Skip to main content

Workarounds related to Zope's security subsystem.

Project description

This package allows to work around weaknesses in the web application server Zope’s security subsystem. Currently, it contains a single module proxy.

proxy

In principle, Zope makes a clear distinction between trusted code (which comes from the file system and cannot be modified through-the-web) and untrusted code (which might be tangled with through-the-web). Trusted code is unrestricted by Zope’s security subsystem, untrusted code has permission checks on each object and method access.

Unfortunately, occasionnally, trusted code performs its own security checks – and can raise Unauthorized exceptions even when called from other trusted code. The proxy module is destined to work around this behaviour. It uses Zope’s so called proxy roles to set up roles which should be used for internal security checks.

The module defines the context manager proxy_roles(*roles), typically used as follows:

>>> with proxy_roles(role1, role2, ...):
>>>   ... perform any operation[s] with internal security checks ...

This sets up proxy roles role1, role2, … to be used for the internal security checks.

Usually, the roles are 'Manager', 'Authenticated' but can be anything. Note that proxy roles override any currently active user roles.

History

2.0

Make Python 3/Zope 4 compatible; drop support for Python 2.6 (and below)

New “context manager” interface.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for dm.zopepatches.security, version 2.0
Filename, size File type Python version Upload date Hashes
Filename, size dm.zopepatches.security-2.0.tar.gz (3.2 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page