Commit 068b405f authored by Jérome Perrin's avatar Jérome Perrin Committed by Kazuhiko Shiozaki

PreferenceTool: fix missing security on getPreference

parent 3ed82eef
......@@ -651,6 +651,7 @@ class TestPreferences(PropertySheetTestCase):
preference_tool.manage_permission(read_permission, [], 0)
obj.manage_permission(read_permission, [], 0)
self.assertFalse(guarded_hasattr(preference_tool, 'getPreferredToto'))
self.assertEqual(preference_tool.getPreference('toto'), None)
preference_tool.manage_permission(read_permission, ['Manager'], 1)
......
......@@ -30,6 +30,7 @@
from AccessControl import ClassSecurityInfo
from AccessControl.SecurityManagement import getSecurityManager,\
setSecurityManager, newSecurityManager
from AccessControl.ZopeGuards import guarded_getattr
from MethodObject import Method
from Products.ERP5Type.Globals import InitializeClass, DTMLFile
from zLOG import LOG, PROBLEM
......@@ -128,8 +129,8 @@ class PreferenceTool(BaseTool):
security.declarePublic('getPreference')
def getPreference(self, pref_name, default=_marker) :
""" get the preference on the most appopriate Preference object. """
method = getattr(self, 'get%s' % convertToUpperCase(pref_name), None)
""" get the preference on the most appropriate Preference object. """
method = guarded_getattr(self, 'get%s' % convertToUpperCase(pref_name), None)
if method is not None:
return method(default)
if default is _marker:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment