Registered all the Launchpad vocabularies with <securedutility>
instead of <utility> so that it will not be possible to get
a db object without a security proxy.
This required an <allow> block on each utility to allow
access to the __call__ method on the vocabulary class (IVocabularyFactory).
The vocabulary objects required a <class> directive with
<allow interface=IHugeVocabulary>.
Some vocabulary factories were actually functions, such as
BugNominatableSeriesVocabulary, which would actually return either
BugNominatableProductSeriesVocabulary or BugNominatableDistroSeriesVocabulary
objects.
Implementation details
----------------------
New tests:
lib/lp/services/tests/test_vocabularies.py
lib/canonical/launchpad/doc/vocabulary-json.txt
Indicate in the picker widget when email address is hidden.
lib/canonical/launchpad/browser/vocabulary.py
Some vocabularies need to get the IBinaryAndSourcePackageName.id
attribute from objects that were passed in from widgets, so they
are already security proxied.
lib/lp/soyuz/interfaces/binarypackagename.py
Fixed tests that broke since they were accessing methods that
should not be exposed through the security proxy.
lib/canonical/launchpad/doc/vocabularies.txt
lib/lp/answers/doc/faq-vocabulary.txt
lib/lp/registry/doc/vocabularies.txt
Since vocabularies must be registered with a name parameter,
the <securedutility> directive needed to be updated to pass
this along to the underlying <utility>.
lib/canonical/launchpad/webapp/metazcml.py
Added BugNominatableDistroSeriesVocabulary and
BugNominatableProductSeriesVocabulary to __all__.
lib/canonical/launchpad/vocabularies/dbobjects.py
ICountableIterator defines a __getitem__ method that provides
the __getslice__ functionality.
lib/canonical/launchpad/webapp/configure.zcml
The changes for SimpleVocabulary, SimpleTerm, and
BugNominatable*SeriesVocabulary are the only parts of note among the
many changes in this file.
lib/canonical/launchpad/vocabularies/configure.zcml
TimezoneNameVocabulary is just a function that returns a
SimpleVocabulary, so it doesn't need any <class> directives.
lib/lp/services/worlddata/vocabularies.zcml
Uninteresting bulk changes to use <securedutility>:
lib/lp/answers/configure.zcml
lib/lp/registry/vocabularies.zcml
Summary
-------
Registered all the Launchpad vocabularies with <securedutility>
instead of <utility> so that it will not be possible to get
a db object without a security proxy.
This required an <allow> block on each utility to allow tory).
access to the __call__ method on the vocabulary class (IVocabularyFac
The vocabulary objects required a <class> directive with IHugeVocabulary >.
<allow interface=
Some vocabulary factories were actually functions, such as eriesVocabulary , which would actually return either roductSeriesVoc abulary or BugNominatableD istroSeriesVoca bulary
BugNominatableS
BugNominatableP
objects.
Implementation details ------- ------- -
-------
New tests: lp/services/ tests/test_ vocabularies. py canonical/ launchpad/ doc/vocabulary- json.txt
lib/
lib/
Indicate in the picker widget when email address is hidden. canonical/ launchpad/ browser/ vocabulary. py
lib/
Some vocabularies need to get the IBinaryAndSourc ePackageName. id lp/soyuz/ interfaces/ binarypackagena me.py
attribute from objects that were passed in from widgets, so they
are already security proxied.
lib/
Fixed tests that broke since they were accessing methods that canonical/ launchpad/ doc/vocabularie s.txt lp/answers/ doc/faq- vocabulary. txt lp/registry/ doc/vocabularie s.txt
should not be exposed through the security proxy.
lib/
lib/
lib/
Since vocabularies must be registered with a name parameter, canonical/ launchpad/ webapp/ metazcml. py
the <securedutility> directive needed to be updated to pass
this along to the underlying <utility>.
lib/
Added BugNominatableD istroSeriesVoca bulary and roductSeriesVoc abulary to __all__. canonical/ launchpad/ vocabularies/ dbobjects. py
BugNominatableP
lib/
ICountableIterator defines a __getitem__ method that provides canonical/ launchpad/ webapp/ configure. zcml
the __getslice__ functionality.
lib/
Somewhat interesting zcml changes: canonical/ launchpad/ zcml/binaryands ourcepackagenam e.zcml lp/soyuz/ configure. zcml
lib/
lib/
The changes for SimpleVocabulary, SimpleTerm, and SeriesVocabular y are the only parts of note among the canonical/ launchpad/ vocabularies/ configure. zcml
BugNominatable*
many changes in this file.
lib/
TimezoneNameVoc abulary is just a function that returns a lp/services/ worlddata/ vocabularies. zcml
SimpleVocabulary, so it doesn't need any <class> directives.
lib/
Uninteresting bulk changes to use <securedutility>: lp/answers/ configure. zcml lp/registry/ vocabularies. zcml
lib/
lib/
Tests
-----
./bin/test -vv -t 'test_vocabular ies|vocabulary- json.txt'
Demo and Q/A
------------
* Open https:/ /launchpad. dev/people/ +requestmerge
* Click on "Choose" to bring up the picker.
* Search for "name12".
* The email address should be hidden.