cco/loops
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

unauthenticated user should not provide a person ID

Browse source
This commit is contained in:
Helmut Merz 2013-04-11 08:28:19 +02:00
parent a78ce4f880
commit cad21c5dc3
3 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
knowledge/survey/browser.py
View file

@ -48,6 +48,7 @@ class SurveyView(ConceptView):
@Lazy @Lazy
def macro(self): def macro(self):
self.registerDojo()
return template.macros['survey'] return template.macros['survey']
def results(self): def results(self):

7
knowledge/survey/response.py
View file

@ -39,10 +39,9 @@ class Responses(BaseRecordManager):
self.context = context self.context = context
def save(self, data): def save(self, data):
if not self.personId: if self.personId:
return self.storage.saveUserTrack(self.uid, 0, self.personId, data,
self.storage.saveUserTrack(self.uid, 0, self.personId, data, update=True, overwrite=True)
update=True, overwrite=True)
def load(self): def load(self):
if self.personId: if self.personId:

3
organize/tracking/base.py
View file

@ -20,6 +20,7 @@
Base class(es) for track/record managers. Base class(es) for track/record managers.
""" """
from zope.app.security.interfaces import IUnauthenticatedPrincipal
from zope.cachedescriptors.property import Lazy from zope.cachedescriptors.property import Lazy
from cybertools.meta.interfaces import IOptions from cybertools.meta.interfaces import IOptions
@ -65,6 +66,8 @@ class BaseRecordManager(object):
else: else:
principal = getPrincipalForUserId(userId, context=self.context) principal = getPrincipalForUserId(userId, context=self.context)
if principal is not None: if principal is not None:
if IUnauthenticatedPrincipal.providedBy(principal):
return None
person = getPersonForUser(self.context, principal=principal) person = getPersonForUser(self.context, principal=principal)
if person is None: if person is None:
return principal.id return principal.id