Re: Problem and fix: filteredTreeNodes doesn't respect hasAccess()

Ooops, messed up the second patch. One more change is necessary:

--- _accessmanager.py.ORIG  2008-06-25 15:05:48.000000000 +0200
+++ _accessmanager.py	2008-06-25 16:06:25.000000000 +0200
@@ -176,9 +176,9 @@
         if access:
           ob_access = self.getObjProperty('manage_access',REQUEST)
           access = access and ((not type(ob_access) is dict) or (ob_access.get( 'edit') is None) or (len( self.intersection_list( self.concat_list( ob_access.get( 'edit'), [ 'Manager']), self.getUserRoles(auth_user))) > 0))
-        access = access and auth_user.has_permission( 'ZMS Author', self) in [ 1, True]
+        access = access and auth_user and auth_user.has_permission( 'ZMS Author', self) in [ 1, True]
       else:
-        access = access and auth_user.has_permission( 'View', self) in [ 1, True]
+        access = access and auth_user and auth_user.has_permission( 'View', self) in [ 1, True]
         if not access:
           access = access or self.hasPublicAccess() 
       return access


* Gregor Hoffleit <[email protected]> [080625 16:01]:
> Another thing:
> 
> With this fix applied, I got errors from hasAccess ("NoneType has no
> attribute has_permission"). hasAccess() was not prepared for the case
> that AUTHENTICATED_USER was not set (anonymous visitors). I patched away
> my problem this way:
> 
> --- _accessmanager.py.ORIG  2008-06-25 15:05:48.000000000 +0200
> +++ _accessmanager.py	2008-06-25 15:51:59.000000000 +0200
> @@ -178,7 +178,7 @@
>            access = access and ((not type(ob_access) is dict) or (ob_access.get( 'edit') is None) or (len( self.intersection_list( self.concat_list( ob_access.get( 'edit'), [ 'Manager']), self.getUserRoles(auth_user))) > 0))
>          access = access and auth_user.has_permission( 'ZMS Author', self) in [ 1, True]
>        else:
> -        access = access and auth_user.has_permission( 'View', self) in [ 1, True]
> +        access = access and auth_user and auth_user.has_permission( 'View', self) in [ 1, True]
>          if not access:
>            access = access or self.hasPublicAccess() 
>        return access