merge static view bugfixes/features from bfg trunk

3 files changed, 24 insertions, 1 deletions

diff --git a/docs/api/configuration.rst b/docs/api/configuration.rst
index f13fc48e5..5215bfb3c 100644
--- a/docs/api/configuration.rst
+++ b/docs/api/configuration.rst
@@ -34,7 +34,7 @@
 
      .. automethod:: add_route
 
-     .. automethod:: add_static_view(name, path, cache_max_age=3600)
+     .. automethod:: add_static_view(name, path, cache_max_age=3600, permission='__no_permission_required__')
 
      .. automethod:: add_settings
 
diff --git a/docs/glossary.rst b/docs/glossary.rst
index dfc40c407..2e2b11aaa 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -204,6 +204,15 @@ Glossary
      to do this".  Examples of permissions: ``read``, or
      ``view_blog_entries``.
 
+   default permission
+     A :term:`permission` which is registered as the default for an
+     entire application.  When a default permission is in effect,
+     every :term:`view configuration` registered with the system will
+     be effectively amended with a ``permission`` argument that will
+     require that the executing user possess the default permission in
+     order to successfully execute the associated :term:`view
+     callable` See also :ref:`setting_a_default_permission`.
+
    ACE
      An *access control entry*.  An access control entry is one element
      in an :term:`ACL`.  An access control entry is a three-tuple that
diff --git a/docs/zcml/static.rst b/docs/zcml/static.rst
index 6c1c5b6d3..815e332c8 100644
--- a/docs/zcml/static.rst
+++ b/docs/zcml/static.rst
@@ -29,6 +29,20 @@ Attributes
   ``Cache-Control`` headers, when any static file is served from this
   directive.  This defaults to 3600 (5 minutes).  Optional.
 
+``permission``
+  Used to specify the :term:`permission` required by a user to execute
+  this static view.  This value defaults to the string
+  ``__no_permission_required__``.  The ``__no_permission_required__``
+  string is a special sentinel which indicates that, even if a
+  :term:`default permission` exists for the current application, the
+  static view should be renderered to completely anonymous users.
+  This default value is permissive because, in most web apps, static
+  resources seldom need protection from viewing.  You should use this
+  option only if you register a static view which points at a
+  directory that contains resources which should be shown only if the
+  calling user has (according to the :term:`authorization policy`) a
+  particular permission.
+
 Examples
 ~~~~~~~~