Roché Compaan wrote at 2005-2-25 17:22 +0200:
>Last year in March the following checkin was made that changed
>ZCatalog's getObject to use restrictedTraverse instead of
>unrestrictedTraverse. See:
>
>http://mail.zope.org/pipermail/zope-checkins/2004-March/026846.html
>
>In my opininion this is wrong,
I agree with you!
> ...
>I would propose that getObject does an unrestrictedTraverse of the path
>and then checks if the user has permission to access that the object.
I argued precisely this approach with the person who made the
change. I had the impression that I have convinced him -- but
apparently, he did not change the code accordingly :-(
Maybe, a bug report to the collector will help?
<http://www.zope.org/Collectors/Zope>
--
Dieter
_______________________________________________
Zope-Dev maillist - Zope-Dev@zope.org
http://mail.zope.org/mailman/listinfo/zope-dev
** No cross posts or HTML encoding! **
(Related lists -
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )
