In article <[EMAIL PROTECTED]>, Florent Guillaume <[EMAIL PROTECTED]> wrote:
> In ZCatalog's brains, getObject currently does a restrictedTraverse to > get the object. That's a problem for unrestricted code that needs to get > to the object nevertheless, even if the user cannot get to it. > > For instance CMF is impacted, when it tries to reindex the security of > all subobjects of a given object. > > Unless someone is opposed to it, I'll add a _getObject method that does > an unrestrictedTraverse, and make CMF use it if available. > > Florent getObject must be restricted since it can be called by untrusted code. It has been argued that it is currently too restrictive, and it should only validate the leaf object, but nothing has been done about this AFAIK. You can work around this issue by using:: unrestrictedTraverse(brain.getPath()) A (restricted) convenience method to do this could be added, but it doesn't really seem worth the effort IMO. -Casey _______________________________________________ Zope-Dev maillist - [EMAIL PROTECTED] http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
