针对Zope3的对象策略

导航

验证详情

这些详情已由PyPI验证
所有者
组织图标 Zope Foundation
维护者
来自gravatar.com的agroszer的头像 agroszer

未验证详情

这些详情尚未由PyPI验证
项目链接
元数据
分类器

项目描述

objectpolicy包使得可以基于对象覆盖zope.securitypolicy.zopepolicy的默认策略。

objectpolicy包使得可以基于对象覆盖zope.securitypolicy.zopepolicy的默认策略。

默认情况下，所有对象都使用zopepolicy。想要有自己的策略的对象应该有一个标记接口IObjectPolicyMarker，并且有一个适配器到IObjectPolicy。

层级

支持两个层级。

  • 低级是SecurityMap.getCell层级。这里存储了由主体或角色存储的权限。这也适用于ZopePolicy作为安全策略。使用允许、拒绝、未设置值。权限（与ZopePolicy一起）下传到子对象或视图。参见

    • IObjectPolicy.getPrincipalPermission

    • IObjectPolicy.getRolePermission

    • lowlevel.txt

    安装：将z3c.objectpolicy-configure.zcml放入实例/etc文件夹中。

  • 高级别是ISecurityPolicy.checkPermission级别。在这里，权限通常通过它的角色、组和对象父子关系来为主体进行总结。ZopePolicy必须由ObjectsPolicy安全策略覆盖。权限不会传递到子对象或视图。使用True – 访问，False – 无访问值。参见

    • IObjectPolicy.checkPermission

    • highlevel.txt

    安装：在实例/etc/securitypolicy.zcml中覆盖ZopePolicy

基本设置（用于高级测试）

一个好的但不完美的例子是用户需要能够修改自己的属性问题。

>>> from zope import interface, component
>>> from zope.annotation.interfaces import IAttributeAnnotatable
>>> from zope.container.interfaces import IContained
>>> from zope.container.contained import Contained
>>> from z3c.objectpolicy.interfaces import IObjectPolicy
>>> from z3c.objectpolicy.interfaces import IObjectPolicyMarker
>>> class IPerson(interface.Interface):
...     """a person interface for a person class"""
...
>>> class Person(Contained):
...     interface.implements(
...         IObjectPolicyMarker,
...         IAttributeAnnotatable,
...         IPerson)
...     def __init__(self, id, name):
...         self.id = id
...         self.name = name
...         self.groups = []
...
>>> class otherKlass(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable)
...     def __init__(self, id):
...         self.id = id

如果当前主体 == Person，则这些权限将被允许在Person对象上为主体

>>> ALLOW_FOR_SELF = ["zope.View",
...                   "zope.app.dublincore.view",
...                   "zope.ManageContent"]

计数器以查看适配器触发多少次

>>> TRIP_WIRE = 0

这是一个自定义策略适配器，它确定权限。注意，这和低级示例有一点不同！

>>> from z3c.objectpolicy.objectpolicy import DefaultObjectPolicyAdapter
>>> class PersonPolicy(DefaultObjectPolicyAdapter):
...     component.adapts(IPerson)
...     interface.implements(IObjectPolicy)
...
...     def __init__(self, context):
...         #context is a Person
...         self.context = context
...
...     def checkPermission(self, manager, permissionid):
...         #print permissionid, str(self.context)
...         return self.checkPermissionForParticipation(manager, permissionid)
...
...     def checkPermissionForParticipant(self, manager, principal, permissionid):
...         global TRIP_WIRE
...         TRIP_WIRE += 1
...         if principal.id == self.context.id:
...             #we have the same Person in the participation
...             if permissionid in ALLOW_FOR_SELF:
...                 #we have the Person and the Permission
...                 return True
...
...         #no Person or Permission found
...         #return the Z3 default permissions
...         return super(PersonPolicy, self).checkPermissionForParticipant(
...             manager, principal, permissionid)
...
>>> component.provideAdapter(PersonPolicy)

安装ObjectPolicy，进行测试配置。

>>> from z3c.objectpolicy.objectpolicy import ObjectPrincipalPermissionManager
>>> from z3c.objectpolicy.objectpolicy import ObjectRolePermissionManager
>>> from z3c.objectpolicy.objectpolicy import ObjectPolicy

>>> component.provideAdapter(ObjectPrincipalPermissionManager)
>>> component.provideAdapter(ObjectRolePermissionManager)

>>> bela = Person('b-id', 'bela')
>>> joe = Person('j-id', 'joe')

>>> class Participation:
...     interaction = None
>>> participation = Participation()
>>> participation.principal = joe
>>> import zope.security.management
>>> oldPolicy = zope.security.management.setSecurityPolicy(ObjectPolicy)
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

让我们看看一个简单的权限检查

joe在没有授予任何权限的情况下，对joe有ManageContent访问权

>>> interaction.checkPermission('zope.ManageContent', joe)
True
>>> TRIP_WIRE
1

joe没有对joe的SomePermission访问权，因为那没有在ALLOW_FOR_SELF中列出

>>> interaction.checkPermission('myapp.SomePermission', joe)
False
>>> TRIP_WIRE
2

joe没有对的有访问权

>>> interaction.checkPermission('zope.ManageContent', bela)
False
>>> TRIP_WIRE
3

>>> from zope.securitypolicy.interfaces import IPrincipalPermissionManager
>>> prinperBela = IPrincipalPermissionManager(bela)
>>> prinperJoe = IPrincipalPermissionManager(joe)
>>> prinperBela.grantPermissionToPrincipal('zope.ManageContent', 'j-id')

当我们授予joe对bela的权限时，joe对bela有访问权

>>> interaction.checkPermission('zope.ManageContent', bela)
True
>>> TRIP_WIRE
4

授予权限对任何任意权限也有效

>>> prinperJoe.grantPermissionToPrincipal('myapp.SomePermission', 'j-id')
>>> interaction.checkPermission('myapp.SomePermission', joe)
True
>>> TRIP_WIRE
5

没有IObjectPolicyMarker的对象行为与以前相同。没有授予 – 无权限

>>> otherObject = otherKlass('o-id')
>>> prinperOther = IPrincipalPermissionManager(otherObject)
>>> interaction.checkPermission('zope.ManageContent', otherObject)
False
>>> TRIP_WIRE
5

>>> prinperOther.grantPermissionToPrincipal('zope.ManageContent', 'j-id')
>>> interaction.checkPermission('zope.ManageContent', otherObject)
True
>>> TRIP_WIRE
5

检查当有标记但没有适配器时的情况

>>> class otherKlassWOadapter(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable,
...         IObjectPolicyMarker)
...     def __init__(self, id):
...         self.id = id

>>> otherObjectWO = otherKlassWOadapter('oa-id')
>>> interaction.checkPermission('zope.ManageContent', otherObjectWO)
False

无权限，也许应该在日志中写入一些内容？

现在一个更复杂的父子设置

>>> from zope.container.sample import SampleContainer
>>> from zope.location.location import locate
>>> class IPersonContainer(interface.Interface):
...     """a person container interface"""
...
>>> class PersonContainer(SampleContainer):
...     interface.implements(
...         IAttributeAnnotatable,
...         IPersonContainer)
...     def __init__(self, id):
...         self.id = id
...         super(PersonContainer, self).__init__()
...
>>> class BrowserView(object):
...     interface.implements(
...         IContained)
...
布局是
users(PersonContainer)
jack(Person)

editJack(BrowserView)

jane(Person)

editJane(BrowserView)

>>> users = PersonContainer('users')
>>> jack = Person('jack-id','jack')
>>> users['jack'] = jack
>>> locate(jack, users, 'jack')
>>> jane = Person('jane-id','jane')
>>> users['jane'] = jane
>>> locate(jane, users, 'jane')

>>> editJack = BrowserView()
>>> locate(editJack, jack, None)
>>> editJane = BrowserView()
>>> locate(editJane, jane, None)

>>> prinperUsers = IPrincipalPermissionManager(users)
>>> prinperJack = IPrincipalPermissionManager(jack)
>>> prinperJane = IPrincipalPermissionManager(jane)

>>> participation = Participation()

正在执行操作的主体是jack

>>> participation.principal = jack
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

当我们不授予权限时，只有jack对其自身和其编辑视图有权限

>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
False
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予jane权限时，jack仍然保持不变。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jane-id')
>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
False
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予jack权限时，他将有权访问整个包。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jack-id')
>>> interaction.checkPermission('zope.ManageContent', users)
True
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
True
>>> interaction.checkPermission('zope.ManageContent', editJane)
True

清理

我们清理了这些示例中做的更改

>>> zope.security.management.endInteraction()
>>> ignore = zope.security.management.setSecurityPolicy(oldPolicy)

基本设置（用于低级测试）

一个好的但不完美的例子是用户需要能够修改自己的属性问题。

>>> from zope import interface, component
>>> from zope.annotation.interfaces import IAttributeAnnotatable
>>> from zope.container.interfaces import IContained
>>> from zope.container.contained import Contained
>>> from z3c.objectpolicy.interfaces import IObjectPolicy
>>> from z3c.objectpolicy.interfaces import IObjectPolicyMarker
>>> class IPerson(interface.Interface):
...     """a person interface for a person class"""
...
>>> class Person(Contained):
...     interface.implements(
...         IObjectPolicyMarker,
...         IAttributeAnnotatable,
...         IPerson)
...     def __init__(self, id, name):
...         self.id = id
...         self.name = name
...         self.groups = []
...
>>> class otherKlass(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable)
...     def __init__(self, id):
...         self.id = id

如果当前主体 == Person，则这些权限将被允许在Person对象上为主体

>>> ALLOW_FOR_SELF = ["zope.View",
...                   "zope.app.dublincore.view",
...                   "zope.ManageContent"]

计数器以查看适配器触发多少次

>>> TRIP_WIRE = 0

这是一个自定义策略适配器，它确定权限。

>>> from zope.securitypolicy.interfaces import Allow, Deny, Unset
>>> from z3c.objectpolicy.objectpolicy import DefaultObjectPolicyAdapter
>>> class PersonPolicy(DefaultObjectPolicyAdapter):
...     component.adapts(IPerson)
...     interface.implements(IObjectPolicy)
...
...     def __init__(self, context):
...         #context is a Person
...         self.context = context
...
...     def getPrincipalPermission(self, manager, permissionid, principalid, default):
...         global TRIP_WIRE
...         TRIP_WIRE += 1
...         if principalid == self.context.id:
...             #we have the same Person in the participation
...             if permissionid in ALLOW_FOR_SELF:
...                 #we have the Person and the Permission
...                 return Allow
...
...         #no Person or Permission found
...         #return the Z3 default permissions
...         return super(PersonPolicy, self).getPrincipalPermission(
...             manager, permissionid, principalid, default)
...
>>> component.provideAdapter(PersonPolicy)

安装ObjectPolicy，进行测试配置。

>>> from z3c.objectpolicy.objectpolicy import ObjectPrincipalPermissionManager
>>> from z3c.objectpolicy.objectpolicy import ObjectRolePermissionManager

>>> component.provideAdapter(ObjectPrincipalPermissionManager)
>>> component.provideAdapter(ObjectRolePermissionManager)

>>> bela = Person('b-id', 'bela')
>>> joe = Person('j-id', 'joe')

>>> class Participation:
...     interaction = None
>>> participation = Participation()
>>> participation.principal = joe
>>> import zope.security.management
>>> from zope.securitypolicy.zopepolicy import ZopeSecurityPolicy
>>> oldPolicy = zope.security.management.setSecurityPolicy(ZopeSecurityPolicy)
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

让我们看看一个简单的权限检查

joe在没有授予任何权限的情况下，对joe有ManageContent访问权

>>> interaction.checkPermission('zope.ManageContent', joe)
True
>>> TRIP_WIRE
1

joe没有对joe的SomePermission访问权，因为那没有在ALLOW_FOR_SELF中列出

>>> interaction.checkPermission('myapp.SomePermission', joe)
False
>>> TRIP_WIRE
2

joe没有对的有访问权

>>> interaction.checkPermission('zope.ManageContent', bela)
False
>>> TRIP_WIRE
3

>>> from zope.securitypolicy.interfaces import IPrincipalPermissionManager
>>> prinperBela = IPrincipalPermissionManager(bela)
>>> prinperJoe = IPrincipalPermissionManager(joe)
>>> prinperBela.grantPermissionToPrincipal('zope.ManageContent', 'j-id')

当我们授予joe对bela的权限时，joe对bela有访问权

>>> interaction.checkPermission('zope.ManageContent', bela)
True
>>> TRIP_WIRE
4

授予权限对任何任意权限也有效

>>> prinperJoe.grantPermissionToPrincipal('myapp.SomePermission', 'j-id')
>>> interaction.checkPermission('myapp.SomePermission', joe)
True
>>> TRIP_WIRE
5

没有IObjectPolicyMarker的对象行为与以前相同。没有授予 – 无权限

>>> otherObject = otherKlass('o-id')
>>> prinperOther = IPrincipalPermissionManager(otherObject)
>>> interaction.checkPermission('zope.ManageContent', otherObject)
False
>>> TRIP_WIRE
5

>>> prinperOther.grantPermissionToPrincipal('zope.ManageContent', 'j-id')
>>> interaction.checkPermission('zope.ManageContent', otherObject)
True
>>> TRIP_WIRE
5

检查当有标记但没有适配器时的情况

>>> class otherKlassWOadapter(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable,
...         IObjectPolicyMarker)
...     def __init__(self, id):
...         self.id = id

>>> otherObjectWO = otherKlassWOadapter('oa-id')
>>> interaction.checkPermission('zope.ManageContent', otherObjectWO)
False

无权限，也许应该在日志中写入一些内容？

现在一个更复杂的父子设置

>>> from zope.container.sample import SampleContainer
>>> from zope.location.location import locate
>>> class IPersonContainer(interface.Interface):
...     """a person container interface"""
...
>>> class PersonContainer(SampleContainer):
...     interface.implements(
...         IAttributeAnnotatable,
...         IPersonContainer)
...     def __init__(self, id):
...         self.id = id
...         super(PersonContainer, self).__init__()
...
>>> class BrowserView(object):
...     interface.implements(
...         IContained)
...
布局是
users(PersonContainer)
jack(Person)

editJack(BrowserView)

jane(Person)

editJane(BrowserView)

>>> users = PersonContainer('users')
>>> jack = Person('jack-id','jack')
>>> users['jack'] = jack
>>> locate(jack, users, 'jack')
>>> jane = Person('jane-id','jane')
>>> users['jane'] = jane
>>> locate(jane, users, 'jane')

>>> editJack = BrowserView()
>>> locate(editJack, jack, None)
>>> editJane = BrowserView()
>>> locate(editJane, jane, None)

>>> prinperUsers = IPrincipalPermissionManager(users)
>>> prinperJack = IPrincipalPermissionManager(jack)
>>> prinperJane = IPrincipalPermissionManager(jane)

>>> participation = Participation()

正在执行操作的主体是jack

>>> participation.principal = jack
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

当我们不授予权限时，只有jack对其自身和其编辑视图有权限

>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予jane权限时，jack仍然保持不变。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jane-id')
>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予jack权限时，他将有权访问整个包。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jack-id')
>>> interaction.checkPermission('zope.ManageContent', users)
True
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
True
>>> interaction.checkPermission('zope.ManageContent', editJane)
True

清理

我们清理了这些示例中做的更改

>>> zope.security.management.endInteraction()
>>> ignore = zope.security.management.setSecurityPolicy(oldPolicy)

CHANGES

0.1 (2010-08-10)

  • 初始发布。

项目详情

验证详情

这些详情已由PyPI验证
所有者
组织图标 Zope Foundation
维护者
来自gravatar.com的agroszer的头像 agroszer

未验证详情

这些详情尚未由PyPI验证
项目链接
元数据
分类器

发布历史 发布通知 | RSS源

这个版本

0.1

下载文件

下载适用于您的平台文件。如果您不确定选择哪个，请了解更多关于安装包的信息。

源分发

z3c.objectpolicy-0.1.tar.gz (16.2 kB 查看散列)

上传时间 源

支持者：

AWS AWS 云计算和安全赞助商 Datadog Datadog 监控 Fastly Fastly CDN Google Google 下载分析 Microsoft Microsoft PSF 赞助商 Pingdom Pingdom 监控 Sentry Sentry 错误日志 StatusPage StatusPage 状态页面