diff options
| author | Chris McDonough <chrism@plope.com> | 2012-03-30 02:30:32 -0400 |
|---|---|---|
| committer | Chris McDonough <chrism@plope.com> | 2012-03-30 02:30:32 -0400 |
| commit | a9ee05f216a0e8866c11aa377cd8c125ef791e28 (patch) | |
| tree | defe7c42fa3b3f72884640a0d43450425f72a754 | |
| parent | f8636ce5fa8685190358fc83cc2b5ebeaefde8b9 (diff) | |
| parent | 8782def302a98cefdd4a4c1d448f5226acf81103 (diff) | |
| download | pyramid-a9ee05f216a0e8866c11aa377cd8c125ef791e28.tar.gz pyramid-a9ee05f216a0e8866c11aa377cd8c125ef791e28.tar.bz2 pyramid-a9ee05f216a0e8866c11aa377cd8c125ef791e28.zip | |
forward-port security fix from 1.3 branch
| -rw-r--r-- | CHANGES.txt | 8 | ||||
| -rw-r--r-- | pyramid/security.py | 2 | ||||
| -rw-r--r-- | pyramid/tests/test_security.py | 3 |
3 files changed, 11 insertions, 2 deletions
diff --git a/CHANGES.txt b/CHANGES.txt index c3e679b8a..ac22aa36d 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,6 +1,14 @@ Next release ============ +Bug Fixes +--------- + +- When no authentication policy was configured, a call to + ``pyramid.security.effective_principals`` would unconditionally return the + empty list. This was incorrect, it should have unconditionally returned + ``[Everyone]``, and now does. + Features -------- diff --git a/pyramid/security.py b/pyramid/security.py index f29edd678..4b929241e 100644 --- a/pyramid/security.py +++ b/pyramid/security.py @@ -100,7 +100,7 @@ def effective_principals(request): policy = reg.queryUtility(IAuthenticationPolicy) if policy is None: - return [] + return [Everyone] return policy.effective_principals(request) def principals_allowed_by_permission(context, permission): diff --git a/pyramid/tests/test_security.py b/pyramid/tests/test_security.py index 86149d554..ba9538b01 100644 --- a/pyramid/tests/test_security.py +++ b/pyramid/tests/test_security.py @@ -266,9 +266,10 @@ class TestEffectivePrincipals(unittest.TestCase): return effective_principals(request) def test_no_authentication_policy(self): + from pyramid.security import Everyone request = _makeRequest() result = self._callFUT(request) - self.assertEqual(result, []) + self.assertEqual(result, [Everyone]) def test_with_authentication_policy(self): request = _makeRequest() |