Code review comment for lp:~edwin-grubbs/launchpad/bug-451208-subscribing-reveals-email

Revision history for this message
Edwin Grubbs (edwin-grubbs) wrote :

Summary
-------

Registered all the Launchpad vocabularies with <securedutility>
instead of <utility> so that it will not be possible to get
a db object without a security proxy.

This required an <allow> block on each utility to allow
access to the __call__ method on the vocabulary class (IVocabularyFactory).

The vocabulary objects required a <class> directive with
<allow interface=IHugeVocabulary>.

Some vocabulary factories were actually functions, such as
BugNominatableSeriesVocabulary, which would actually return either
BugNominatableProductSeriesVocabulary or BugNominatableDistroSeriesVocabulary
objects.

Implementation details
----------------------

New tests:
    lib/lp/services/tests/test_vocabularies.py
    lib/canonical/launchpad/doc/vocabulary-json.txt

Indicate in the picker widget when email address is hidden.
    lib/canonical/launchpad/browser/vocabulary.py

Some vocabularies need to get the IBinaryAndSourcePackageName.id
attribute from objects that were passed in from widgets, so they
are already security proxied.
    lib/lp/soyuz/interfaces/binarypackagename.py

Fixed tests that broke since they were accessing methods that
should not be exposed through the security proxy.
    lib/canonical/launchpad/doc/vocabularies.txt
    lib/lp/answers/doc/faq-vocabulary.txt
    lib/lp/registry/doc/vocabularies.txt

Since vocabularies must be registered with a name parameter,
the <securedutility> directive needed to be updated to pass
this along to the underlying <utility>.
    lib/canonical/launchpad/webapp/metazcml.py

Added BugNominatableDistroSeriesVocabulary and
BugNominatableProductSeriesVocabulary to __all__.
    lib/canonical/launchpad/vocabularies/dbobjects.py

ICountableIterator defines a __getitem__ method that provides
the __getslice__ functionality.
    lib/canonical/launchpad/webapp/configure.zcml

Somewhat interesting zcml changes:
    lib/canonical/launchpad/zcml/binaryandsourcepackagename.zcml
    lib/lp/soyuz/configure.zcml

The changes for SimpleVocabulary, SimpleTerm, and
BugNominatable*SeriesVocabulary are the only parts of note among the
many changes in this file.
    lib/canonical/launchpad/vocabularies/configure.zcml

TimezoneNameVocabulary is just a function that returns a
SimpleVocabulary, so it doesn't need any <class> directives.
    lib/lp/services/worlddata/vocabularies.zcml

Uninteresting bulk changes to use <securedutility>:
    lib/lp/answers/configure.zcml
    lib/lp/registry/vocabularies.zcml

Tests
-----

./bin/test -vv -t 'test_vocabularies|vocabulary-json.txt'

Demo and Q/A
------------

* Open https://launchpad.dev/people/+requestmerge
  * Click on "Choose" to bring up the picker.
  * Search for "name12".
  * The email address should be hidden.

« Back to merge proposal