when attempting to get a list of users, use the __allow_groups__ alias.
This doesn't break anything as it is one of the (unwritten) contracts
of a user folder to install itself as __allow_groups__ in its container
(it is canonized in the manage_beforeDelete and manage_afterAdd methods
of BasicUserFolder, and the traversal machinery refers to a user folder
by its __allow_groups__ alias exclusively).

It's actually likely that all code in Zope's security machinery that directly
refers to a user folder by its 'acl_users' alias in this way is wrong.

Referring to the user folder by its __allow_groups__ alias in the security
machinery exclusively gives us the ability to insert a "proxy" object as
can act as an intermediary for a "real" UserFolder object, allowing us to
massage the output from its interface methods as necessary to allow for
grouping and other tricks.

Some indexes were storing acquisition wrappers in the cyclic references
back to the ZCatalog instance.  Removed the acquisition wrappers and
cleaned up a bad use of apply().  The acquisition wrappers were revealed
by AdaptableStorage.

There's a second problem, in that indexes are unknowingly storing references
back to the ZCatalog in an unused attribute.  In the 2_6 branch it's
hard to fix without breaking things, but on the HEAD there's a better way
to fix this.  Coming soon, I hope.

run from Daemon.

of a catalog metadata was identical with the name of an acquired
object.
~

#740: _tzoffset handled positive numerical offsets incorrectly. This has been fixed. A large set of tests for different cases has been added, and for the purpose of those tests DateTime has a new feature: A tzoffset() method.

- add at least something of a test for the datatype

Merge with HEAD: Collector #763: There was no error when you had a sendmail-tag without specifying a mailhost or smpthost. Also added a missing import.

result in an Unauthorized error rather than AttributeError.  Added a test
to ensure the bug stays fixed.

Also, set the FullOpenCloseTest's level to 2 so
testCloseWithCheckpointingThread() isn't normally run, even if you
have BerkeleyDB installed.  This is the single longest test in the
--all suite.  This shaves about 21 seconds off the tests.

Also, set the suite's test level to 2 so these aren't normally run
(even if you have BerkeleyDB installed).  These tests take a long
time.

  contained 'None', which lead to 'None' as connection hook.

no other handlers are provided.  This is needed to avoid warnings on stderr
from the logging package.

Needs more work, but can deal with at least logging to files and STDERR.
Log rotation has been tested.

- add a way to control how logging is re-initialized

- Cache the translations from severity to level and string in dicts,
  so these are normally done with a single dict.get() call rather than
  a Python function call.

- Extract the PEP 282 level first, and check it against the effective
  level of the logger, so we can take an early exit if the logger
  won't handle the event.

- Got rid of textwrap.  It slows things down, can frustrate grepping
  programs, and wasn't effective unless you were using Python 2.3
  anyway.

- Got rid of the addHandler(NullHandler()) (seems like superstition).

- Got rid of the log_format class variable (YAGNI).

trunk.

       why security assertions should be placed

       PASSWORD() function add to lib/python/AccessControl/AuthEncoding.py.

using list comprehensions (20-30% speedup under Python 2.2).

available or not, and also fixes to all the tests so they won't crap
out or complain if not.

To test whether these storages are avialable (including all package
dependencies), do:

import BDBStorage
if BDBStorage.is_available:
    # okay to use

Also, in BDBStorage/__init__.py do some cross-platform compatibility
for the bsddb module; in Python 2.3 we can just use the built-in
module, but in earlier Pythons we have to use bsddb3.  Now you can
just use "from BDBStorage import db" to get the proper db object.

Ensured that all HTTP headers are sent as normal strings and not Unicode.

Removed most <dtml-var> to replace them with &dtml-foo;.
This corrects a number of potential XSS holes, and simplifies
auditability of the remaining legitimate <dtml-var>.

version:

- If the setlocale() call fails, don't fail the test -- just skip it
  silently.  XXX This is not ideal, but what else can we do?  Locale
  names are not standardized; the test fails on Mac OSX, and
  apparently on older Linux versions (e.g. my Mandrake 8.1).

- Don't use non-ASCII literals; use \xXX escapes.