Applied changes from Hotfix_2001_02_23.

lib/python/OFS/ObjectManager.py

@@ -84,9 +84,9 @@
 ##############################################################################
 __doc__="""Object Manager
 
-$Id: ObjectManager.py,v 1.126 2001/02/13 20:26:09 brian Exp $"""
+$Id: ObjectManager.py,v 1.127 2001/02/28 19:31:56 shane Exp $"""
 
-__version__='$Revision: 1.126 $'[11:-2]
+__version__='$Revision: 1.127 $'[11:-2]
 
 import App.Management, Acquisition, Globals, CopySupport, Products
 import os, App.FactoryDispatcher, ts_regex, Products
@@ -384,7 +384,7 @@ class ObjectManager(
 
     def objectMap(self):
         # Return a tuple of mappings containing subobject meta-data
-        return self._objects
+        return map(lambda dict: dict.copy(), self._objects)
 
     def objectIds_d(self,t=None):
         if hasattr(self, '_reserved_names'): n=self._reserved_names
@@ -413,7 +413,7 @@ class ObjectManager(
         r=[]
         a=r.append
         for d in self._objects:
-            if d['id'] not in n: a(d)
+            if d['id'] not in n: a(d.copy())
         return r
 
     def superValues(self,t):

lib/python/OFS/PropertyManager.py

@@ -84,7 +84,7 @@
 ##############################################################################
 
 """Property management"""
-__version__='$Revision: 1.35 $'[11:-2]
+__version__='$Revision: 1.36 $'[11:-2]
 
 import ExtensionClass, Globals
 import ZDOM
@@ -288,10 +288,17 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
         """Return a list of (id,property) tuples """
         return map(lambda i,s=self: (i['id'],getattr(s,i['id'])), 
                                     self._properties)
-    def propertyMap(self):
+    def _propertyMap(self):
         """Return a tuple of mappings, giving meta-data for properties """
         return self._properties
 
+    def propertyMap(self):
+        """
+        Return a tuple of mappings, giving meta-data for properties.
+        Return copies of the real definitions for security.
+        """
+        return map(lambda dict: dict.copy(), self._propertyMap())
+
     def propertyLabel(self, id):
         """Return a label for the given property id
         """
@@ -322,7 +329,7 @@ class PropertyManager(ExtensionClass.Base, ZDOM.ElementWithAttributes):
         get turned off will be ignored.  Use manage_changeProperties()
         instead for most situations.
         """
-        for prop in self.propertyMap():
+        for prop in self._propertyMap():
             name=prop['id']
             if 'w' in prop.get('mode', 'wd'):
                 value=REQUEST.get(name, '')

lib/python/OFS/PropertySheets.py

@@ -84,7 +84,7 @@
 ##############################################################################
 
 """Property sheets"""
-__version__='$Revision: 1.65 $'[11:-2]
+__version__='$Revision: 1.66 $'[11:-2]
 
 import time, string, App.Management, Globals
 from webdav.WriteLockInterface import WriteLockInterface
@@ -213,7 +213,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
 
     def hasProperty(self, id):
         # Return a true value if a property exists with the given id.
-        for prop in self.propertyMap():
+        for prop in self._propertyMap():
             if id==prop['id']:
                 return 1
         return 0
@@ -312,36 +312,37 @@ class PropertySheet(Traversable, Persistent, Implicit):
 
     def propertyIds(self):
         # Return a list of property ids.
-        return map(lambda i: i['id'], self.propertyMap())
+        return map(lambda i: i['id'], self._propertyMap())
 
     def propertyValues(self):
         # Return a list of property values.
         return map(lambda i, s=self: s.getProperty(i['id']),
-                   self.propertyMap())
+                   self._propertyMap())
 
     def propertyItems(self):
         # Return a list of (id, property) tuples.
         return map(lambda i, s=self: (i['id'], s.getProperty(i['id'])), 
-                   self.propertyMap())
+                   self._propertyMap())
 
     def propertyInfo(self, id):
         # Return a mapping containing property meta-data
-        for p in self.propertyMap():
+        for p in self._propertyMap():
             if p['id']==id: return p
         raise ValueError, 'The property %s does not exist.' % id
 
-    def propertyMap(self):
+    def _propertyMap(self):
         # Return a tuple of mappings, giving meta-data for properties.
         # Some ZClass instances dont seem to have an _properties, so
         # we have to fake it...
         return self.p_self()._properties
 
-
-
+    def propertyMap(self):
+        # Returns a secure copy of the property definitions.
+        return map(lambda dict: dict.copy(), self._propertyMap())
 
     def _propdict(self):
         dict={}
-        for p in self.propertyMap():
+        for p in self._propertyMap():
             dict[p['id']]=p
         return dict
 
@@ -360,7 +361,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
         # DAV helper method - return one or more propstat elements
         # indicating property names and values for all properties.
         result=[]
-        for item in self.propertyMap():
+        for item in self._propertyMap():
             name, type=item['id'], item.get('type','string')
             value=self.getProperty(name)
             if type=='tokens':
@@ -453,7 +454,7 @@ class PropertySheet(Traversable, Persistent, Implicit):
 
     def manage_editProperties(self, REQUEST):
         """Edit object properties via the web."""
-        for prop in self.propertyMap():
+        for prop in self._propertyMap():
             name=prop['id']
             if 'w' in prop.get('mode', 'wd'):
                 value=REQUEST.get(name, '')
@@ -551,9 +552,12 @@ class DAVProperties(Virtual, PropertySheet, View):
     def _delProperty(self, id):
         raise ValueError, '%s cannot be deleted.' % id
 
-    def propertyMap(self):
+    def _propertyMap(self):
         return self.pm
     
+    def propertyMap(self):
+        return map(lambda dict: dict.copy(), self._propertyMap())
+    
     def dav__creationdate(self):
         return iso8601_date(43200.0)
 
@@ -759,20 +763,20 @@ class FixedSchema(PropertySheet):
         FixedSchema.inheritedAttribute('__init__')(self, id, md)
         self._base=base
 
-    def propertyMap(self):
+    def _propertyMap(self):
         # Return a tuple of mappings, giving meta-data for properties.
-        r=[]
-        for d in self._base.propertyMap():
-            mode=d.get('mode', 'wd')
+        r = []
+        for d in self._base._propertyMap():
+            d = d.copy()
+            mode = d.get('mode', 'wd')
             if 'd' in mode:
-                dd={}
-                dd.update(d)
-                d=dd
                 d['mode']=filter(lambda c: c != 'd', mode)
             r.append(d)
             
         return tuple(r)
 
+    propertyMap = _propertyMap
+
     def property_extensible_schema__(self):
         return 0
         return self._base._extensible

lib/python/ZClasses/ZClass.py

@@ -407,6 +407,7 @@ class ZClass( Base
 
         return '*'+id
 
+    changeClassId__roles__ = ()  # Private
     def changeClassId(self, newid=None):
         if not dbVersionEquals('3'):
             return
@@ -572,6 +573,7 @@ class ZClass( Base
         r.sort()
         return r
 
+    getClassAttr__roles__ = ()  # Private
     def getClassAttr(self, name, default=_marker, inherit=0):
         if default is _marker:
             if inherit: return getattr(self._zclass_, name)
@@ -581,6 +583,7 @@ class ZClass( Base
             else: return self._zclass_.__dict__[name]
         except: return default
 
+    setClassAttr__roles__ = ()  # Private
     def setClassAttr(self, name, value):
         c=self._zclass_
         setattr(c, name, value)
@@ -588,6 +591,7 @@ class ZClass( Base
             get_transaction().register(c)
             c._p_changed=1
 
+    delClassAttr__roles__ = ()  # Private
     def delClassAttr(self, name):
         c=self._zclass_
         delattr(c, name)