diff --git a/product/ERP5Type/UnrestrictedMethod.py b/product/ERP5Type/UnrestrictedMethod.py index 5a257786dc9b5d7e779d23d06f0a56710e8918a2..dd4932163987750326529b69c8fecdb4f5ea9b59 100644 --- a/product/ERP5Type/UnrestrictedMethod.py +++ b/product/ERP5Type/UnrestrictedMethod.py @@ -26,6 +26,7 @@ # ############################################################################## +from contextlib import contextmanager from AccessControl.User import UnrestrictedUser from AccessControl.SpecialUsers import system from AccessControl.SecurityManagement import getSecurityManager, \ @@ -69,6 +70,17 @@ def UnrestrictedMethod(function): def unrestricted_apply(function, args=(), kw={}): # XXX-JPS: naming """Function to bypass all security checks + This function is as dangerous as 'UnrestrictedMethod' decorator. Read its + docstring for more information. Never use this, until you are 100% certain + that you have no other way. + """ + with unrestricted_contextmanager(): + return apply(function, args, kw) + +@contextmanager +def unrestricted_contextmanager(): + """Function to bypass all security checks + This function is as dangerous as 'UnrestrictedMethod' decorator. Read its docstring for more information. Never use this, until you are 100% certain that you have no other way. @@ -99,7 +111,7 @@ def unrestricted_apply(function, args=(), kw={}): # XXX-JPS: naming role_list, user.getDomains()).__of__(uf) newSecurityManager(None, super_user) try: - return apply(function, args, kw) + yield finally: # Make sure that the original user is back. setSecurityManager(security_manager)