principals_allowed_by_permission is described to always return a sequence. Most of the time the result is used with something like Everyone in principals_allowed_by_permission or iterated over. So even if no prinicpal is authorised it should be a sequence regardless.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/pyramid/testing.py b/src/pyramid/testing.py
index 23392772c..6f64e1def 100644
--- a/src/pyramid/testing.py
+++ b/src/pyramid/testing.py
@@ -94,7 +94,7 @@ class DummySecurityPolicy(object):
         if self.permissive:
             return self.effective_principals(None)
         else:
-            return None
+            return []
 
 
 class DummyTemplateRenderer(object):