> > === modified file 'lib/canonical/launchpad/webapp/configure.zcml'
> > --- lib/canonical/launchpad/webapp/configure.zcml     2009-11-18 00:22:41
> +0000
> > +++ lib/canonical/launchpad/webapp/configure.zcml     2010-01-12 22:36:26
> +0000
> > @@ -809,6 +809,7 @@
> >
> >      <class class="canonical.launchpad.webapp.vocabulary.CountableIterator">
> >        <allow
> interface="canonical.launchpad.webapp.vocabulary.ICountableIterator" />
> > +      <allow attributes="__getslice__"/>
> 
> Wouldn't it make sense to add __getslice__ to CountableIterator?


Gary had recommended that I add __getslice__ to the zcml instead of the interface
since this is a security concern and not a method that implementors of ICountableIterator
need to create.



> >      </class>
> >
> >      <class
> class="canonical.launchpad.webapp.vocabulary.BatchedCountableIterator">
> >
> > === modified file 'lib/lp/registry/doc/vocabularies.txt'
> > --- lib/lp/registry/doc/vocabularies.txt      2009-12-24 01:41:54 +0000
> > +++ lib/lp/registry/doc/vocabularies.txt      2010-01-12 22:36:26 +0000
> > @@ -20,7 +20,9 @@
> >  The active mailing lists vocabulary matches and returns only those mailing
> >  lists which are active.
> >
> > -    >>> list_vocabulary = vocabulary_registry.get(None,
> 'ActiveMailingList')
> > +    >>> from zope.security.proxy import removeSecurityProxy
> > +    >>> list_vocabulary = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, 'ActiveMailingList'))
> >      >>> from canonical.launchpad.webapp.testing import verifyObject
> >      >>> from canonical.launchpad.webapp.vocabulary import IHugeVocabulary
> >      >>> verifyObject(IHugeVocabulary, list_vocabulary)
> > @@ -203,6 +205,7 @@
> >      u'The Hoary Hedgehog Release'
> >
> >      >>> def getTerms(vocab, search_text):
> > +    ...     vocab = removeSecurityProxy(vocab)
> >      ...     [vocab.toTerm(item) for item in vocab.search(search_text)]
> >
> >      >>> getTerms(distroseries_vocabulary, 'woody')
> > @@ -508,7 +511,8 @@
> >
> >  The list of selectable projects. The results are ordered by displayname.
> >
> > -    >>> project_vocabulary = vocabulary_registry.get(None, "Project")
> > +    >>> project_vocabulary = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "Project"))
> 
> I think we wought to have a wrapper around vocabulary_registry.get() to remove
> the security proxy of the vocab before returning. Something like
> 
>     def get_naked_vocab(context, name):
>         return removeSecurityProxy(vocab_registry.get(context, name))
> 
> That way we don't have to repeat the removeSecurityProxy() call in all the
> places we call vocabulary_registry.get.


Done.


> >      >>> project_vocabulary.displayname
> >      'Select a project group'
> >
> > @@ -542,7 +546,8 @@
> >
> >  The list of selectable products. Results are ordered by displayname.
> >
> > -    >>> product_vocabulary = vocabulary_registry.get(None, "Product")
> > +    >>> product_vocabulary = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "Product"))
> >      >>> product_vocabulary.displayname
> >      'Select a project'
> >
> > @@ -583,8 +588,8 @@
> >
> >  The list of selectable products releases.
> >
> > -    >>> productrelease_vocabulary = vocabulary_registry.get(None,
> > -    ...
> "ProductRelease")
> > +    >>> productrelease_vocabulary = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "ProductRelease"))
> >      >>> productrelease_vocabulary.displayname
> >      'Select a Product Release'
> >
> > @@ -603,7 +608,8 @@
> >  All non-merged people with at least one email address. This vocabulary is
> >  meant to be used only in the people merge form.
> >
> > -    >>> vocab = vocabulary_registry.get(None, "PersonAccountToMerge")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "PersonAccountToMerge"))
> >      >>> vocab.displayname
> >      'Select a Person to Merge'
> >
> > @@ -693,7 +699,8 @@
> >
> >  The set of non-merged people.
> >
> > -    >>> vocab = vocabulary_registry.get(None, "AdminMergeablePerson")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "AdminMergeablePerson"))
> >      >>> vocab.displayname
> >      'Select a Person to Merge'
> >
> > @@ -712,7 +719,8 @@
> >
> >  All non-merged people and teams.
> >
> > -    >>> vocab = vocabulary_registry.get(None, "NonMergedPeopleAndTeams")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "NonMergedPeopleAndTeams"))
> >      >>> vocab.displayname
> >      'Select a Person or Team'
> >
> > @@ -746,7 +754,8 @@
> >  None).  It also includes all public teams and private teams the
> >  user has permission to view.
> >
> > -    >>> vocab = vocabulary_registry.get(None, "ValidPersonOrTeam")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "ValidPersonOrTeam"))
> >      >>> vocab.displayname
> >      'Select a Person or Team'
> >
> > @@ -794,7 +803,8 @@
> >  A PRIVATE team is displayed when the logged in user is a member of the
> team.
> >
> >      >>> commercial = person_set.getByEmail('commercial-
> <email address hidden>')
> > -    >>> vocab = vocabulary_registry.get(commercial, "ValidPersonOrTeam")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(commercial, "ValidPersonOrTeam"))
> >      >>> login('<email address hidden>')
> >      >>> priv_team = factory.makeTeam(
> >      ...     name='private-team',
> > @@ -861,7 +871,8 @@
> >  one of its email addresses.
> >
> >      >>> login('<email address hidden>')
> > -    >>> vocab = vocabulary_registry.get(None, "ValidPersonOrTeam")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "ValidPersonOrTeam"))
> >      >>> sorted(person.name for person in vocab.search('support'))
> >      [u'ubuntu-team']
> >
> > @@ -932,7 +943,8 @@
> >  All valid persons and teams are also valid owners.
> >
> >      >>> login(ANONYMOUS)
> > -    >>> vocab = vocabulary_registry.get(None, "ValidOwner")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "ValidOwner"))
> >      >>> vocab.displayname
> >      'Select a Person or Team'
> >
> > @@ -955,7 +967,8 @@
> >  except that its terms are limited only to teams.  No non-team Persons will
> be
> >  returned.
> >
> > -    >>> vocab = vocabulary_registry.get(None, 'ValidTeam')
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, 'ValidTeam'))
> >      >>> vocab.displayname
> >      'Select a Team'
> >      >>> sorted((team.displayname, team.teamowner.displayname)
> > @@ -1076,7 +1089,8 @@
> >
> >  'name16' is a valid member for 'ubuntu-team':
> >
> > -    >>> vocab = vocabulary_registry.get(team, "ValidTeamMember")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(team, "ValidTeamMember"))
> >      >>> vocab.displayname
> >      'Select a Person or Team'
> >
> > @@ -1126,7 +1140,8 @@
> >
> >  'ubuntu-team' is not a valid owner for itself.
> >
> > -    >>> vocab = vocabulary_registry.get(team, "ValidTeamOwner")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(team, "ValidTeamOwner"))
> >      >>> vocab.displayname
> >      'Select a Person or Team'
> >
> > @@ -1147,7 +1162,8 @@
> >
> >  All 'valid' persons who are not a team.
> >
> > -    >>> vocab = vocabulary_registry.get(None, "ValidPerson")
> > +    >>> vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "ValidPerson"))
> >      >>> vocab.displayname
> >      'Select a Person'
> >      >>> people = vocab.search(None)
> > @@ -1172,8 +1188,8 @@
> >      >>> carlos = getUtility(IPersonSet).getByName('carlos')
> >      >>> carlos_team = factory.makeTeam(
> >      ...     owner=carlos, name='carlos-team')
> > -    >>> person_or_team_vocab = vocabulary_registry.get(
> > -    ...     None, "ValidPersonOrTeam")
> > +    >>> person_or_team_vocab = removeSecurityProxy(
> > +    ...     vocabulary_registry.get(None, "ValidPersonOrTeam"))
> >      >>> carlos_people_or_team = person_or_team_vocab.search('carlos')
> >      >>> # The people or team search yields our one Carlos person and
> >      >>> # the new team.
> >
> > === added file 'lib/lp/services/tests/test_vocabularies.py'
> > --- lib/lp/services/tests/test_vocabularies.py        1970-01-01 00:00:00
> +0000
> > +++ lib/lp/services/tests/test_vocabularies.py        2010-01-12 22:36:26
> +0000
> > @@ -0,0 +1,33 @@
> > +# Copyright 2010 Canonical Ltd.  This software is licensed under the
> > +# GNU Affero General Public License version 3 (see the file LICENSE).
> > +
> > +"""Test registered vocabularies."""
> > +
> > +__metaclass__ = type
> > +__all__ = []
> > +
> > +import unittest
> > +
> > +from zope.component import getUtilitiesFor
> > +from zope.schema.interfaces import IVocabularyFactory
> > +from zope.security._proxy import _Proxy
> > +
> > +from canonical.testing.layers import FunctionalLayer
> > +from lp.testing import TestCase
> > +
> > +
> > +class TestVocabularies(TestCase):
> > +    layer = FunctionalLayer
> > +
> > +    def test_security_proxy(self):
> > +        """Our vocabularies should be registered with <securedutility>."""
> > +        vocabularies = getUtilitiesFor(IVocabularyFactory)
> > +        for name, vocab in vocabularies:
> > +            if type(vocab) != _Proxy and vocab.__module__[:5] != 'zope.':
> > +                raise AssertionError(
> > +                    '%s.%s vocabulary is not wrapped in a security proxy.'
> % (
> > +                    vocab.__module__, name))
> 
> Isn't there a simpler way to check that a given object is wrapped in a
> security proxy?  Let's check with Gary...


I changed it to use zope.proxy.isProxy() as Gary recommended.


> > +
> > +
> > +def test_suite():
> > +    return unittest.TestLoader().loadTestsFromName(__name__)
> >


Incremental diff:
{{{
=== modified file 'lib/canonical/launchpad/doc/vocabularies.txt'
--- lib/canonical/launchpad/doc/vocabularies.txt	2010-01-12 19:02:09 +0000
+++ lib/canonical/launchpad/doc/vocabularies.txt	2010-01-15 19:30:52 +0000
@@ -43,7 +43,11 @@
 vocabulary registry.
 
     >>> from zope.schema.vocabulary import getVocabularyRegistry
+    >>> from zope.security.proxy import removeSecurityProxy
     >>> vocabulary_registry = getVocabularyRegistry()
+    >>> def get_naked_vocab(context, name):
+    ...     return removeSecurityProxy(
+    ...         vocabulary_registry.get(context, name))
     >>> product_vocabulary = vocabulary_registry.get(None, "Product")
     >>> product_vocabulary.displayname
     'Select a project'
@@ -56,9 +60,8 @@
 
 All the distributions that use Malone as their main bug tracker.
 
-    >>> from zope.security.proxy import removeSecurityProxy
-    >>> using_malone_vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, 'DistributionUsingMalone'))
+    >>> using_malone_vocabulary = get_naked_vocab(
+    ...     None, 'DistributionUsingMalone')
     >>> len(using_malone_vocabulary)
     2
     >>> for term in using_malone_vocabulary:
@@ -359,8 +362,7 @@
 concerned).
 
     # Just use None as the context.
-    >>> branch_vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "Branch"))
+    >>> branch_vocabulary = get_naked_vocab(None, "Branch")
     >>> def print_vocab_branches(vocab, search):
     ...     for term in vocab.searchForTerms(search):
     ...         print term.value.unique_name
@@ -641,8 +643,7 @@
 that matches the search string. The string is matched against the name,
 or fallbacks to a full text search.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(spec_a, "SpecificationDepCandidates"))
+    >>> vocab = get_naked_vocab(spec_a, "SpecificationDepCandidates")
     >>> list(vocab.search('spec-b')) == [spec_b]
     True
     >>> list(vocab.search('third')) == [spec_c]
@@ -666,8 +667,7 @@
     >>> from canonical.launchpad.webapp.testing import verifyObject
     >>> from canonical.launchpad.webapp.vocabulary import IHugeVocabulary
 
-    >>> vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, 'PPA'))
+    >>> vocabulary = get_naked_vocab(None, 'PPA')
     >>> verifyObject(IHugeVocabulary, vocabulary)
     True
 

=== modified file 'lib/lp/registry/doc/vocabularies.txt'
--- lib/lp/registry/doc/vocabularies.txt	2010-01-12 19:02:09 +0000
+++ lib/lp/registry/doc/vocabularies.txt	2010-01-15 19:29:03 +0000
@@ -11,8 +11,12 @@
     >>> launchbag.clear()
 
     >>> from zope.schema.vocabulary import getVocabularyRegistry
+    >>> from zope.security.proxy import removeSecurityProxy
     >>> vocabulary_registry = getVocabularyRegistry()
-    >>> product_vocabulary = vocabulary_registry.get(None, "Product")
+    >>> def get_naked_vocab(context, name):
+    ...     return removeSecurityProxy(
+    ...         vocabulary_registry.get(context, name))
+    >>> product_vocabulary = get_naked_vocab(None, "Product")
 
 
 == ActiveMailingList ==
@@ -20,9 +24,7 @@
 The active mailing lists vocabulary matches and returns only those mailing
 lists which are active.
 
-    >>> from zope.security.proxy import removeSecurityProxy
-    >>> list_vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, 'ActiveMailingList'))
+    >>> list_vocabulary = get_naked_vocab(None, 'ActiveMailingList')
     >>> from canonical.launchpad.webapp.testing import verifyObject
     >>> from canonical.launchpad.webapp.vocabulary import IHugeVocabulary
     >>> verifyObject(IHugeVocabulary, list_vocabulary)
@@ -183,7 +185,7 @@
 Reflects the available distribution series.  Results are ordered by
 `name`
 
-    >>> distroseries_vocabulary = vocabulary_registry.get(
+    >>> distroseries_vocabulary = get_naked_vocab(
     ...     None,"DistroSeries")
     >>> for term in distroseries_vocabulary:
     ...     print "%30s %s" % (term.token, term.title)
@@ -205,7 +207,6 @@
     u'The Hoary Hedgehog Release'
 
     >>> def getTerms(vocab, search_text):
-    ...     vocab = removeSecurityProxy(vocab)
     ...     [vocab.toTerm(item) for item in vocab.search(search_text)]
 
     >>> getTerms(distroseries_vocabulary, 'woody')
@@ -228,7 +229,7 @@
 All the teams the person is an active member of.
 
     >>> foo_bar = person_set.getByEmail('<email address hidden>')
-    >>> person_active_membership = vocabulary_registry.get(
+    >>> person_active_membership = get_naked_vocab(
     ...     foo_bar, 'PersonActiveMembership')
     >>> len(person_active_membership)
     10
@@ -323,7 +324,7 @@
     [u'hwdb-team', u'landscape-developers', u'launchpad-users', u'name18',
      u'name20']
 
-    >>> sample_person_teams_vocabulary = vocabulary_registry.get(
+    >>> sample_person_teams_vocabulary = get_naked_vocab(
     ...     sample_person, 'PersonTeamParticipations')
 
     >>> for term in sample_person_teams_vocabulary:
@@ -346,13 +347,13 @@
 to the current context. If no context is given, or if the context does
 not have any milestones, a MilestoneVocabulary is empty...
 
-    >>> milestones = vocabulary_registry.get(None, 'Milestone')
+    >>> milestones = get_naked_vocab(None, 'Milestone')
     >>> len(milestones)
     0
 
     >>> from canonical.launchpad.interfaces import IMaloneApplication
     >>> malone = getUtility(IMaloneApplication)
-    >>> milestones = vocabulary_registry.get(malone, 'Milestone')
+    >>> milestones = get_naked_vocab(malone, 'Milestone')
     >>> len(milestones)
     0
 
@@ -361,7 +362,7 @@
 milestones from RelevantMilestonesMixin.getMilestoneWidgetValues()
 but we need the big default vocabulary for form input validation.
 
-    >>> all_milestones = vocabulary_registry.get(sample_person, 'Milestone')
+    >>> all_milestones = get_naked_vocab(sample_person, 'Milestone')
     >>> len(all_milestones)
     3
     >>> for term in all_milestones:
@@ -374,7 +375,7 @@
 vocabulary.
 
     >>> firefox = product_set.getByName('firefox')
-    >>> firefox_milestones = vocabulary_registry.get(firefox, 'Milestone')
+    >>> firefox_milestones = get_naked_vocab(firefox, 'Milestone')
     >>> for term in firefox_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
     firefox: 1.0
@@ -385,7 +386,7 @@
     >>> firefox_trunk = firefox.getSeries('trunk')
     >>> firefox_milestone = factory.makeMilestone(
     ...     product=firefox, name='firefox-milestone-no-series')
-    >>> firefox_trunk_milestones = vocabulary_registry.get(firefox_trunk,
+    >>> firefox_trunk_milestones = get_naked_vocab(firefox_trunk,
     ...                                                    'Milestone')
     >>> for term in firefox_trunk_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
@@ -400,7 +401,7 @@
     >>> firefox_task = bug_one.bugtasks[0]
     >>> firefox_task.bugtargetdisplayname
     u'Mozilla Firefox'
-    >>> firefox_task_milestones = vocabulary_registry.get(
+    >>> firefox_task_milestones = get_naked_vocab(
     ...     firefox_task, 'Milestone')
     >>> for term in firefox_task_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
@@ -411,7 +412,7 @@
     >>> debian_woody_task = bug_two.bugtasks[-1]
     >>> debian_woody_task.bugtargetdisplayname
     u'mozilla-firefox (Debian Woody)'
-    >>> debian_woody_milestones = vocabulary_registry.get(
+    >>> debian_woody_milestones = get_naked_vocab(
     ...     debian_woody_task, 'Milestone')
     >>> debian_woody = debian_woody_task.distroseries
     >>> len(debian_woody_milestones)
@@ -423,7 +424,7 @@
     >>> milestone = debian_woody.milestones[0]
     >>> milestone.active = False
     >>> flush_database_updates()
-    >>> len(vocabulary_registry.get(debian_woody_task, 'Milestone'))
+    >>> len(get_naked_vocab(debian_woody_task, 'Milestone'))
     1
 
 If the milestone was used in a bugtask before it was marked inactive, though,
@@ -431,7 +432,7 @@
 
     >>> debian_woody_task.milestone = milestone
     >>> flush_database_updates()
-    >>> len(vocabulary_registry.get(debian_woody_task, 'Milestone'))
+    >>> len(get_naked_vocab(debian_woody_task, 'Milestone'))
     2
 
 This is true for inactive milestones used in bugtasks for products and
@@ -439,7 +440,7 @@
 
     >>> product_bugtask = factory.makeBugTask(target=firefox)
     >>> product_bugtask.milestone = firefox_milestone
-    >>> product_target_milestones = vocabulary_registry.get(
+    >>> product_target_milestones = get_naked_vocab(
     ...     product_bugtask, 'Milestone')
     >>> for term in product_target_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
@@ -447,7 +448,7 @@
     firefox: firefox-milestone-no-series
 
     >>> firefox_milestone.active = False
-    >>> product_target_milestones = vocabulary_registry.get(
+    >>> product_target_milestones = get_naked_vocab(
     ...     product_bugtask, 'Milestone')
     >>> for term in product_target_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
@@ -456,7 +457,7 @@
 
     >>> productseries_bugtask = factory.makeBugTask(target=firefox_trunk)
     >>> productseries_bugtask.milestone = firefox_milestone
-    >>> productseries_target_milestones = vocabulary_registry.get(
+    >>> productseries_target_milestones = get_naked_vocab(
     ...     productseries_bugtask, 'Milestone')
     >>> for term in productseries_target_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
@@ -467,7 +468,7 @@
 target are in the vocabulary.
 
     >>> canvas_spec = firefox.getSpecification('canvas')
-    >>> spec_target_milestones = vocabulary_registry.get(
+    >>> spec_target_milestones = get_naked_vocab(
     ...     canvas_spec, 'Milestone')
     >>> for term in spec_target_milestones:
     ...     print "%s: %s" % (term.value.target.name, term.value.name)
@@ -484,10 +485,10 @@
     u'1.0'
     >>> one_dot_o.active = False
 
-    >>> firefox_milestones = vocabulary_registry.get(firefox, 'Milestone')
+    >>> firefox_milestones = get_naked_vocab(firefox, 'Milestone')
     >>> len(firefox_milestones)
     0
-    >>> firefox_task_milestones = vocabulary_registry.get(
+    >>> firefox_task_milestones = get_naked_vocab(
     ...     firefox_task, 'Milestone')
     >>> len(firefox_task_milestones)
     0
@@ -498,7 +499,7 @@
 All the products in a project.
 
     >>> mozilla_project = getUtility(IProjectSet).getByName('mozilla')
-    >>> mozilla_products_vocabulary = vocabulary_registry.get(
+    >>> mozilla_products_vocabulary = get_naked_vocab(
     ...     mozilla_project,'ProjectProducts')
 
     >>> for term in mozilla_products_vocabulary:
@@ -511,8 +512,7 @@
 
 The list of selectable projects. The results are ordered by displayname.
 
-    >>> project_vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "Project"))
+    >>> project_vocabulary = get_naked_vocab(None, "Project")
     >>> project_vocabulary.displayname
     'Select a project group'
 
@@ -546,8 +546,7 @@
 
 The list of selectable products. Results are ordered by displayname.
 
-    >>> product_vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "Product"))
+    >>> product_vocabulary = get_naked_vocab(None, "Product")
     >>> product_vocabulary.displayname
     'Select a project'
 
@@ -588,8 +587,7 @@
 
 The list of selectable products releases.
 
-    >>> productrelease_vocabulary = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "ProductRelease"))
+    >>> productrelease_vocabulary = get_naked_vocab(None, "ProductRelease")
     >>> productrelease_vocabulary.displayname
     'Select a Product Release'
 
@@ -608,8 +606,7 @@
 All non-merged people with at least one email address. This vocabulary is
 meant to be used only in the people merge form.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "PersonAccountToMerge"))
+    >>> vocab = get_naked_vocab(None, "PersonAccountToMerge")
     >>> vocab.displayname
     'Select a Person to Merge'
 
@@ -674,7 +671,6 @@
     True
 
     # Here we cheat because IPerson.merged is a readonly attribute.
-    >>> from zope.security.proxy import removeSecurityProxy
     >>> naked_cprov = removeSecurityProxy(cprov)
     >>> naked_cprov.merged = 1
     >>> naked_cprov.syncUpdate()
@@ -699,8 +695,7 @@
 
 The set of non-merged people.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "AdminMergeablePerson"))
+    >>> vocab = get_naked_vocab(None, "AdminMergeablePerson")
     >>> vocab.displayname
     'Select a Person to Merge'
 
@@ -719,8 +714,7 @@
 
 All non-merged people and teams.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "NonMergedPeopleAndTeams"))
+    >>> vocab = get_naked_vocab(None, "NonMergedPeopleAndTeams")
     >>> vocab.displayname
     'Select a Person or Team'
 
@@ -754,8 +748,7 @@
 None).  It also includes all public teams and private teams the
 user has permission to view.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "ValidPersonOrTeam"))
+    >>> vocab = get_naked_vocab(None, "ValidPersonOrTeam")
     >>> vocab.displayname
     'Select a Person or Team'
 
@@ -803,8 +796,7 @@
 A PRIVATE team is displayed when the logged in user is a member of the team.
 
     >>> commercial = person_set.getByEmail('<email address hidden>')
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(commercial, "ValidPersonOrTeam"))
+    >>> vocab = get_naked_vocab(commercial, "ValidPersonOrTeam")
     >>> login('<email address hidden>')
     >>> priv_team = factory.makeTeam(
     ...     name='private-team',
@@ -871,8 +863,7 @@
 one of its email addresses.
 
     >>> login('<email address hidden>')
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "ValidPersonOrTeam"))
+    >>> vocab = get_naked_vocab(None, "ValidPersonOrTeam")
     >>> sorted(person.name for person in vocab.search('support'))
     [u'ubuntu-team']
 
@@ -943,8 +934,7 @@
 All valid persons and teams are also valid owners.
 
     >>> login(ANONYMOUS)
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "ValidOwner"))
+    >>> vocab = get_naked_vocab(None, "ValidOwner")
     >>> vocab.displayname
     'Select a Person or Team'
 
@@ -967,8 +957,7 @@
 except that its terms are limited only to teams.  No non-team Persons will be
 returned.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, 'ValidTeam'))
+    >>> vocab = get_naked_vocab(None, 'ValidTeam')
     >>> vocab.displayname
     'Select a Team'
     >>> sorted((team.displayname, team.teamowner.displayname)
@@ -1075,22 +1064,21 @@
 
 ValidTeamMember needs a context:
 
-    >>> vocab = vocabulary_registry.get(None, "ValidTeamMember")
+    >>> vocab = get_naked_vocab(None, "ValidTeamMember")
     Traceback (most recent call last):
     ...
     AssertionError: ...
 
 ValidTeamMember's context must implement ITeam:
 
-    >>> vocab = vocabulary_registry.get(person, "ValidTeamMember")
+    >>> vocab = get_naked_vocab(person, "ValidTeamMember")
     Traceback (most recent call last):
     ...
     AssertionError: ...
 
 'name16' is a valid member for 'ubuntu-team':
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(team, "ValidTeamMember"))
+    >>> vocab = get_naked_vocab(team, "ValidTeamMember")
     >>> vocab.displayname
     'Select a Person or Team'
 
@@ -1122,26 +1110,25 @@
 
 ValidTeamOwner needs a context.
 
-    >>> vocab = vocabulary_registry.get(None, "ValidTeamOwner")
+    >>> vocab = get_naked_vocab(None, "ValidTeamOwner")
     Traceback (most recent call last):
     ...
     AssertionError: ...
 
 ValidTeamOwner's context must provide IPerson or IPersonSet.
 
-    >>> vocabulary_registry.get(team, "ValidTeamOwner")
-    <...ValidTeamOwnerVocabulary...
-    >>> vocabulary_registry.get(person_set, "ValidTeamOwner")
-    <...ValidTeamOwnerVocabulary...
-    >>> vocabulary_registry.get(firefox, "ValidTeamOwner")
+    >>> get_naked_vocab(team, "ValidTeamOwner")
+    <...ValidTeamOwnerVocabulary...
+    >>> get_naked_vocab(person_set, "ValidTeamOwner")
+    <...ValidTeamOwnerVocabulary...
+    >>> get_naked_vocab(firefox, "ValidTeamOwner")
     Traceback (most recent call last):
     ...
     AssertionError: ...
 
 'ubuntu-team' is not a valid owner for itself.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(team, "ValidTeamOwner"))
+    >>> vocab = get_naked_vocab(team, "ValidTeamOwner")
     >>> vocab.displayname
     'Select a Person or Team'
 
@@ -1162,8 +1149,7 @@
 
 All 'valid' persons who are not a team.
 
-    >>> vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "ValidPerson"))
+    >>> vocab = get_naked_vocab(None, "ValidPerson")
     >>> vocab.displayname
     'Select a Person'
     >>> people = vocab.search(None)
@@ -1188,8 +1174,7 @@
     >>> carlos = getUtility(IPersonSet).getByName('carlos')
     >>> carlos_team = factory.makeTeam(
     ...     owner=carlos, name='carlos-team')
-    >>> person_or_team_vocab = removeSecurityProxy(
-    ...     vocabulary_registry.get(None, "ValidPersonOrTeam"))
+    >>> person_or_team_vocab = get_naked_vocab(None, "ValidPersonOrTeam")
     >>> carlos_people_or_team = person_or_team_vocab.search('carlos')
     >>> # The people or team search yields our one Carlos person and
     >>> # the new team.
@@ -1212,7 +1197,7 @@
 All products and distributions. Note that the value type is
 heterogeneous.
 
-    >>> vocab = vocabulary_registry.get(None, "DistributionOrProduct")
+    >>> vocab = get_naked_vocab(None, "DistributionOrProduct")
     >>> for term in vocab:
     ...     if 'Ubuntu' in term.title:
     ...         print term.title, '- class', term.value.__class__.__name__
@@ -1252,12 +1237,12 @@
     True
     >>> tomcat.active = False
     >>> flush_database_updates()
-    >>> vocab = vocabulary_registry.get(None, "DistributionOrProduct")
+    >>> vocab = get_naked_vocab(None, "DistributionOrProduct")
     >>> tomcat in vocab
     False
     >>> tomcat.active = True
     >>> flush_database_updates()
-    >>> vocab = vocabulary_registry.get(None, "DistributionOrProduct")
+    >>> vocab = get_naked_vocab(None, "DistributionOrProduct")
     >>> tomcat in vocab
     True
 
@@ -1273,7 +1258,7 @@
 All products, projects and distributions. Note that the value type is
 heterogeneous.
 
-    >>> vocab = vocabulary_registry.get(None, "DistributionOrProductOrProject")
+    >>> vocab = get_naked_vocab(None, "DistributionOrProductOrProject")
     >>> for term in vocab:
     ...     if 'Ubuntu' in term.title:
     ...         print term.title, '- class', term.value.__class__.__name__
@@ -1313,7 +1298,7 @@
     >>> apache in vocab
     False
 
-    >>> vocab = vocabulary_registry.get(None, "DistributionOrProductOrProject")
+    >>> vocab = get_naked_vocab(None, "DistributionOrProductOrProject")
     >>> for term in vocab:
     ...     if 'Apache' in term.title:
     ...         print term.title, '- class', term.value.__class__.__name__
@@ -1323,7 +1308,7 @@
     >>> product_set.getByName('tomcat').active = True
     >>> getUtility(IProjectSet).getByName('apache').active = True
     >>> flush_database_updates()
-    >>> vocab = vocabulary_registry.get(None, "DistributionOrProductOrProject")
+    >>> vocab = get_naked_vocab(None, "DistributionOrProductOrProject")
     >>> for term in vocab:
     ...     if 'Apache' in term.title:
     ...         print term.title, '- class', term.value.__class__.__name__
@@ -1341,7 +1326,7 @@
 DistributionOrProductOrProjectVocabulary (defined using the
 _clauseTables).
 
-    >>> featured_project_vocabulary = vocabulary_registry.get(
+    >>> featured_project_vocabulary = get_naked_vocab(
     ...     None, 'FeaturedProject')
     >>> len(featured_project_vocabulary)
     9
@@ -1392,7 +1377,7 @@
     >>> check_permission('launchpad.Commercial', bac)
     False
 
-    >>> comm_proj_vocab = vocabulary_registry.get(bac, "CommercialProjects")
+    >>> comm_proj_vocab = get_naked_vocab(bac, "CommercialProjects")
     >>> print comm_proj_vocab.displayname
     Select a commercial project
 
@@ -1420,7 +1405,7 @@
     >>> check_permission('launchpad.ProjectReview', product_set)
     True
 
-    >>> comm_proj_vocab = vocabulary_registry.get(registry_member, "CommercialProjects")
+    >>> comm_proj_vocab = get_naked_vocab(registry_member, "CommercialProjects")
     >>> print comm_proj_vocab.displayname
     Select a commercial project
 

=== modified file 'lib/lp/services/tests/test_vocabularies.py'
--- lib/lp/services/tests/test_vocabularies.py	2010-01-12 21:53:44 +0000
+++ lib/lp/services/tests/test_vocabularies.py	2010-01-15 19:17:12 +0000
@@ -9,6 +9,7 @@
 import unittest
 
 from zope.component import getUtilitiesFor
+from zope.proxy import isProxy
 from zope.schema.interfaces import IVocabularyFactory
 from zope.security._proxy import _Proxy
 
@@ -23,7 +24,7 @@
         """Our vocabularies should be registered with <securedutility>."""
         vocabularies = getUtilitiesFor(IVocabularyFactory)
         for name, vocab in vocabularies:
-            if type(vocab) != _Proxy and vocab.__module__[:5] != 'zope.':
+            if not isProxy(vocab) and vocab.__module__[:5] != 'zope.':
                 raise AssertionError(
                     '%s.%s vocabulary is not wrapped in a security proxy.' % (
                     vocab.__module__, name))


}}}