[ZCM] [ZC] 2333/ 4 Accept "Five.browser.metaconfigure.page doesn't protect names from interface superclasses"

Issue #2333 Update (Accept) "Five.browser.metaconfigure.page doesn't protect names from interface superclasses"
 Status Accepted, Zope/bug+solution medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2333

==============================================================
= Accept - Entry #4 by tseaver on Jun 25, 2007 11:06 am

 Status: Pending => Accepted

 Supporters added: tseaver

I will get this checked in for Zope 2.9, Zope 2.10, and the trunk.
________________________________________
= Comment - Entry #3 by tuppence on Jun 21, 2007 6:56 pm


Uploaded:  "allowed_interface_security2.diff"
 - http://www.zope.org/Collectors/Zope/2333/allowed_interface_security2.diff/view
Just for completeness, here is the tiny diff that actually fixes the issue.
________________________________________
= Comment - Entry #2 by tuppence on Jun 21, 2007 6:54 pm


Uploaded:  "allowed_interface_security_tests.diff"
 - http://www.zope.org/Collectors/Zope/2333/allowed_interface_security_tests.diff/view
> I'm attaching a patch to fix and a test that I hope exercises the bug.  I
>   say "hope" because I've been unable to run (just) the Five tests on my
>   Windows platform.  Hopefully this is enough for it to be easy for someone
>   to fix this.

Right, now I actually know how to run Five tests, I'm attaching a patch that tests for the issue.  It fails without the interfaces.names(all=True) change in Five/browser/metaconfigure.py, and passes with the change.
________________________________________
= Request - Entry #1 by tuppence on Jun 9, 2007 10:39 am


Uploaded:  "allowed_interface_security.diff"
 - http://www.zope.org/Collectors/Zope/2333/allowed_interface_security.diff/view
Subject line says it all.  The bug stems from the security setup code calling <interface>.names() rather than <interface>.names(all=True).  philiKON asserts it's a bug.

I'm attaching a patch to fix and a test that I hope exercises the bug.  I say "hope" because I've been unable to run (just) the Five tests on my Windows platform.  Hopefully this is enough for it to be easy for someone to fix this.
==============================================================