Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Try to hide the docstring restriction a little less. #824

Merged
merged 3 commits into from
May 14, 2020
Merged

Try to hide the docstring restriction a little less. #824

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e90845a
#770 mention the doc string restriction when publishing in security c…
May 14, 2020
e0c98ed
#770 mention the doc string restriction in the overview list of the d…
May 14, 2020
5fb154b
add suggestens from PR review
May 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions docs/zdgbook/Security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,14 @@ determine whether to allow or deny access to a visitor for a
particular object. For example, when a user visits the root
``index_html`` object of your site via HTTP, the security policy is
consulted by ``ZPublisher`` to determine whether the user has
permission to view the ``index_html`` object itself. For more
information on this topic, see the chapter on :doc:`ObjectPublishing`.
permission to view the ``index_html`` object itself.

On top of that, publisher also defines other rules to determine which
dataflake marked this conversation as resolved.
Show resolved Hide resolved
objects can be published. The most important of these is that Objects
dataflake marked this conversation as resolved.
Show resolved Hide resolved
which are published must have a docstring.

For more information on this topic, see the chapter on
:doc:`ObjectPublishing`.


How The Security Policy Relates to Restricted Code
Expand Down Expand Up @@ -129,6 +135,10 @@ In short, the default Zope security policy ensures the following:
user does not possess a role that has been granted the permission
in question, access is denied.

- not directly part of the security policy, but also important is the
rule, that objects can only be published if they have a doc string.
dataflake marked this conversation as resolved.
Show resolved Hide resolved


As we delve further into Zope security within this chapter, we'll see
exactly what it means to associate security information with an
object.
Expand Down