Merge r110185 from 2.12 branch

src/Products/Five/browser/resource.py

@@ -162,6 +162,11 @@ class DirectoryResource(Resource,
         resource = factory(name, filename)(self.request)
         resource.__name__ = name
         resource.__parent__ = self
+        
+        # We need to propagate security so that restrictedTraverse() will
+        # work
+        resource.__roles__ = self.__roles__
+        
         return resource
 
 class DirectoryResourceFactory(ResourceFactory):

src/Products/Five/browser/tests/resource.txt

@@ -69,7 +69,6 @@ PageTemplateResource's __call__ renders the template
   ...     if not isinstance(resource, PageTemplateResource):
   ...         self.assertEquals(resource(), base_url % r)
 
-
 Security
 --------
 
@@ -108,6 +107,14 @@ We can now view them all:
   ...     path = base % resource
   ...     checkRestricted(self.folder, 'context.restrictedTraverse("%s")' % path)
 
+Let's make sure restrictedTraverse() works directly, too. It used to get
+tripped up on subdirectories due to missing security declarations.
+
+  >>> self.folder.restrictedTraverse('++resource++fivetest_resources/resource.txt') is not None
+  True
+  
+  >>> self.folder.restrictedTraverse('++resource++fivetest_resources/resource_subdir/resource.txt') is not None
+  True
 
 Clean up
 --------