diff options
| author | Matt Russell <mattr@netsight.co.uk> | 2013-10-24 23:52:42 +0100 |
|---|---|---|
| committer | Matt Russell <matthew.russell@horizon5.org> | 2013-10-27 22:23:31 +0000 |
| commit | 3c2f95e8049bbd45b144d454daa68005361828b2 (patch) | |
| tree | 163b64c41eb061b7f995513de3c2f00f902d86eb /docs/narr/security.rst | |
| parent | a4492a9bbe0a58aaed68f12657d3ddf979d22921 (diff) | |
| download | pyramid-3c2f95e8049bbd45b144d454daa68005361828b2.tar.gz pyramid-3c2f95e8049bbd45b144d454daa68005361828b2.tar.bz2 pyramid-3c2f95e8049bbd45b144d454daa68005361828b2.zip | |
Security APIs on pyramid.request.Request
The pyramid.security Authorization API function has_permission is made available on the request.
The pyramid.security Authentication API functions are now available as
properties (unauthenticated_userid, authenticated_userid, effective_principals)
and methods (remember_userid, forget_userid) on pyramid.request.Request.
Backwards compatibility:
For each of the APIs moved to request method or property,
the original API in the pyramid.security module proxies to the request.
Reworked tests to check module level b/c wrappers call through to mixins for each API.
Tests that check no reg on request now do the right thing.
Use a response callback to set the request headers for forget_userid and remember_userid.
Update docs.
Attempt to improve a documentation section referencing the pyramid.security.has_permission
function in docs/narr/resources.rst
Ensures backwards compatiblity for `pyramid.security.forget`
and `pyramid.security.remember`.
Diffstat (limited to 'docs/narr/security.rst')
| -rw-r--r-- | docs/narr/security.rst | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/docs/narr/security.rst b/docs/narr/security.rst index e85ed823a..9e6fb6c82 100644 --- a/docs/narr/security.rst +++ b/docs/narr/security.rst @@ -550,7 +550,7 @@ also contain security debugging information in its body. Debugging Imperative Authorization Failures ------------------------------------------- -The :func:`pyramid.security.has_permission` API is used to check +The :meth:`pyramid.request.Request.has_permission` API is used to check security within view functions imperatively. It returns instances of objects that are effectively booleans. But these objects are not raw ``True`` or ``False`` objects, and have information attached to them @@ -563,7 +563,7 @@ one of :data:`pyramid.security.ACLAllowed`, ``msg`` attribute, which is a string indicating why the permission was denied or allowed. Introspecting this information in the debugger or via print statements when a call to -:func:`~pyramid.security.has_permission` fails is often useful. +:meth:`~pyramid.request.Request.has_permission` fails is often useful. .. index:: single: authentication policy (creating) |