• Jérome Perrin's avatar
    Support properties' read permission in the GUI and in getProperty · 6c2435cf
    Jérome Perrin authored
    Because unlike `getFoo()`,  `getProperty('foo')` does not checks the permission defined on the accessor, when a form contain a `my_foo` field, the property would be displayed to the user who can view the form, even if the user does not actually have the permission to get this property. This because getter for default value of fields uses getProperty ( [here](https://lab.nexedi.com/nexedi/erp5/blob/58d4ab8efef748f522b3eaaecba3dc1133c99e72/product/ERP5Form/Form.py#L275) ).
    
    These changes modify behavior of `getProperty`, so that it enforces read permission security of properties and raise when user does not have permission to access properties.
    
    Some notes about implementation:
     * `getProperty` now becomes a bit slower, but it was incorrect before, so I guess it's inevitable.
     * some efforts have been made to keep the impact on performance minimal. This uses the same approach of  in `edit` of computing the set of restricted properties and using `guarded_getattr` only on these properties and using `getattr` on non-restricted properties. The computation of this set was moved  to dynamic class generation time and as a result, `edit` becomes a bit faster.
     * the `expectedFailure` part of `test_PropertySheetSecurityOnAccessors` was moved to another test, but I'm not even sure we want to support this (read-protecting properties with default write permission) as, to me, such configuration does not make much sense. 
     * new performance tests were added. I don't know what to use as min/max values so I just used something that should pass.
     * implementation for `getProperty('*_list')` was changed a lot, I have no idea why this was getting the method on the class and passing self as first argument. Now it we just get method on the instance, like we do for single properties.
    
    /reviewed-on !181
    6c2435cf
Name
Last commit
Last update
..
Constraint Loading commit data...
Document Loading commit data...
Extensions Loading commit data...
Interactor Loading commit data...
PropertySheet Loading commit data...
Tool Loading commit data...
dtml Loading commit data...
scripts Loading commit data...
tests Loading commit data...
www Loading commit data...
AudioField.py Loading commit data...
CaptchaField.py Loading commit data...
CaptchasDotNet.py Loading commit data...
CreatePropertySheet.py Loading commit data...
DurationField.py Loading commit data...
EditorField.py Loading commit data...
FSForm.py Loading commit data...
Form.py Loading commit data...
FormBox.py Loading commit data...
GadgetField.py Loading commit data...
HoneypotField.py Loading commit data...
HyperLinkField.py Loading commit data...
ImageField.py Loading commit data...
InputButtonField.py Loading commit data...
ListBox.py Loading commit data...
MAINTAINERS.txt Loading commit data...
MatrixBox.py Loading commit data...
MultiLinkField.py Loading commit data...
MultiRelationField.py Loading commit data...
OOoChart.py Loading commit data...
PDFForm.py Loading commit data...
PDFParser.py Loading commit data...
PDFTemplate.py Loading commit data...
POSBox.py Loading commit data...
ParallelListField.py Loading commit data...
Permissions.py Loading commit data...
PlanningBox.py Loading commit data...
PreferenceTool.py Loading commit data...
ProxyField.py Loading commit data...
RelationField.py Loading commit data...
Report.py Loading commit data...
ReportBox.py Loading commit data...
ScribusParser.py Loading commit data...
ScribusUtils.py Loading commit data...
Selection.py Loading commit data...
TODO.txt Loading commit data...
UI.stx Loading commit data...
VERSION.txt Loading commit data...
VideoField.py Loading commit data...
ZGDChart.py Loading commit data...
ZPyChart.py Loading commit data...
__init__.py Loading commit data...
refresh.txt Loading commit data...
tool.png Loading commit data...