Skip to content

Commit

Permalink
Fixing permission handling by using hashed names instead of columns a…
Browse files Browse the repository at this point in the history
…nd rows
  • Loading branch information
gogobd committed May 10, 2016
1 parent faa17bb commit 397f868
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 5 deletions.
2 changes: 1 addition & 1 deletion src/OFS/dtml/access.dtml
Expand Up @@ -81,7 +81,7 @@ a permission in addition to selecting to acquire permissions.

<dtml-unless isTopLevelPrincipiaApplicationObject>
<td align="left" valign="top">
<input type="checkbox" name="a&dtml-sequence-index;" &dtml-acquire; />
<input type="checkbox" name="acquire_&dtml-hashed_name;" &dtml-acquire; />
</td>
</dtml-unless>
<td align="left" nowrap>
Expand Down
13 changes: 9 additions & 4 deletions src/OFS/role.py
Expand Up @@ -25,6 +25,7 @@
from AccessControl.Permission import Permission
from AccessControl.Permissions import change_permissions
from AccessControl.requestmethod import requestmethod
from AccessControl.rolemanager import _string_hash


class RoleManager(BaseRoleManager):
Expand Down Expand Up @@ -104,14 +105,18 @@ def manage_changePermissions(self, REQUEST):
permissions=self.ac_inherited_permissions(1)
fails = []
for ip in range(len(permissions)):
permission_name = permissions[ip][0]
permission_hash = _string_hash(permission_name)
roles = []
for ir in indexes:
if have("p%dr%d" % (ip, ir)):
roles.append(valid_roles[ir])
for role in valid_roles:
role_name = role
role_hash = _string_hash(role_name)
if have("permission_%srole_%s" % (permission_hash, role_hash)):
roles.append(role)
name, value = permissions[ip][:2]
try:
p = Permission(name, value, self)
if not have('a%d' % ip):
if not have('acquire_%s' % permission_hash):
roles=tuple(roles)
p.setRoles(roles)
except:
Expand Down

0 comments on commit 397f868

Please sign in to comment.