diff options
Diffstat (limited to 'repoze/bfg')
| -rw-r--r-- | repoze/bfg/security.py | 2 | ||||
| -rw-r--r-- | repoze/bfg/tests/test_security.py | 36 |
2 files changed, 1 insertions, 37 deletions
diff --git a/repoze/bfg/security.py b/repoze/bfg/security.py index 693f253d0..2b1d3e0de 100644 --- a/repoze/bfg/security.py +++ b/repoze/bfg/security.py @@ -75,7 +75,7 @@ class ACLAuthorizer(object): for ace in acl: ace_action, ace_principal, ace_permissions = ace - for principal in flatten(principals): + for principal in principals: if ace_principal == principal: permissions = flatten(ace_permissions) if permission in permissions: diff --git a/repoze/bfg/tests/test_security.py b/repoze/bfg/tests/test_security.py index 4209f8d3d..31b25b774 100644 --- a/repoze/bfg/tests/test_security.py +++ b/repoze/bfg/tests/test_security.py @@ -129,42 +129,6 @@ class TestACLAuthorizer(unittest.TestCase): self.assertEqual(result, True) self.assertEqual(result.ace, allow) - def test_permits_nested_principals_list_allow(self): - context = DummyContext() - acl = [] - from repoze.bfg.security import Allow - ace = (Allow, 'larry', 'read') - acl = [ace] - context.__acl__ = acl - authorizer = self._makeOne(context) - principals = (['fred', ['jim', ['bob', 'larry']]]) - result = authorizer.permits('read', *principals) - self.assertEqual(result, True) - self.assertEqual(result.ace, ace) - - def test_permits_nested_principals_list_deny_explicit(self): - context = DummyContext() - from repoze.bfg.security import Deny - ace = (Deny, 'larry', 'read') - acl = [ace] - context.__acl__ = acl - authorizer = self._makeOne(context) - principals = (['fred', ['jim', ['bob', 'larry']]]) - result = authorizer.permits('read', *principals) - self.assertEqual(result, False) - self.assertEqual(result.ace, ace) - - def test_permits_nested_principals_list_deny_implicit(self): - context = DummyContext() - from repoze.bfg.security import Allow - ace = (Allow, 'somebodyelse', 'read') - acl = [ace] - context.__acl__ = acl - authorizer = self._makeOne(context) - principals = (['fred', ['jim', ['bob', 'larry']]]) - result = authorizer.permits('read', *principals) - self.assertEqual(result, False) - def test_permits_allow_via_location_parent(self): context = DummyContext() context.__parent__ = None |