[ZCM] [ZC] 2333/ 5 Comment "Five.browser.metaconfigure.page doesn't protect names from interface superclasses"

Issue #2333 Update (Comment) "Five.browser.metaconfigure.page doesn't protect names from interface superclasses"
 Status Accepted, Zope/bug+solution medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2333

==============================================================
= Comment - Entry #5 by tseaver on Jun 25, 2007 5:44 am

Checked in on the Five 1.3 branch:

 http://svn.zope.org/Products.Five/branches/1.3/?rev=77049&view=rev

the Five 1.4 branch:

 http://svn.zope.org/Products.Five/branches/1.4/?rev=77052&view=rev

the Five 1.5 branch:

 http://svn.zope.org/Products.Five/branches/1.5/?rev=77057&view=rev

and the Five / Zope2 trunk:

 http://svn.zope.org/Zope/trunk/?rev=77058&view=rev

In order for this change to land in the upcoming Zope 2.9.x and
Zope 2.10.x releases, we need also to get the appropriate version
of Five linked into the Zope2 tree.
________________________________________
= Accept - Entry #4 by tseaver on Jun 25, 2007 11:06 am

 Status: Pending => Accepted

 Supporters added: tseaver

I will get this checked in for Zope 2.9, Zope 2.10, and the trunk.
________________________________________
= Comment - Entry #3 by tuppence on Jun 21, 2007 6:56 pm


Uploaded:  "allowed_interface_security2.diff"
 - http://www.zope.org/Collectors/Zope/2333/allowed_interface_security2.diff/view
Just for completeness, here is the tiny diff that actually fixes the issue.
________________________________________
= Comment - Entry #2 by tuppence on Jun 21, 2007 6:54 pm


Uploaded:  "allowed_interface_security_tests.diff"
 - http://www.zope.org/Collectors/Zope/2333/allowed_interface_security_tests.diff/view
> I'm attaching a patch to fix and a test that I hope exercises the bug.  I
>   say "hope" because I've been unable to run (just) the Five tests on my
>   Windows platform.  Hopefully this is enough for it to be easy for someone
>   to fix this.

Right, now I actually know how to run Five tests, I'm attaching a patch that tests for the issue.  It fails without the interfaces.names(all=True) change in Five/browser/metaconfigure.py, and passes with the change.
________________________________________
= Request - Entry #1 by tuppence on Jun 9, 2007 10:39 am


Uploaded:  "allowed_interface_security.diff"
 - http://www.zope.org/Collectors/Zope/2333/allowed_interface_security.diff/view
Subject line says it all.  The bug stems from the security setup code calling <interface>.names() rather than <interface>.names(all=True).  philiKON asserts it's a bug.

I'm attaching a patch to fix and a test that I hope exercises the bug.  I say "hope" because I've been unable to run (just) the Five tests on my Windows platform.  Hopefully this is enough for it to be easy for someone to fix this.
==============================================================