|
From: Mauro A. <mau...@gm...> - 2014-09-25 15:56:22
|
This is a test for traversing images: https://github.com/collective/experimental.noacquisition/blob/master/src/experimental/noacquisition/tests/test_bad_acquisition.py#L62 that I think fails with current implementation on https://github.com/plone/Products.CMFPlone/tree/publication-through-explicit-acquisition and https://github.com/collective/collective.explicitacquisition I'll try to copy the test also on the collective.explicitacquisition <https://github.com/collective/collective.explicitacquisition>, and make the test suggested by Dylan. https://github.com/collective/experimental.noacquisition is my different implementation that implements an ugly monkey patch on ZPublisher, I'll happy if collective.explicitacquisition <https://github.com/collective/collective.explicitacquisition> make the same job without monkey patching. Mauro. On Thu, Sep 25, 2014 at 2:18 PM, Godefroid Chapelle <go...@bu...> wrote: > Le 25/09/14 06:41, Dylan Jay a écrit : > > On 25 Sep 2014, at 11:17 am, Johannes Raggam<rag...@ad...> wrote: > > > >> >I also run into this problem today and factored out gotcha's code > >> >regardinghttps://dev.plone.org/ticket/13793 from > >> > > https://github.com/plone/Products.CMFPlone/tree/publication-through-explicit-acquisition > >> >into a seperate package: > >> > > >> >https://github.com/collective/collective.explicitacquisition > >> > > >> >That's exactly his implementation as a separate package. Easy and > >> >unobtrusive to include, and got no problems with it so far. > >> > > >> >Mauro, which problems with image scaling did you have? I didn't > encouter > >> >problems until now... > > I notice it doesn't also fix the case of dirs being acquired. > > For example > > > > news/item1 > > sub/news/item1 > > > > If sub/news was deleted from sub it's urls would still work and not > raise a 404. > > Anyone see a reason not to extend this patch to disallow acquisition of > any part of the path, not just the context? > > > Nope, would you mind adding a test ? > > Thanks > -- > Godefroid Chapelle (aka __gotcha) http://bubblenet.be > > > ------------------------------------------------------------------------------ > Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer > Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports > Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper > Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer > > http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk > _______________________________________________ > Plone-developers mailing list > Plo...@li... > https://lists.sourceforge.net/lists/listinfo/plone-developers > |