtml/catalogAdvanced', globals())
security.declareProtected(manage_zcatalog_entries,
'manage_objectInformation')
manage_objectInformation = DTMLFile('dtml/catalogObjectInformation', manage_objectInformation = DTMLFile('dtml/catalogObjectInformation',
globals()) globals())
...@@ -224,6 +214,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -224,6 +214,7 @@ class ZCatalog(Folder, Persistent, Implicit):
URL1 + URL1 +
'/manage_catalogAdvanced?manage_tabs_message=Catalog%20Changed') '/manage_catalogAdvanced?manage_tabs_message=Catalog%20Changed')
security.declareProtected(manage_zcatalog_entries, 'manage_catalogObject')
def manage_catalogObject(self, REQUEST, RESPONSE, URL1, urls=None): def manage_catalogObject(self, REQUEST, RESPONSE, URL1, urls=None):
""" index Zope object(s) that 'urls' point to """ """ index Zope object(s) that 'urls' point to """
if urls: if urls:
...@@ -242,6 +233,8 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -242,6 +233,8 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogView?manage_tabs_message=Object%20Cataloged') '/manage_catalogView?manage_tabs_message=Object%20Cataloged')
security.declareProtected(manage_zcatalog_entries,
'manage_uncatalogObject')
def manage_uncatalogObject(self, REQUEST, RESPONSE, URL1, urls=None): def manage_uncatalogObject(self, REQUEST, RESPONSE, URL1, urls=None):
""" removes Zope object(s) 'urls' from catalog """ """ removes Zope object(s) 'urls' from catalog """
...@@ -257,6 +250,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -257,6 +250,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogView?manage_tabs_message=Object%20Uncataloged') '/manage_catalogView?manage_tabs_message=Object%20Uncataloged')
security.declareProtected(manage_zcatalog_entries, 'manage_catalogReindex')
def manage_catalogReindex(self, REQUEST, RESPONSE, URL1): def manage_catalogReindex(self, REQUEST, RESPONSE, URL1):
""" clear the catalog, then re-index everything """ """ clear the catalog, then re-index everything """
...@@ -278,6 +272,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -278,6 +272,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'Total CPU time: %s' % (`elapse`, `c_elapse`))) 'Total CPU time: %s' % (`elapse`, `c_elapse`)))
security.declareProtected(manage_zcatalog_entries, 'refreshCatalog')
def refreshCatalog(self, clear=0, pghandler=None): def refreshCatalog(self, clear=0, pghandler=None):
""" re-index everything we can find """ """ re-index everything we can find """
...@@ -309,6 +304,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -309,6 +304,7 @@ class ZCatalog(Folder, Persistent, Implicit):
if pghandler: pghandler.finish() if pghandler: pghandler.finish()
security.declareProtected(manage_zcatalog_entries, 'manage_catalogClear')
def manage_catalogClear(self, REQUEST=None, RESPONSE=None, URL1=None): def manage_catalogClear(self, REQUEST=None, RESPONSE=None, URL1=None):
""" clears the whole enchilada """ """ clears the whole enchilada """
self._catalog.clear() self._catalog.clear()
...@@ -319,6 +315,8 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -319,6 +315,8 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogAdvanced?manage_tabs_message=Catalog%20Cleared') '/manage_catalogAdvanced?manage_tabs_message=Catalog%20Cleared')
security.declareProtected(manage_zcatalog_entries,
'manage_catalogFoundItems')
def manage_catalogFoundItems(self, REQUEST, RESPONSE, URL2, URL1, def manage_catalogFoundItems(self, REQUEST, RESPONSE, URL2, URL1,
obj_metatypes=None, obj_metatypes=None,
obj_ids=None, obj_searchterm=None, obj_ids=None, obj_searchterm=None,
...@@ -364,6 +362,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -364,6 +362,7 @@ class ZCatalog(Folder, Persistent, Implicit):
) )
security.declareProtected(manage_zcatalog_entries, 'manage_addColumn')
def manage_addColumn(self, name, REQUEST=None, RESPONSE=None, URL1=None): def manage_addColumn(self, name, REQUEST=None, RESPONSE=None, URL1=None):
""" add a column """ """ add a column """
self.addColumn(name) self.addColumn(name)
...@@ -374,6 +373,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -374,6 +373,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogSchema?manage_tabs_message=Column%20Added') '/manage_catalogSchema?manage_tabs_message=Column%20Added')
security.declareProtected(manage_zcatalog_entries, 'manage_delColumns')
def manage_delColumns(self, names, REQUEST=None, RESPONSE=None, URL1=None): def manage_delColumns(self, names, REQUEST=None, RESPONSE=None, URL1=None):
""" Deprecated method. Use manage_delColumn instead. """ """ Deprecated method. Use manage_delColumn instead. """
# log a deprecation warning # log a deprecation warning
...@@ -392,6 +392,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -392,6 +392,7 @@ class ZCatalog(Folder, Persistent, Implicit):
URL1=URL1) URL1=URL1)
security.declareProtected(manage_zcatalog_entries, 'manage_delColumn')
def manage_delColumn(self, names, REQUEST=None, RESPONSE=None, URL1=None): def manage_delColumn(self, names, REQUEST=None, RESPONSE=None, URL1=None):
""" delete a column or some columns """ """ delete a column or some columns """
if isinstance(names, str): if isinstance(names, str):
...@@ -406,6 +407,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -406,6 +407,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogSchema?manage_tabs_message=Column%20Deleted') '/manage_catalogSchema?manage_tabs_message=Column%20Deleted')
security.declareProtected(manage_zcatalog_entries, 'manage_addIndex')
def manage_addIndex(self, name, type, extra=None, def manage_addIndex(self, name, type, extra=None,
REQUEST=None, RESPONSE=None, URL1=None): REQUEST=None, RESPONSE=None, URL1=None):
"""add an index """ """add an index """
...@@ -417,6 +419,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -417,6 +419,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogIndexes?manage_tabs_message=Index%20Added') '/manage_catalogIndexes?manage_tabs_message=Index%20Added')
security.declareProtected(manage_zcatalog_entries, 'manage_deleteIndex')
def manage_deleteIndex(self, ids=None, REQUEST=None, RESPONSE=None, def manage_deleteIndex(self, ids=None, REQUEST=None, RESPONSE=None,
URL1=None): URL1=None):
""" Deprecated method. Use manage_delIndex instead. """ """ Deprecated method. Use manage_delIndex instead. """
...@@ -436,6 +439,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -436,6 +439,7 @@ class ZCatalog(Folder, Persistent, Implicit):
URL1=URL1) URL1=URL1)
security.declareProtected(manage_zcatalog_entries, 'manage_delIndex')
def manage_delIndex(self, ids=None, REQUEST=None, RESPONSE=None, def manage_delIndex(self, ids=None, REQUEST=None, RESPONSE=None,
URL1=None): URL1=None):
""" delete an index or some indexes """ """ delete an index or some indexes """
...@@ -456,6 +460,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -456,6 +460,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'/manage_catalogIndexes?manage_tabs_message=Index%20Deleted') '/manage_catalogIndexes?manage_tabs_message=Index%20Deleted')
security.declareProtected(manage_zcatalog_entries, 'manage_clearIndex')
def manage_clearIndex(self, ids=None, REQUEST=None, RESPONSE=None, def manage_clearIndex(self, ids=None, REQUEST=None, RESPONSE=None,
URL1=None): URL1=None):
""" clear an index or some indexes """ """ clear an index or some indexes """
...@@ -524,6 +529,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -524,6 +529,7 @@ class ZCatalog(Folder, Persistent, Implicit):
if pghandler: if pghandler:
pghandler.finish() pghandler.finish()
security.declareProtected(manage_zcatalog_entries, 'manage_reindexIndex')
def manage_reindexIndex(self, ids=None, REQUEST=None, RESPONSE=None, def manage_reindexIndex(self, ids=None, REQUEST=None, RESPONSE=None,
URL1=None): URL1=None):
"""Reindex indexe(s) from a ZCatalog""" """Reindex indexe(s) from a ZCatalog"""
...@@ -543,11 +549,13 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -543,11 +549,13 @@ class ZCatalog(Folder, Persistent, Implicit):
'?manage_tabs_message=Reindexing%20Performed') '?manage_tabs_message=Reindexing%20Performed')
security.declareProtected(manage_zcatalog_entries, 'availableSplitters')
def availableSplitters(self): def availableSplitters(self):
""" splitter we can add """ """ splitter we can add """
return Splitter.availableSplitters return Splitter.availableSplitters
security.declareProtected(manage_zcatalog_entries, 'catalog_object')
def catalog_object(self, obj, uid=None, idxs=None, update_metadata=1, pghandler=None): def catalog_object(self, obj, uid=None, idxs=None, update_metadata=1, pghandler=None):
""" wrapper around catalog """ """ wrapper around catalog """
...@@ -593,14 +601,17 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -593,14 +601,17 @@ class ZCatalog(Folder, Persistent, Implicit):
if pghandler: if pghandler:
pghandler.info('commiting subtransaction') pghandler.info('commiting subtransaction')
security.declareProtected(manage_zcatalog_entries, 'uncatalog_object')
def uncatalog_object(self, uid): def uncatalog_object(self, uid):
"""Wrapper around catalog """ """Wrapper around catalog """
self._catalog.uncatalogObject(uid) self._catalog.uncatalogObject(uid)
security.declareProtected(search_zcatalog, 'uniqueValuesFor')
def uniqueValuesFor(self, name): def uniqueValuesFor(self, name):
"""Return the unique values for a given FieldIndex """ """Return the unique values for a given FieldIndex """
return self._catalog.uniqueValuesFor(name) return self._catalog.uniqueValuesFor(name)
security.declareProtected(search_zcatalog, 'getpath')
def getpath(self, rid): def getpath(self, rid):
"""Return the path to a cataloged object given a 'data_record_id_' """Return the path to a cataloged object given a 'data_record_id_'
""" """
...@@ -611,6 +622,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -611,6 +622,7 @@ class ZCatalog(Folder, Persistent, Implicit):
""" """
return self._catalog.uids.get(path, default) return self._catalog.uids.get(path, default)
security.declareProtected(search_zcatalog, 'getobject')
def getobject(self, rid, REQUEST=None): def getobject(self, rid, REQUEST=None):
"""Return a cataloged object given a 'data_record_id_' """Return a cataloged object given a 'data_record_id_'
""" """
...@@ -639,17 +651,21 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -639,17 +651,21 @@ class ZCatalog(Folder, Persistent, Implicit):
"""return the current index contents for the specific rid""" """return the current index contents for the specific rid"""
return self._catalog.getIndexDataForRID(rid) return self._catalog.getIndexDataForRID(rid)
security.declareProtected(search_zcatalog, 'schema')
def schema(self): def schema(self):
return self._catalog.schema.keys() return self._catalog.schema.keys()
security.declareProtected(search_zcatalog, 'indexes')
def indexes(self): def indexes(self):
return self._catalog.indexes.keys() return self._catalog.indexes.keys()
security.declareProtected(search_zcatalog, 'index_objects')
def index_objects(self): def index_objects(self):
# This method returns unwrapped indexes! # This method returns unwrapped indexes!
# You should probably use getIndexObjects instead # You should probably use getIndexObjects instead
return self._catalog.indexes.values() return self._catalog.indexes.values()
security.declareProtected(manage_zcatalog_indexes, 'getIndexObjects')
def getIndexObjects(self): def getIndexObjects(self):
# Return a list of wrapped(!) indexes # Return a list of wrapped(!) indexes
getIndex = self._catalog.getIndex getIndex = self._catalog.getIndex
...@@ -677,6 +693,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -677,6 +693,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'width': 8}) 'width': 8})
return r return r
security.declareProtected(search_zcatalog, 'searchResults')
def searchResults(self, REQUEST=None, used=None, **kw): def searchResults(self, REQUEST=None, used=None, **kw):
"""Search the catalog """Search the catalog
...@@ -688,8 +705,10 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -688,8 +705,10 @@ class ZCatalog(Folder, Persistent, Implicit):
return self._catalog.searchResults(REQUEST, used, **kw) return self._catalog.searchResults(REQUEST, used, **kw)
security.declareProtected(search_zcatalog, '__call__')
__call__=searchResults __call__=searchResults
security.declareProtected(search_zcatalog, 'search')
def search( def search(
self, query_request, sort_index=None, reverse=0, limit=None, merge=1): self, query_request, sort_index=None, reverse=0, limit=None, merge=1):
"""Programmatic search interface, use for searching the catalog from """Programmatic search interface, use for searching the catalog from
...@@ -720,6 +739,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -720,6 +739,7 @@ class ZCatalog(Folder, Persistent, Implicit):
# except AttributeError: pass # except AttributeError: pass
# return self.meta_types+Products.meta_types+pmt # return self.meta_types+Products.meta_types+pmt
security.declareProtected(search_zcatalog, 'valid_roles')
def valid_roles(self): def valid_roles(self):
"Return list of valid roles" "Return list of valid roles"
obj=self obj=self
...@@ -838,6 +858,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -838,6 +858,7 @@ class ZCatalog(Folder, Persistent, Implicit):
return result return result
security.declareProtected(search_zcatalog, 'resolve_url')
def resolve_url(self, path, REQUEST): def resolve_url(self, path, REQUEST):
""" """
Attempt to resolve a url into an object in the Zope Attempt to resolve a url into an object in the Zope
...@@ -902,6 +923,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -902,6 +923,7 @@ class ZCatalog(Folder, Persistent, Implicit):
'%s unchanged.' % (len(fixed), len(removed), unchanged), '%s unchanged.' % (len(fixed), len(removed), unchanged),
action='./manage_main') action='./manage_main')
security.declareProtected(manage_zcatalog_entries, 'manage_setProgress')
def manage_setProgress(self, pgthreshold=0, RESPONSE=None, URL1=None): def manage_setProgress(self, pgthreshold=0, RESPONSE=None, URL1=None):
"""Set parameter to perform logging of reindexing operations very """Set parameter to perform logging of reindexing operations very
'pgthreshold' objects 'pgthreshold' objects
...@@ -1026,7 +1048,7 @@ class ZCatalog(Folder, Persistent, Implicit): ...@@ -1026,7 +1048,7 @@ class ZCatalog(Folder, Persistent, Implicit):
return self._catalog.delColumn(name) return self._catalog.delColumn(name)
Globals.default__class_init__(ZCatalog) InitializeClass(ZCatalog)
def p_name(name): def p_name(name):
......
lib/python/Products/ZSQLMethods/SQL.py
View file @ 41049f78
...@@ -18,6 +18,9 @@ __version__='$Revision: 1.21 $'[11:-2] ...@@ -18,6 +18,9 @@ __version__='$Revision: 1.21 $'[11:-2]
import Shared.DC.ZRDB.DA import Shared.DC.ZRDB.DA
from Globals import DTMLFile from Globals import DTMLFile
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import change_database_methods
from webdav.WriteLockInterface import WriteLockInterface from webdav.WriteLockInterface import WriteLockInterface
def SQLConnectionIDs(self): def SQLConnectionIDs(self):
...@@ -120,12 +123,11 @@ class SQL(Shared.DC.ZRDB.DA.DA): ...@@ -120,12 +123,11 @@ class SQL(Shared.DC.ZRDB.DA.DA):
__implements__ = (WriteLockInterface,) __implements__ = (WriteLockInterface,)
meta_type='Z SQL Method' meta_type='Z SQL Method'
security = ClassSecurityInfo()
security.declareProtected(change_database_methods, 'manage')
security.declareProtected(change_database_methods, 'manage_main')
manage=manage_main=DTMLFile('dtml/edit', globals()) manage=manage_main=DTMLFile('dtml/edit', globals())
manage_main._setName('manage_main') manage_main._setName('manage_main')
__ac_permissions__=( InitializeClass(SQL)
('Change Database Methods', ('manage', 'manage_main')),
)
import Globals
Globals.InitializeClass(SQL)
lib/python/Shared/DC/Scripts/Bindings.py
View file @ 41049f78
...@@ -13,8 +13,10 @@ ...@@ -13,8 +13,10 @@
__version__='$Revision$'[11:-2] __version__='$Revision$'[11:-2]
import Globals from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.Permissions import view_management_screens
from AccessControl.PermissionRole import _what_not_even_god_should_do from AccessControl.PermissionRole import _what_not_even_god_should_do
from AccessControl.ZopeGuards import guarded_getattr from AccessControl.ZopeGuards import guarded_getattr
from Persistence import Persistent from Persistence import Persistent
...@@ -190,18 +192,17 @@ class UnauthorizedBinding: ...@@ -190,18 +192,17 @@ class UnauthorizedBinding:
class Bindings: class Bindings:
__ac_permissions__ = ( security = ClassSecurityInfo()
('View management screens', ('getBindingAssignments',)),
('Change bindings', ('ZBindings_edit', 'ZBindings_setClient')),
)
_Bindings_client = None _Bindings_client = None
security.declareProtected('Change bindings', 'ZBindings_edit')
def ZBindings_edit(self, mapping): def ZBindings_edit(self, mapping):
names = self._setupBindings(mapping) names = self._setupBindings(mapping)
self._prepareBindCode() self._prepareBindCode()
self._editedBindings() self._editedBindings()
security.declareProtected('Change bindings', 'ZBindings_setClient')
def ZBindings_setClient(self, clientname): def ZBindings_setClient(self, clientname):
'''Name the binding to be used as the "client". '''Name the binding to be used as the "client".
...@@ -217,6 +218,7 @@ class Bindings: ...@@ -217,6 +218,7 @@ class Bindings:
self._bind_names = names = NameAssignments(names) self._bind_names = names = NameAssignments(names)
return names return names
security.declareProtected(view_management_screens, 'getBindingAssignments')
def getBindingAssignments(self): def getBindingAssignments(self):
if not hasattr(self, '_bind_names'): if not hasattr(self, '_bind_names'):
self._setupBindings() self._setupBindings()
...@@ -348,3 +350,5 @@ class Bindings: ...@@ -348,3 +350,5 @@ class Bindings:
return self._exec(bound_data, args, kw) return self._exec(bound_data, args, kw)
finally: finally:
security.removeContext(self) security.removeContext(self)
InitializeClass(Bindings)
lib/python/Shared/DC/Scripts/BindingsUI.py
View file @ 41049f78
...@@ -14,23 +14,26 @@ ...@@ -14,23 +14,26 @@
__version__='$Revision$'[11:-2] __version__='$Revision$'[11:-2]
import Globals import Globals
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
from Bindings import Bindings from Bindings import Bindings
class BindingsUI(Bindings): class BindingsUI(Bindings):
security = ClassSecurityInfo()
manage_options = ( manage_options = (
{'label':'Bindings', {'label':'Bindings',
'action':'ZBindingsHTML_editForm', 'action':'ZBindingsHTML_editForm',
'help':('PythonScripts', 'Bindings.stx')}, 'help':('PythonScripts', 'Bindings.stx')},
) )
__ac_permissions__ = ( security.declareProtected(view_management_screens,
('View management screens', ('ZBindingsHTML_editForm',)), 'ZBindingsHTML_editForm')
('Change bindings', ('ZBindingsHTML_editAction',)),
)
ZBindingsHTML_editForm = Globals.DTMLFile('dtml/scriptBindings', globals()) ZBindingsHTML_editForm = Globals.DTMLFile('dtml/scriptBindings', globals())
security.declareProtected('Change bindings', 'ZBindingsHTML_editAction')
def ZBindingsHTML_editAction(self, REQUEST): def ZBindingsHTML_editAction(self, REQUEST):
'''Changes binding names. '''Changes binding names.
''' '''
...@@ -38,4 +41,4 @@ class BindingsUI(Bindings): ...@@ -38,4 +41,4 @@ class BindingsUI(Bindings):
message = "Bindings changed." message = "Bindings changed."
return self.manage_main(self, REQUEST, manage_tabs_message=message) return self.manage_main(self, REQUEST, manage_tabs_message=message)
Globals.default__class_init__(BindingsUI) InitializeClass(BindingsUI)
lib/python/Shared/DC/Scripts/Script.py
View file @ 41049f78
...@@ -18,7 +18,10 @@ This provides generic script support ...@@ -18,7 +18,10 @@ This provides generic script support
__version__='$Revision$'[11:-2] __version__='$Revision$'[11:-2]
from Globals import InitializeClass
from Globals import DTMLFile from Globals import DTMLFile
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
from OFS.SimpleItem import SimpleItem from OFS.SimpleItem import SimpleItem
from string import join from string import join
from urllib import quote from urllib import quote
...@@ -34,17 +37,17 @@ class Script(SimpleItem, BindingsUI): ...@@ -34,17 +37,17 @@ class Script(SimpleItem, BindingsUI):
"""Web-callable script mixin """Web-callable script mixin
""" """
security = ClassSecurityInfo()
index_html = None index_html = None
func_defaults=() func_defaults=()
func_code=None func_code=None
_Bindings_ns_class = TemplateDict _Bindings_ns_class = TemplateDict
__ac_permissions__ = ( security.declareProtected(view_management_screens, 'ZScriptHTML_tryForm')
('View management screens', ('ZScriptHTML_tryForm',)),
)
ZScriptHTML_tryForm = DTMLFile('dtml/scriptTry', globals()) ZScriptHTML_tryForm = DTMLFile('dtml/scriptTry', globals())
def ZScriptHTML_tryAction(self, REQUEST, argvars): def ZScriptHTML_tryAction(self, REQUEST, argvars):
"""Apply the test parameters. """Apply the test parameters.
""" """
...@@ -55,3 +58,5 @@ class Script(SimpleItem, BindingsUI): ...@@ -55,3 +58,5 @@ class Script(SimpleItem, BindingsUI):
raise Redirect, "%s?%s" % (REQUEST['URL1'], join(vv, '&')) raise Redirect, "%s?%s" % (REQUEST['URL1'], join(vv, '&'))
from Signature import _setFuncSignature from Signature import _setFuncSignature
InitializeClass(Script)
lib/python/Shared/DC/ZRDB/Connection.py
View file @ 41049f78
...@@ -19,6 +19,12 @@ import Globals, OFS.SimpleItem, AccessControl.Role, Acquisition, sys ...@@ -19,6 +19,12 @@ import Globals, OFS.SimpleItem, AccessControl.Role, Acquisition, sys
from DateTime import DateTime from DateTime import DateTime
from App.Dialogs import MessageDialog from App.Dialogs import MessageDialog
from Globals import DTMLFile from Globals import DTMLFile
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view_management_screens
from AccessControl.Permissions import change_database_connections
from AccessControl.Permissions import test_database_connections
from AccessControl.Permissions import open_close_database_connection
from string import find, join, split from string import find, join, split
from Aqueduct import custom_default_report from Aqueduct import custom_default_report
from cStringIO import StringIO from cStringIO import StringIO
...@@ -36,6 +42,8 @@ class Connection( ...@@ -36,6 +42,8 @@ class Connection(
Acquisition.Implicit, Acquisition.Implicit,
): ):
security = ClassSecurityInfo()
# Specify definitions for tabs: # Specify definitions for tabs:
manage_options=( manage_options=(
( (
...@@ -47,15 +55,6 @@ class Connection( ...@@ -47,15 +55,6 @@ class Connection(
+OFS.SimpleItem.Item.manage_options +OFS.SimpleItem.Item.manage_options
) )
# Specify how individual operations add up to "permissions":
__ac_permissions__=(
('View management screens', ('manage_main',)),
('Change Database Connections', ('manage_edit',)),
('Test Database Connections', ('manage_testForm','manage_test')),
('Open/Close Database Connection',
('manage_open_connection', 'manage_close_connection')),
)
_v_connected='' _v_connected=''
connection_string='' connection_string=''
...@@ -97,6 +96,8 @@ class Connection( ...@@ -97,6 +96,8 @@ class Connection(
if check: self.connect(connection_string) if check: self.connect(connection_string)
manage_properties=DTMLFile('dtml/connectionEdit', globals()) manage_properties=DTMLFile('dtml/connectionEdit', globals())
security.declareProtected(change_database_connections, 'manage_edit')
def manage_edit(self, title, connection_string, check=None, REQUEST=None): def manage_edit(self, title, connection_string, check=None, REQUEST=None):
"""Change connection """Change connection
""" """
...@@ -108,7 +109,10 @@ class Connection( ...@@ -108,7 +109,10 @@ class Connection(
action ='./manage_main', action ='./manage_main',
) )
security.declareProtected(test_database_connections, 'manage_testForm')
manage_testForm=DTMLFile('dtml/connectionTestForm', globals()) manage_testForm=DTMLFile('dtml/connectionTestForm', globals())
security.declareProtected(test_database_connections, 'manage_test')
def manage_test(self, query, REQUEST=None): def manage_test(self, query, REQUEST=None):
"Executes the SQL in parameter 'query' and returns results" "Executes the SQL in parameter 'query' and returns results"
dbc=self() #get our connection dbc=self() #get our connection
...@@ -142,8 +146,11 @@ class Connection( ...@@ -142,8 +146,11 @@ class Connection(
return report return report
security.declareProtected(view_management_screens, 'manage_main')
manage_main=DTMLFile('dtml/connectionStatus', globals()) manage_main=DTMLFile('dtml/connectionStatus', globals())
security.declareProtected(open_close_database_connection,
'manage_close_connection')
def manage_close_connection(self, REQUEST=None): def manage_close_connection(self, REQUEST=None):
" " " "
try: try:
...@@ -158,6 +165,8 @@ class Connection( ...@@ -158,6 +165,8 @@ class Connection(
if REQUEST is not None: if REQUEST is not None:
return self.manage_main(self, REQUEST) return self.manage_main(self, REQUEST)
security.declareProtected(open_close_database_connection,
'manage_open_connection')
def manage_open_connection(self, REQUEST=None): def manage_open_connection(self, REQUEST=None):
" " " "
self.connect(self.connection_string) self.connect(self.connection_string)
...@@ -193,3 +202,5 @@ class Connection( ...@@ -193,3 +202,5 @@ class Connection(
def sql_quote__(self, v): def sql_quote__(self, v):
if find(v,"\'") >= 0: v=join(split(v,"\'"),"''") if find(v,"\'") >= 0: v=join(split(v,"\'"),"''")
return "'%s'" % v return "'%s'" % v
InitializeClass(Connection)
lib/python/Shared/DC/ZRDB/DA.py
View file @ 41049f78
...@@ -34,7 +34,12 @@ import DocumentTemplate.DT_Util ...@@ -34,7 +34,12 @@ import DocumentTemplate.DT_Util
from cPickle import dumps, loads from cPickle import dumps, loads
from Results import Results from Results import Results
from App.Extensions import getBrain from App.Extensions import getBrain
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl.Permissions import change_database_methods
from AccessControl.Permissions import use_database_methods
from AccessControl.Permissions import view_management_screens
from AccessControl.DTML import RestrictedDTML from AccessControl.DTML import RestrictedDTML
from webdav.Resource import Resource from webdav.Resource import Resource
from webdav.Lockable import ResourceLockedError from webdav.Lockable import ResourceLockedError
...@@ -73,6 +78,11 @@ class DA( ...@@ -73,6 +78,11 @@ class DA(
): ):
'Database Adapter' 'Database Adapter'
security = ClassSecurityInfo()
security.declareObjectProtected(use_database_methods)
security.setPermissionDefault(use_database_methods,
('Anonymous', 'Manager'))
_col=None _col=None
max_rows_=1000 max_rows_=1000
cache_time_=0 cache_time_=0
...@@ -96,27 +106,14 @@ class DA( ...@@ -96,27 +106,14 @@ class DA(
+OFS.SimpleItem.Item.manage_options +OFS.SimpleItem.Item.manage_options
) )
# Specify how individual operations add up to "permissions":
__ac_permissions__=(
('View management screens',
(
'index_html',
'manage_advancedForm', 'PrincipiaSearchSource', 'document_src'
)),
('Change Database Methods',
('manage_edit','manage_advanced', 'manage_testForm','manage_test',
'manage_product_zclass_info', 'PUT')),
('Use Database Methods', ('__call__',''), ('Anonymous','Manager')),
)
def __init__(self, id, title, connection_id, arguments, template): def __init__(self, id, title, connection_id, arguments, template):
self.id=str(id) self.id=str(id)
self.manage_edit(title, connection_id, arguments, template) self.manage_edit(title, connection_id, arguments, template)
security.declareProtected(view_management_screens, 'manage_advancedForm')
manage_advancedForm=DTMLFile('dtml/advanced', globals()) manage_advancedForm=DTMLFile('dtml/advanced', globals())
test_url___roles__=None security.declarePublic('test_url')
def test_url_(self): def test_url_(self):
'Method for testing server connection information' 'Method for testing server connection information'
return 'PING' return 'PING'
...@@ -148,6 +145,7 @@ class DA( ...@@ -148,6 +145,7 @@ class DA(
arguments_src=arguments, arguments_src=arguments,
connection_id=connection_id, src=template) connection_id=connection_id, src=template)
security.declareProtected(change_database_methods, 'manage_edit')
def manage_edit(self,title,connection_id,arguments,template, def manage_edit(self,title,connection_id,arguments,template,
SUBMIT='Change', dtpref_cols='100%', dtpref_rows='20', SUBMIT='Change', dtpref_cols='100%', dtpref_rows='20',
REQUEST=None): REQUEST=None):
...@@ -189,6 +187,7 @@ class DA( ...@@ -189,6 +187,7 @@ class DA(
return '' return ''
security.declareProtected(change_database_methods, 'manage_advanced')
def manage_advanced(self, max_rows, max_cache, cache_time, def manage_advanced(self, max_rows, max_cache, cache_time,
class_name, class_file, direct=None, class_name, class_file, direct=None,
REQUEST=None, zclass='', connection_hook=None): REQUEST=None, zclass='', connection_hook=None):
...@@ -256,6 +255,7 @@ class DA( ...@@ -256,6 +255,7 @@ class DA(
# """Return content for use by the Find machinery.""" # """Return content for use by the Find machinery."""
# return '%s\n%s' % (self.arguments_src, self.src) # return '%s\n%s' % (self.arguments_src, self.src)
security.declareProtected(view_management_screens, 'PrincipiaSearchSource')
def PrincipiaSearchSource(self): def PrincipiaSearchSource(self):
"""Return content for use by the Find machinery.""" """Return content for use by the Find machinery."""
return '%s\n%s' % (self.arguments_src, self.src) return '%s\n%s' % (self.arguments_src, self.src)
...@@ -265,6 +265,7 @@ class DA( ...@@ -265,6 +265,7 @@ class DA(
default_content_type = 'text/plain' default_content_type = 'text/plain'
security.declareProtected(view_management_screens, 'document_src')
def document_src(self, REQUEST=None, RESPONSE=None): def document_src(self, REQUEST=None, RESPONSE=None):
"""Return unprocessed document source.""" """Return unprocessed document source."""
if RESPONSE is not None: if RESPONSE is not None:
...@@ -278,6 +279,7 @@ class DA( ...@@ -278,6 +279,7 @@ class DA(
def get_size(self): return len(self.document_src()) def get_size(self): return len(self.document_src())
security.declareProtected(change_database_methods, 'PUT')
def PUT(self, REQUEST, RESPONSE): def PUT(self, REQUEST, RESPONSE):
"""Handle put requests""" """Handle put requests"""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -297,6 +299,7 @@ class DA( ...@@ -297,6 +299,7 @@ class DA(
return RESPONSE return RESPONSE
security.declareProtected(change_database_methods, 'manage_testForm')
def manage_testForm(self, REQUEST): def manage_testForm(self, REQUEST):
" " " "
input_src=default_input_form(self.title_or_id(), input_src=default_input_form(self.title_or_id(),
...@@ -304,6 +307,7 @@ class DA( ...@@ -304,6 +307,7 @@ class DA(
'<dtml-var manage_tabs>') '<dtml-var manage_tabs>')
return DocumentTemplate.HTML(input_src)(self, REQUEST, HTTP_REFERER='') return DocumentTemplate.HTML(input_src)(self, REQUEST, HTTP_REFERER='')
security.declareProtected(change_database_methods, 'manage_test')
def manage_test(self, REQUEST): def manage_test(self, REQUEST):
"""Test an SQL method.""" """Test an SQL method."""
# Try to render the query template first so that the rendered # Try to render the query template first so that the rendered
...@@ -344,6 +348,7 @@ class DA( ...@@ -344,6 +348,7 @@ class DA(
finally: tb=None finally: tb=None
security.declareProtected(view_management_screens, 'index_html')
def index_html(self, REQUEST): def index_html(self, REQUEST):
""" """ """ """
REQUEST.RESPONSE.redirect("%s/manage_testForm" % REQUEST['URL1']) REQUEST.RESPONSE.redirect("%s/manage_testForm" % REQUEST['URL1'])
...@@ -388,6 +393,7 @@ class DA( ...@@ -388,6 +393,7 @@ class DA(
return result return result
security.declareProtected(use_database_methods, '__call__')
def __call__(self, REQUEST=None, __ick__=None, src__=0, test__=0, **kw): def __call__(self, REQUEST=None, __ick__=None, src__=0, test__=0, **kw):
"""Call the database method """Call the database method
...@@ -500,6 +506,8 @@ class DA( ...@@ -500,6 +506,8 @@ class DA(
return getattr(getattr(self, self.connection_id), 'connected')() return getattr(getattr(self, self.connection_id), 'connected')()
security.declareProtected(change_database_methods,
'manage_product_zclass_info')
def manage_product_zclass_info(self): def manage_product_zclass_info(self):
r=[] r=[]
Z=self._zclass Z=self._zclass
...@@ -517,9 +525,7 @@ class DA( ...@@ -517,9 +525,7 @@ class DA(
return r return r
InitializeClass(DA)
Globals.default__class_init__(DA)
...@@ -586,4 +592,3 @@ class SQLMethodTracebackSupplement: ...@@ -586,4 +592,3 @@ class SQLMethodTracebackSupplement:
#__implements__ = ITracebackSupplement #__implements__ = ITracebackSupplement
def __init__(self, sql): def __init__(self, sql):
self.object = sql self.object = sql
lib/python/Testing/ZopeTestCase/ZopeLite.py
View file @ 41049f78
...@@ -153,7 +153,7 @@ def installProduct(name, quiet=0): ...@@ -153,7 +153,7 @@ def installProduct(name, quiet=0):
get_folder_permissions(), raise_exc=1) get_folder_permissions(), raise_exc=1)
_installedProducts[product_name] = 1 _installedProducts[product_name] = 1
Products.meta_types = Products.meta_types + tuple(meta_types) Products.meta_types = Products.meta_types + tuple(meta_types)
Globals.default__class_init__(Folder) Globals.InitializeClass(Folder)
if not quiet: _print('done (%.3fs)\n' % (time.time() - start)) if not quiet: _print('done (%.3fs)\n' % (time.time() - start))
break break
else: else:
......
lib/python/ZClasses/Property.py
View file @ 41049f78
...@@ -17,7 +17,12 @@ import transaction ...@@ -17,7 +17,12 @@ import transaction
import OFS.PropertySheets, Globals, OFS.SimpleItem, OFS.PropertyManager import OFS.PropertySheets, Globals, OFS.SimpleItem, OFS.PropertyManager
import Acquisition import Acquisition
from Globals import InitializeClass
from AccessControl import ClassSecurityInfo
from AccessControl.Permission import pname from AccessControl.Permission import pname
from AccessControl.Permissions import manage_zclasses
from AccessControl.Permissions import manage_properties
from AccessControl.Permissions import access_contents_information
class ClassCaretaker: class ClassCaretaker:
def __init__(self, klass): self.__dict__['_k']=klass def __init__(self, klass): self.__dict__['_k']=klass
...@@ -48,9 +53,10 @@ class ZCommonSheet(OFS.PropertySheets.PropertySheet, OFS.SimpleItem.Item): ...@@ -48,9 +53,10 @@ class ZCommonSheet(OFS.PropertySheets.PropertySheet, OFS.SimpleItem.Item):
'help':('OFSP','Security_Define-Permissions.stx')}, 'help':('OFSP','Security_Define-Permissions.stx')},
) )
__ac_permissions__=( security = ClassSecurityInfo()
('Manage Z Classes', ('', 'manage')), security.declareObjectProtected(manage_zclasses)
)
security.declareProtected(manage_zclasses, 'manage')
def __init__(self, id, title): def __init__(self, id, title):
self.id=id self.id=id
...@@ -238,7 +244,8 @@ class ZCommonSheet(OFS.PropertySheets.PropertySheet, OFS.SimpleItem.Item): ...@@ -238,7 +244,8 @@ class ZCommonSheet(OFS.PropertySheets.PropertySheet, OFS.SimpleItem.Item):
self, REQUEST, self, REQUEST,
manage_tabs_message='The permission mapping has been updated') manage_tabs_message='The permission mapping has been updated')
Globals.default__class_init__(ZCommonSheet) InitializeClass(ZCommonSheet)
property_sheet_permissions=( property_sheet_permissions=(
# 'Access contents information', # 'Access contents information',
...@@ -250,26 +257,28 @@ class ZInstanceSheet(OFS.PropertySheets.FixedSchema, ...@@ -250,26 +257,28 @@ class ZInstanceSheet(OFS.PropertySheets.FixedSchema,
): ):
"Waaa this is too hard" "Waaa this is too hard"
security = ClassSecurityInfo()
security.declareObjectProtected(access_contents_information)
security.declareProtected(access_contents_information, 'hasProperty')
security.declareProtected(access_contents_information, 'propertyIds')
security.declareProtected(access_contents_information, 'propertyValues')
security.declareProtected(access_contents_information, 'propertyItems')
security.declareProtected(access_contents_information, 'propertyMap')
security.declareProtected(manage_properties, 'manage')
security.declareProtected(manage_properties, 'manage_addProperty')
security.declareProtected(manage_properties, 'manage_editProperties')
security.declareProtected(manage_properties, 'manage_delProperties')
security.declareProtected(manage_properties, 'manage_changeProperties')
_Manage_properties_Permission='_Manage_properties_Permission' _Manage_properties_Permission='_Manage_properties_Permission'
_Access_contents_information_Permission='_View_Permission' _Access_contents_information_Permission='_View_Permission'
__ac_permissions__=(
('Manage properties', ('manage_addProperty',
'manage_editProperties',
'manage_delProperties',
'manage_changeProperties',
'manage',
)),
('Access contents information', ('hasProperty', 'propertyIds',
'propertyValues','propertyItems',
'propertyMap', ''),
),
)
def v_self(self): def v_self(self):
return self.aq_inner.aq_parent.aq_parent return self.aq_inner.aq_parent.aq_parent
Globals.default__class_init__(ZInstanceSheet) InitializeClass(ZInstanceSheet)
def rclass(klass): def rclass(klass):
if not getattr(klass, '_p_changed', 0) and klass._p_jar is not None: if not getattr(klass, '_p_changed', 0) and klass._p_jar is not None:
...@@ -348,5 +357,4 @@ class ZInstanceSheets(OFS.PropertySheets.PropertySheets, Globals.Persistent): ...@@ -348,5 +357,4 @@ class ZInstanceSheets(OFS.PropertySheets.PropertySheets, Globals.Persistent):
r.append(getattr(self, id)) r.append(getattr(self, id))
return propsets+tuple(r) return propsets+tuple(r)
InitializeClass(ZInstanceSheets)
Globals.default__class_init__(ZInstanceSheets)
lib/python/ZClasses/ZClass.py
View file @ 41049f78
...@@ -13,7 +13,10 @@ ...@@ -13,7 +13,10 @@
"""Zope Classes """Zope Classes
""" """
import Globals, OFS.SimpleItem, OFS.PropertySheets, Products import Globals, OFS.SimpleItem, OFS.PropertySheets, Products
from Globals import InitializeClass
import Method, Basic, Property, AccessControl.Role, re import Method, Basic, Property, AccessControl.Role, re
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import create_class_instances
from ZPublisher.mapply import mapply from ZPublisher.mapply import mapply
from ExtensionClass import Base from ExtensionClass import Base
...@@ -220,10 +223,8 @@ class ZClass( Base ...@@ -220,10 +223,8 @@ class ZClass( Base
__propsets__=() __propsets__=()
isPrincipiaFolderish=1 isPrincipiaFolderish=1
__ac_permissions__=( security = ClassSecurityInfo()
('Create class instances', security.declareObjectProtected(create_class_instances)
('', '__call__', 'index_html', 'createInObjectManager')),
)
def __init__(self, id, title, bases, zope_object=1): def __init__(self, id, title, bases, zope_object=1):
"""Build a Zope class """Build a Zope class
...@@ -343,7 +344,7 @@ class ZClass( Base ...@@ -343,7 +344,7 @@ class ZClass( Base
return '*'+id return '*'+id
changeClassId__roles__ = () # Private security.declarePrivate('changeClassId')
def changeClassId(self, newid=None): def changeClassId(self, newid=None):
if newid is None: newid=self._new_class_id() if newid is None: newid=self._new_class_id()
self._unregister() self._unregister()
...@@ -442,6 +443,7 @@ class ZClass( Base ...@@ -442,6 +443,7 @@ class ZClass( Base
manage_options=ComputedAttribute(manage_options) manage_options=ComputedAttribute(manage_options)
security.declareProtected(create_class_instances, 'createInObjectManager')
def createInObjectManager(self, id, REQUEST, RESPONSE=None): def createInObjectManager(self, id, REQUEST, RESPONSE=None):
""" """
Create Z instance. If called with a RESPONSE, Create Z instance. If called with a RESPONSE,
...@@ -470,6 +472,7 @@ class ZClass( Base ...@@ -470,6 +472,7 @@ class ZClass( Base
else: else:
return folder._getOb(id) return folder._getOb(id)
security.declareProtected(create_class_instances, 'index_html')
index_html=createInObjectManager index_html=createInObjectManager
def fromRequest(self, id=None, REQUEST={}): def fromRequest(self, id=None, REQUEST={}):
...@@ -487,6 +490,7 @@ class ZClass( Base ...@@ -487,6 +490,7 @@ class ZClass( Base
i.id = id i.id = id
return i return i
security.declareProtected(create_class_instances, '__call__')
def __call__(self, *args, **kw): def __call__(self, *args, **kw):
return apply(self._zclass_, args, kw) return apply(self._zclass_, args, kw)
...@@ -511,7 +515,7 @@ class ZClass( Base ...@@ -511,7 +515,7 @@ class ZClass( Base
r.sort() r.sort()
return r return r
getClassAttr__roles__ = () # Private security.declarePrivate('getClassAttr')
def getClassAttr(self, name, default=_marker, inherit=0): def getClassAttr(self, name, default=_marker, inherit=0):
if default is _marker: if default is _marker:
if inherit: return getattr(self._zclass_, name) if inherit: return getattr(self._zclass_, name)
...@@ -521,7 +525,7 @@ class ZClass( Base ...@@ -521,7 +525,7 @@ class ZClass( Base
else: return self._zclass_.__dict__[name] else: return self._zclass_.__dict__[name]
except: return default except: return default
setClassAttr__roles__ = () # Private security.declarePrivate('setClassAttr')
def setClassAttr(self, name, value): def setClassAttr(self, name, value):
c=self._zclass_ c=self._zclass_
setattr(c, name, value) setattr(c, name, value)
...@@ -529,7 +533,7 @@ class ZClass( Base ...@@ -529,7 +533,7 @@ class ZClass( Base
transaction.get().register(c) transaction.get().register(c)
c._p_changed=1 c._p_changed=1
delClassAttr__roles__ = () # Private security.declarePrivate('delClassAttr')
def delClassAttr(self, name): def delClassAttr(self, name):
c=self._zclass_ c=self._zclass_
delattr(c, name) delattr(c, name)
...@@ -559,12 +563,11 @@ class ZClass( Base ...@@ -559,12 +563,11 @@ class ZClass( Base
return (self.classDefinedPermissions()+ return (self.classDefinedPermissions()+
self.classInheritedPermissions()) self.classInheritedPermissions())
security.declarePublic('ziconImage')
def ziconImage(self, REQUEST, RESPONSE): def ziconImage(self, REQUEST, RESPONSE):
"Display a class icon" "Display a class icon"
return self._zclass_.ziconImage.index_html(REQUEST, RESPONSE) return self._zclass_.ziconImage.index_html(REQUEST, RESPONSE)
ziconImage__roles__=None
def tpValues(self): def tpValues(self):
return self.propertysheets.common, self.propertysheets.methods return self.propertysheets.common, self.propertysheets.methods
...@@ -619,6 +622,9 @@ class ZClass( Base ...@@ -619,6 +622,9 @@ class ZClass( Base
values.remove( value ) values.remove( value )
return values return values
InitializeClass(ZClass)
class ZClassSheets(OFS.PropertySheets.PropertySheets): class ZClassSheets(OFS.PropertySheets.PropertySheets):
"Manage a collection of property sheets that provide ZClass management" "Manage a collection of property sheets that provide ZClass management"
......
lib/python/ZClasses/ZClassOwner.py
View file @ 41049f78
...@@ -13,6 +13,7 @@ ...@@ -13,6 +13,7 @@
"""Zope Classes """Zope Classes
""" """
import ExtensionClass, Globals, ZClass, Products import ExtensionClass, Globals, ZClass, Products
from Globals import InitializeClass
def manage_subclassableClassNames(self): def manage_subclassableClassNames(self):
r={} r={}
...@@ -43,5 +44,4 @@ class ZClassOwner(ExtensionClass.Base): ...@@ -43,5 +44,4 @@ class ZClassOwner(ExtensionClass.Base):
manage_subclassableClassNames=manage_subclassableClassNames manage_subclassableClassNames=manage_subclassableClassNames
InitializeClass(ZClassOwner)
Globals.default__class_init__(ZClassOwner)
lib/python/webdav/Collection.py
View file @ 41049f78
...@@ -17,7 +17,7 @@ $Id$ ...@@ -17,7 +17,7 @@ $Id$
from urllib import unquote from urllib import unquote
import Globals from Globals import InitializeClass
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from zExceptions import MethodNotAllowed, NotFound from zExceptions import MethodNotAllowed, NotFound
from zope.interface import implements from zope.interface import implements
...@@ -142,4 +142,4 @@ class Collection(Resource): ...@@ -142,4 +142,4 @@ class Collection(Resource):
return objectValues() return objectValues()
return [] return []
Globals.default__class_init__(Collection) InitializeClass(Collection)
lib/python/webdav/NullResource.py
View file @ 41049f78
...@@ -18,9 +18,14 @@ $Id$ ...@@ -18,9 +18,14 @@ $Id$
import sys import sys
import Acquisition, OFS.content_types import Acquisition, OFS.content_types
import Globals from Globals import InitializeClass
import OFS.SimpleItem import OFS.SimpleItem
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import view as View
from AccessControl.Permissions import add_folders
from AccessControl.Permissions import webdav_lock_items
from AccessControl.Permissions import webdav_unlock_items
from Globals import Persistent, DTMLFile from Globals import Persistent, DTMLFile
from OFS.CopySupport import CopyError from OFS.CopySupport import CopyError
from zExceptions import MethodNotAllowed from zExceptions import MethodNotAllowed
...@@ -43,11 +48,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource): ...@@ -43,11 +48,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource):
__implements__ = (WriteLockInterface,) __implements__ = (WriteLockInterface,)
__null_resource__=1 __null_resource__=1
__ac_permissions__=( security = ClassSecurityInfo()
('View', ('HEAD',)),
('Add Folders', ('MKCOL',)),
('WebDAV Lock items', ('LOCK',)),
)
def __init__(self, parent, name, request=None): def __init__(self, parent, name, request=None):
self.__name__=name self.__name__=name
...@@ -64,6 +65,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource): ...@@ -64,6 +65,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource):
raise Conflict, 'Collection ancestors must already exist.' raise Conflict, 'Collection ancestors must already exist.'
raise NotFound, 'The requested resource was not found.' raise NotFound, 'The requested resource was not found.'
security.declareProtected(View, 'HEAD')
def HEAD(self, REQUEST, RESPONSE): def HEAD(self, REQUEST, RESPONSE):
"""Retrieve resource information without a response message body.""" """Retrieve resource information without a response message body."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -89,7 +91,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource): ...@@ -89,7 +91,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource):
ob=File(name, '', body, content_type=typ) ob=File(name, '', body, content_type=typ)
return ob return ob
PUT__roles__ = ('Anonymous',) security.declarePublic('PUT')
def PUT(self, REQUEST, RESPONSE): def PUT(self, REQUEST, RESPONSE):
"""Create a new non-collection resource. """Create a new non-collection resource.
""" """
...@@ -166,6 +168,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource): ...@@ -166,6 +168,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource):
RESPONSE.setBody('') RESPONSE.setBody('')
return RESPONSE return RESPONSE
security.declareProtected(add_folders, 'MKCOL')
def MKCOL(self, REQUEST, RESPONSE): def MKCOL(self, REQUEST, RESPONSE):
"""Create a new collection resource.""" """Create a new collection resource."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -201,6 +204,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource): ...@@ -201,6 +204,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource):
RESPONSE.setBody('') RESPONSE.setBody('')
return RESPONSE return RESPONSE
security.declareProtected(webdav_lock_items, 'LOCK')
def LOCK(self, REQUEST, RESPONSE): def LOCK(self, REQUEST, RESPONSE):
""" LOCK on a Null Resource makes a LockNullResource instance """ """ LOCK on a Null Resource makes a LockNullResource instance """
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -252,8 +256,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource): ...@@ -252,8 +256,7 @@ class NullResource(Persistent, Acquisition.Implicit, Resource):
RESPONSE.setHeader('Lock-Token', 'opaquelocktoken:' + token) RESPONSE.setHeader('Lock-Token', 'opaquelocktoken:' + token)
RESPONSE.setBody(lock.asXML()) RESPONSE.setBody(lock.asXML())
InitializeClass(NullResource)
Globals.default__class_init__(NullResource)
class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
...@@ -266,17 +269,14 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -266,17 +269,14 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
__locknull_resource__ = 1 __locknull_resource__ = 1
meta_type = 'WebDAV LockNull Resource' meta_type = 'WebDAV LockNull Resource'
__ac_permissions__ = ( security = ClassSecurityInfo()
('WebDAV Unlock items', ('UNLOCK',)),
('View', ('manage_main',
'manage_workspace', 'manage')),
('Add Folders', ('MKCOL',)),
('WebDAV Lock items', ('LOCK',)),
)
manage_options = ({'label': 'Info', 'action': 'manage_main'},) manage_options = ({'label': 'Info', 'action': 'manage_main'},)
security.declareProtected(View, 'manage')
security.declareProtected(View, 'manage_main')
manage = manage_main = DTMLFile('dtml/locknullmain', globals()) manage = manage_main = DTMLFile('dtml/locknullmain', globals())
security.declareProtected(View, 'manage_workspace')
manage_workspace = manage manage_workspace = manage
manage_main._setName('manage_main') # explicit manage_main._setName('manage_main') # explicit
...@@ -291,7 +291,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -291,7 +291,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
self.id = self.__name__ = name self.id = self.__name__ = name
self.title = "LockNull Resource '%s'" % name self.title = "LockNull Resource '%s'" % name
title_or_id__roles__=None security.declarePublic('title_or_id')
def title_or_id(self): def title_or_id(self):
return 'Foo' return 'Foo'
...@@ -299,6 +299,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -299,6 +299,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
"""Retrieve properties defined on the resource.""" """Retrieve properties defined on the resource."""
return Resource.PROPFIND(self, REQUEST, RESPONSE) return Resource.PROPFIND(self, REQUEST, RESPONSE)
security.declareProtected(webdav_lock_items, 'LOCK')
def LOCK(self, REQUEST, RESPONSE): def LOCK(self, REQUEST, RESPONSE):
""" A Lock command on a LockNull resource should only be a """ A Lock command on a LockNull resource should only be a
refresh request (one without a body) """ refresh request (one without a body) """
...@@ -336,6 +337,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -336,6 +337,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
return RESPONSE return RESPONSE
security.declareProtected(webdav_unlock_items, 'UNLOCK')
def UNLOCK(self, REQUEST, RESPONSE): def UNLOCK(self, REQUEST, RESPONSE):
""" Unlocking a Null Resource removes it from its parent """ """ Unlocking a Null Resource removes it from its parent """
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -362,7 +364,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -362,7 +364,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
RESPONSE.setStatus(204) RESPONSE.setStatus(204)
return RESPONSE return RESPONSE
PUT__roles__ = ('Anonymous',) security.declarePublic('PUT')
def PUT(self, REQUEST, RESPONSE): def PUT(self, REQUEST, RESPONSE):
""" Create a new non-collection resource, deleting the LockNull """ Create a new non-collection resource, deleting the LockNull
object from the container before putting the new object in. """ object from the container before putting the new object in. """
...@@ -437,6 +439,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -437,6 +439,7 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
RESPONSE.setBody('') RESPONSE.setBody('')
return RESPONSE return RESPONSE
security.declareProtected(add_folders, 'MKCOL')
def MKCOL(self, REQUEST, RESPONSE): def MKCOL(self, REQUEST, RESPONSE):
""" Create a new Collection (folder) resource. Since this is being """ Create a new Collection (folder) resource. Since this is being
done on a LockNull resource, this also involves removing the LockNull done on a LockNull resource, this also involves removing the LockNull
...@@ -484,4 +487,4 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__): ...@@ -484,4 +487,4 @@ class LockNullResource(NullResource, OFS.SimpleItem.Item_w__name__):
RESPONSE.setBody('') RESPONSE.setBody('')
return RESPONSE return RESPONSE
Globals.default__class_init__(LockNullResource) InitializeClass(LockNullResource)
lib/python/webdav/Resource.py
View file @ 41049f78
...@@ -20,8 +20,15 @@ import sys ...@@ -20,8 +20,15 @@ import sys
from urllib import unquote from urllib import unquote
import ExtensionClass import ExtensionClass
import Globals from Globals import InitializeClass
from AccessControl import getSecurityManager from AccessControl import getSecurityManager
from AccessControl import ClassSecurityInfo
from AccessControl.Permissions import delete_objects
from AccessControl.Permissions import manage_properties
from AccessControl.Permissions import view as View
from AccessControl.Permissions import webdav_lock_items
from AccessControl.Permissions import webdav_unlock_items
from AccessControl.Permissions import webdav_access
from Acquisition import aq_base from Acquisition import aq_base
from zExceptions import BadRequest, MethodNotAllowed from zExceptions import BadRequest, MethodNotAllowed
from zExceptions import Unauthorized, Forbidden from zExceptions import Unauthorized, Forbidden
...@@ -56,16 +63,8 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -56,16 +63,8 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
'MOVE', 'LOCK', 'UNLOCK', 'MOVE', 'LOCK', 'UNLOCK',
) )
__ac_permissions__=( security = ClassSecurityInfo()
('View', ('HEAD',)), security.setPermissionDefault(webdav_access, ('Authenticated', 'Manager'))
('WebDAV access', ('PROPFIND', 'manage_DAVget',
'listDAVObjects'),
('Authenticated', 'Manager')),
('Manage properties', ('PROPPATCH',)),
('Delete objects', ('DELETE',)),
('WebDAV Lock items', ('LOCK',)),
('WebDAV Unlock items', ('UNLOCK',)),
)
def dav__init(self, request, response): def dav__init(self, request, response):
# Init expected HTTP 1.1 / WebDAV headers which are not # Init expected HTTP 1.1 / WebDAV headers which are not
...@@ -158,6 +157,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -158,6 +157,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
# WebDAV class 1 support # WebDAV class 1 support
security.declareProtected(View, 'HEAD')
def HEAD(self, REQUEST, RESPONSE): def HEAD(self, REQUEST, RESPONSE):
"""Retrieve resource information without a response body.""" """Retrieve resource information without a response body."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -197,7 +197,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -197,7 +197,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
raise MethodNotAllowed, 'Method not supported for this resource.' raise MethodNotAllowed, 'Method not supported for this resource.'
OPTIONS__roles__=None security.declarePublic('OPTIONS')
def OPTIONS(self, REQUEST, RESPONSE): def OPTIONS(self, REQUEST, RESPONSE):
"""Retrieve communication options.""" """Retrieve communication options."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -207,7 +207,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -207,7 +207,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
RESPONSE.setStatus(200) RESPONSE.setStatus(200)
return RESPONSE return RESPONSE
TRACE__roles__=None security.declarePublic('TRACE')
def TRACE(self, REQUEST, RESPONSE): def TRACE(self, REQUEST, RESPONSE):
"""Return the HTTP message received back to the client as the """Return the HTTP message received back to the client as the
entity-body of a 200 (OK) response. This will often usually entity-body of a 200 (OK) response. This will often usually
...@@ -218,6 +218,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -218,6 +218,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
raise MethodNotAllowed, 'Method not supported for this resource.' raise MethodNotAllowed, 'Method not supported for this resource.'
security.declareProtected(delete_objects, 'DELETE')
def DELETE(self, REQUEST, RESPONSE): def DELETE(self, REQUEST, RESPONSE):
"""Delete a resource. For non-collection resources, DELETE may """Delete a resource. For non-collection resources, DELETE may
return either 200 or 204 (No Content) to indicate success.""" return either 200 or 204 (No Content) to indicate success."""
...@@ -256,6 +257,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -256,6 +257,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
return RESPONSE return RESPONSE
security.declareProtected(webdav_access, 'PROPFIND')
def PROPFIND(self, REQUEST, RESPONSE): def PROPFIND(self, REQUEST, RESPONSE):
"""Retrieve properties defined on the resource.""" """Retrieve properties defined on the resource."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -273,6 +275,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -273,6 +275,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
RESPONSE.setBody(result) RESPONSE.setBody(result)
return RESPONSE return RESPONSE
security.declareProtected(manage_properties, 'PROPPATCH')
def PROPPATCH(self, REQUEST, RESPONSE): def PROPPATCH(self, REQUEST, RESPONSE):
"""Set and/or remove properties defined on the resource.""" """Set and/or remove properties defined on the resource."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -300,7 +303,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -300,7 +303,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
raise MethodNotAllowed, 'The resource already exists.' raise MethodNotAllowed, 'The resource already exists.'
COPY__roles__=('Anonymous',) security.declarePublic('COPY')
def COPY(self, REQUEST, RESPONSE): def COPY(self, REQUEST, RESPONSE):
"""Create a duplicate of the source resource whose state """Create a duplicate of the source resource whose state
and behavior match that of the source resource as closely and behavior match that of the source resource as closely
...@@ -406,7 +409,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -406,7 +409,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
RESPONSE.setBody('') RESPONSE.setBody('')
return RESPONSE return RESPONSE
MOVE__roles__=('Anonymous',) security.declarePublic('MOVE')
def MOVE(self, REQUEST, RESPONSE): def MOVE(self, REQUEST, RESPONSE):
"""Move a resource to a new location. Though we may later try to """Move a resource to a new location. Though we may later try to
make a move appear seamless across namespaces (e.g. from Zope make a move appear seamless across namespaces (e.g. from Zope
...@@ -522,6 +525,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -522,6 +525,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
# WebDAV Class 2, Lock and Unlock # WebDAV Class 2, Lock and Unlock
security.declareProtected(webdav_lock_items, 'LOCK')
def LOCK(self, REQUEST, RESPONSE): def LOCK(self, REQUEST, RESPONSE):
"""Lock a resource""" """Lock a resource"""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -581,6 +585,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -581,6 +585,7 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
return RESPONSE return RESPONSE
security.declareProtected(webdav_unlock_items, 'UNLOCK')
def UNLOCK(self, REQUEST, RESPONSE): def UNLOCK(self, REQUEST, RESPONSE):
"""Remove an existing lock on a resource.""" """Remove an existing lock on a resource."""
self.dav__init(REQUEST, RESPONSE) self.dav__init(REQUEST, RESPONSE)
...@@ -601,12 +606,14 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem): ...@@ -601,12 +606,14 @@ class Resource(ExtensionClass.Base, Lockable.LockableItem):
return RESPONSE return RESPONSE
security.declareProtected(webdav_access, 'manage_DAVget')
def manage_DAVget(self): def manage_DAVget(self):
"""Gets the document source""" """Gets the document source"""
# The default implementation calls manage_FTPget # The default implementation calls manage_FTPget
return self.manage_FTPget() return self.manage_FTPget()
security.declareProtected(webdav_access, 'listDAVObjects')
def listDAVObjects(self): def listDAVObjects(self):
return [] return []
Globals.default__class_init__(Resource) InitializeClass(Resource)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7