some bits I missed, and the next release will be beta ;)

Author: Richard Jones

CHANGES.txt

@@ -1,7 +1,7 @@
 This file contains the changes to the Roundup system over time. The entries
 are given with the most recent entry first.
 
-2005-01-?? 0.8.0
+2005-01-?? 0.8.0b3
 Fixed:
 - fix roundup-server log and PID file paths to be absolute
 - fix initialisation of roundup-server in daemon mode so initialisation

templates/classic/html/_generic.item.html

@@ -9,12 +9,13 @@
 
 <td class="content" metal:fill-slot="content">
 
-<span tal:condition="python:not (context.is_view_ok() or context.is_edit_ok())"
- tal:omit-tag="python:1" i18n:translate=""
->You are not allowed to view this page.</span>
+<p tal:condition="not:context/is_view_ok" i18n:translate="">You are not
+    allowed to view this page.</p>
+
+<div tal:condition="context/is_view_ok">
 
 <form method="POST" onSubmit="return submit_once()"
-      enctype="multipart/form-data" tal:condition="context/is_edit_ok"
+      enctype="multipart/form-data" tal:condition="context/is_view_ok"
       tal:attributes="action context/designator">
 
 <input type="hidden" name="@template" value="item">
@@ -38,21 +39,9 @@
 
 </form>
 
-<table class="form" tal:condition="context/is_only_view_ok">
-
-<tr tal:repeat="prop python:db[context._classname].properties()">
- <tal:block tal:condition="python:prop._name not in ('id', 'creator',
-                                  'creation', 'activity')">
-  <th tal:content="prop/_name"></th>
-  <td tal:content="structure python:context[prop._name].field()"></td>
- </tal:block>
-</tr>
-</table>
-
+<tal:block tal:condition="context/id" tal:replace="structure context/history" />
 
-<tal:block tal:condition="python:context.id and context.is_view_ok()">
- <tal:block tal:replace="structure context/history" />
-</tal:block>
+</div>
 
 </td>
 

templates/classic/html/file.item.html

@@ -6,12 +6,11 @@
 
 <td class="content" metal:fill-slot="content">
 
-<span tal:condition="python:not (context.is_view_ok() or context.is_edit_ok())"
- tal:omit-tag="python:1" i18n:translate=""
->You are not allowed to view this page.</span>
+<p tal:condition="not:context/is_view_ok" i18n:translate="">You are not
+    allowed to view this page.</p>
 
 <form method="POST" onSubmit="return submit_once()"
-      enctype="multipart/form-data" tal:condition="context/is_edit_ok"
+      enctype="multipart/form-data" tal:condition="context/is_view_ok"
       tal:attributes="action context/designator">
 
 <table class="form">
@@ -42,19 +41,8 @@
  tal:attributes="href string:file${context/id}/${context/name}"
  i18n:translate="">download</a>
 
-<table class="form" tal:condition="context/is_only_view_ok">
- <tr>
-  <th i18n:translate="">Name</th>
-  <td tal:content="context/name"></td>
- </tr>
- <tr>
-  <th i18n:translate="">Content Type</th>
-  <td tal:content="context/type"></td>
- </tr>
-</table>
+<tal:block tal:condition="context/id" tal:replace="structure context/history" />
 
-<tal:block tal:condition="python:context.id and context.is_view_ok()"
-           tal:replace="structure context/history" />
 </td>
 
 </tal:block>

templates/classic/html/msg.item.html

@@ -22,6 +22,11 @@
   replace="context/id" i18n:name="id" /> Editing</span>
 </tal:block>
 <td class="content" metal:fill-slot="content">
+
+<p tal:condition="not:context/is_view_ok" i18n:translate="">You are not
+    allowed to view this page.</p>
+
+<div tal:condition="context/is_view_ok">
 <table class="form">
 
 <tr>
@@ -66,6 +71,8 @@
 </table>
 
 <tal:block tal:replace="structure context/history" />
+
+</div>
 </td>
 
 </tal:block>

templates/classic/html/user.item.html

@@ -25,6 +25,11 @@
 
 <td class="content" metal:fill-slot="content">
 
+<p tal:condition="not:context/is_view_ok" i18n:translate="">You are not
+    allowed to view this page.</p>
+
+<div tal:condition="context/is_view_ok">
+
 <form method="POST" onSubmit="return submit_once()"
       enctype="multipart/form-data"
       tal:attributes="action context/designator">
@@ -94,7 +99,9 @@
 </table>
 </form>
 
-<tal:block tal:replace="structure context/history" />
+<tal:block tal:condition="context/id" tal:replace="structure context/history" />
+
+</div>
 
 </td>
 

test/test_security.py

@@ -18,7 +18,7 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
-# $Id: test_security.py,v 1.8 2005-01-28 03:51:19 richard Exp $
+# $Id: test_security.py,v 1.9 2005-01-28 04:07:58 richard Exp $
 
 import os, unittest, shutil
 
@@ -124,6 +124,13 @@ def testAccessControls(self):
         # *any* access to class
         self.assertEquals(has('Test', user1, 'test'), 1)
         self.assertEquals(has('Test', user2, 'test'), 1)
+
+        # *any* access to item
+        self.assertEquals(has('Test', user1, 'test', itemid='1'), 1)
+        self.assertEquals(has('Test', user2, 'test', itemid='1'), 1)
+        self.assertEquals(has('Test', super, 'test', itemid='1'), 1)
+        self.assertEquals(has('Test', none, 'test', itemid='1'), 0)
+
         # now property test
         self.assertEquals(has('Test', user2, 'test', property='a'), 1)
         self.assertEquals(has('Test', user2, 'test', property='b'), 1)