AccessControl 7.1__tar.gz → 7.3__tar.gz

{accesscontrol-7.1 → accesscontrol-7.3}/.manylinux-install.sh

@@ -28,12 +28,11 @@ yum -y install libffi-devel
 
 tox_env_map() {
     case $1 in
-        *"cp38"*) echo 'py38';;
-        *"cp39"*) echo 'py39';;
         *"cp310"*) echo 'py310';;
         *"cp311"*) echo 'py311';;
         *"cp312"*) echo 'py312';;
         *"cp313"*) echo 'py313';;
+        *"cp314"*) echo 'py314';;
         *) echo 'py';;
     esac
 }
@@ -41,12 +40,11 @@ tox_env_map() {
 # Compile wheels
 for PYBIN in /opt/python/*/bin; do
     if \
-       [[ "${PYBIN}" == *"cp38/"* ]] || \
-       [[ "${PYBIN}" == *"cp39/"* ]] || \
        [[ "${PYBIN}" == *"cp310/"* ]] || \
        [[ "${PYBIN}" == *"cp311/"* ]] || \
        [[ "${PYBIN}" == *"cp312/"* ]] || \
-       [[ "${PYBIN}" == *"cp313/"* ]] ; then
+       [[ "${PYBIN}" == *"cp313/"* ]] || \
+       [[ "${PYBIN}" == *"cp314/"* ]] ; then
         "${PYBIN}/pip" install -e /io/
         "${PYBIN}/pip" wheel /io/ -w wheelhouse/
         if [ `uname -m` == 'aarch64' ]; then
@@ -60,7 +58,10 @@ for PYBIN in /opt/python/*/bin; do
     fi
 done
 
+# Show what wheels we have
+echo "Fixing up the following wheels:"
+ls -l wheelhouse/accesscontrol*.whl
 # Bundle external shared libraries into the wheels
-for whl in wheelhouse/AccessControl*.whl; do
+for whl in wheelhouse/accesscontrol*.whl; do
     auditwheel repair "$whl" -w /io/wheelhouse/
 done

{accesscontrol-7.1 → accesscontrol-7.3}/.pre-commit-config.yaml

@@ -3,25 +3,25 @@
 minimum_pre_commit_version: '3.6'
 repos:
   - repo: https://github.com/pycqa/isort
-    rev: "5.13.2"
+    rev: "7.0.0"
     hooks:
     - id: isort
   - repo: https://github.com/hhatto/autopep8
-    rev: "v2.3.1"
+    rev: "v2.3.2"
     hooks:
     - id: autopep8
       args: [--in-place, --aggressive, --aggressive]
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.17.0
+    rev: v3.21.0
     hooks:
     - id: pyupgrade
-      args: [--py38-plus]
+      args: [--py310-plus]
   - repo: https://github.com/isidentical/teyit
     rev: 0.4.3
     hooks:
     - id: teyit
   - repo: https://github.com/PyCQA/flake8
-    rev: "7.1.1"
+    rev: "7.3.0"
     hooks:
     - id: flake8
       additional_dependencies:

{accesscontrol-7.1 → accesscontrol-7.3}/CHANGES.rst

@@ -1,8 +1,26 @@
-Changelog
-=========
+Change log
+==========
 
 For changes before version 3.0, see ``HISTORY.rst``.
 
+
+7.3 (2025-11-16)
+----------------
+
+- Move all supported package metadata into ``pyproject.toml``.
+
+- Add support for Python 3.14.
+
+- Drop support for Python 3.8 and 3.9.
+
+
+7.2 (2024-11-03)
+----------------
+
+- Prevent untrusted access to ``AccessControl.userfolder.UserFolder.data``
+  (fixes `GHSA-g5vw-3h65-2q3v <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v>`_).
+
+
 7.1 (2024-10-10)
 ----------------
 
@@ -237,16 +255,19 @@ Changes since 3.0.12:
   ``SecurityInfo._ModuleSecurityInfo``.  See:
   https://github.com/zopefoundation/AccessControl/issues/12
 
+
 3.0.11 (2014-11-02)
 -------------------
 
 - Harden test fix for machines that do not define `localhost`.
 
+
 3.0.10 (2014-11-02)
 -------------------
 
 - Test fix for machines that do not define `localhost`.
 
+
 3.0.9 (2014-08-08)
 ------------------
 
@@ -257,6 +278,7 @@ Changes since 3.0.12:
 - LP #1248529: Leave existing security manager in place inside
   ``RoleManager.manage_getUserRolesAndPermissions``.
 
+
 3.0.8 (2013-07-16)
 ------------------
 
@@ -264,6 +286,7 @@ Changes since 3.0.12:
   (used by ``ImplC``) when using the "C" security policy.  Thanks to
   Arnaud Fontaine for the patch.
 
+
 3.0.7 (2013-05-14)
 ------------------
 
@@ -273,39 +296,46 @@ Changes since 3.0.12:
 - Prevent infinite loop when looking up local roles in an acquisition chain
   with cycles.
 
+
 3.0.6 (2012-10-31)
 ------------------
 
 - LP #1071067: Use a stronger random number generator and a constant time
   comparison function.
 
+
 3.0.5 (2012-10-21)
 ------------------
 
 - LP #966101: Recognize special `zope2.Private` permission in ZCML
   role directive.
 
+
 3.0.4 (2012-09-09)
 ------------------
 
 - LP #1047318: Tighten import restrictions for restricted code.
 
+
 3.0.3 (2012-08-23)
 ------------------
 
 - Fix a bug in ZopeSecurityPolicy.py. Global variable `rolesForPermissionOn`
   could be overridden if `__role__` had custom rolesForPermissionOn.
 
+
 3.0.2 (2012-06-22)
 ------------------
 
 - Add Anonymous as a default role for Public permission.
 
+
 3.0.1 (2012-05-24)
 ------------------
 
 - Fix tests under Python 2.6.
 
+
 3.0 (2012-05-12)
 ----------------
 

{accesscontrol-7.1 → accesscontrol-7.3}/CONTRIBUTING.md

@@ -1,7 +1,7 @@
 <!--
 Generated from:
 https://github.com/zopefoundation/meta/tree/master/config/c-code
---> 
+-->
 # Contributing to zopefoundation projects
 
 The projects under the zopefoundation GitHub organization are open source and

accesscontrol-7.3/PKG-INFO

@@ -0,0 +1,68 @@
+Metadata-Version: 2.4
+Name: AccessControl
+Version: 7.3
+Summary: Security framework for Zope
+Author-email: Zope Foundation and contributors <zope-dev@zope.dev>
+Maintainer-email: Plone Foundation and contributors <zope-dev@zope.dev>
+License-Expression: ZPL-2.1
+Project-URL: Issues, https://github.com/zopefoundation/AccessControl/issues
+Project-URL: Source, https://github.com/zopefoundation/AccessControl
+Project-URL: Changelog, https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst
+Keywords: security,access,authorization
+Classifier: Development Status :: 6 - Mature
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Zope
+Classifier: Framework :: Zope :: 5
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Requires-Python: >=3.10
+Description-Content-Type: text/x-rst
+License-File: LICENSE.txt
+Requires-Dist: Acquisition
+Requires-Dist: AuthEncoding
+Requires-Dist: BTrees
+Requires-Dist: DateTime
+Requires-Dist: ExtensionClass
+Requires-Dist: Persistence
+Requires-Dist: RestrictedPython
+Requires-Dist: transaction
+Requires-Dist: zExceptions
+Requires-Dist: zope.component
+Requires-Dist: zope.configuration
+Requires-Dist: zope.deferredimport
+Requires-Dist: zope.interface
+Requires-Dist: zope.publisher
+Requires-Dist: zope.schema
+Requires-Dist: zope.security
+Requires-Dist: zope.testing
+Provides-Extra: test
+Requires-Dist: zope.testrunner>=6.4; extra == "test"
+Dynamic: license-file
+
+.. image:: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml/badge.svg
+   :target: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml
+
+.. image:: https://coveralls.io/repos/github/zopefoundation/AccessControl/badge.svg?branch=master
+   :target: https://coveralls.io/github/zopefoundation/AccessControl?branch=master
+
+.. image:: https://img.shields.io/pypi/v/AccessControl.svg
+   :target: https://pypi.org/project/AccessControl/
+   :alt: Current version on PyPI
+
+.. image:: https://img.shields.io/pypi/pyversions/AccessControl.svg
+   :target: https://pypi.org/project/AccessControl/
+   :alt: Supported Python versions
+
+
+AccessControl
+=============
+
+AccessControl provides a general security framework for use in Zope.

accesscontrol-7.3/pyproject.toml

@@ -0,0 +1,104 @@
+# 
+# Generated from:
+# https://github.com/zopefoundation/meta/tree/master/config/c-code
+
+[build-system]
+requires = [
+    "setuptools",
+    "wheel",
+]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "AccessControl"
+version = "7.3"
+description = "Security framework for Zope"
+keywords = ["security", "access", "authorization"]
+readme = "README.rst"
+requires-python = ">=3.10"
+license = "ZPL-2.1"
+authors = [
+  { name = "Zope Foundation and contributors", email = "zope-dev@zope.dev" },
+]
+maintainers = [
+  { name = "Plone Foundation and contributors", email = "zope-dev@zope.dev" },
+]
+classifiers = [
+  "Development Status :: 6 - Mature",
+  "Environment :: Web Environment",
+  "Framework :: Zope",
+  "Framework :: Zope :: 5",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: Implementation :: CPython",
+]
+dependencies = [
+  "Acquisition",
+  "AuthEncoding",
+  "BTrees",
+  "DateTime",
+  "ExtensionClass",
+  "Persistence",
+  "RestrictedPython",
+  "transaction",
+  "zExceptions",
+  "zope.component",
+  "zope.configuration",
+  "zope.deferredimport",
+  "zope.interface",
+  "zope.publisher",
+  "zope.schema",
+  "zope.security",
+  "zope.testing",
+]
+
+[project.entry-points."zodbupdate.decode"]
+decodes = "AccessControl:zodbupdate_decode_dict"
+
+[project.optional-dependencies]
+test = [
+  "zope.testrunner >= 6.4",
+]
+
+[project.urls]
+Issues = "https://github.com/zopefoundation/AccessControl/issues"
+Source = "https://github.com/zopefoundation/AccessControl"
+Changelog = "https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst"
+
+[tool.coverage.run]
+branch = true
+source = ["AccessControl"]
+relative_files = true
+
+[tool.coverage.report]
+fail_under = 80
+precision = 2
+ignore_errors = true
+show_missing = true
+exclude_lines = [
+    "pragma: no cover",
+    "pragma: nocover",
+    "except ImportError:",
+    "raise NotImplementedError",
+    "if __name__ == '__main__':",
+    "self.fail",
+    "raise AssertionError",
+    "raise unittest.Skip",
+]
+
+[tool.coverage.html]
+directory = "parts/htmlcov"
+
+[tool.coverage.paths]
+source = [
+    "src/",
+    ".tox/*/lib/python*/site-packages/",
+    ".tox/pypy*/site-packages/",
+]

accesscontrol-7.3/setup.py

@@ -0,0 +1,32 @@
+##############################################################################
+#
+# Copyright (c) 2010 Zope Foundation and Contributors.
+# All Rights Reserved.
+#
+# This software is subject to the provisions of the Zope Public License,
+# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
+# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
+# FOR A PARTICULAR PURPOSE.
+#
+##############################################################################
+
+from os.path import join
+
+from setuptools import Extension
+from setuptools import setup
+
+
+ext_modules = [
+    Extension(
+        name='AccessControl.cAccessControl',
+        include_dirs=['include', 'src'],
+        sources=[join('src', 'AccessControl', 'cAccessControl.c')],
+        depends=[join('include', 'ExtensionClass', 'ExtensionClass.h'),
+                 join('include', 'ExtensionClass', '_compat.h'),
+                 join('include', 'Acquisition', 'Acquisition.h')]),
+]
+
+
+setup(ext_modules=ext_modules)

{accesscontrol-7.1 → accesscontrol-7.3}/src/AccessControl/SecurityInfo.py

@@ -320,7 +320,7 @@ class _ModuleSecurityInfo(SecurityInfo):
     def __init__(self, module_name=None):
         self.names = {}
         if module_name is not None:
-            global _moduleSecurity
+            global _moduleSecurity  # noqa: F824
             _moduleSecurity[module_name] = self
 
     __call____roles__ = ACCESS_PRIVATE

{accesscontrol-7.1 → accesscontrol-7.3}/src/AccessControl/userfolder.py

@@ -376,6 +376,7 @@ class UserFolder(BasicUserFolder):
     zmi_show_add_dialog = False
     id = 'acl_users'
     title = 'User Folder'
+    data__roles__ = ()  # prevent untrusted access to ``data``.
 
     def __init__(self):
         self.data = PersistentMapping()

accesscontrol-7.3/src/AccessControl.egg-info/PKG-INFO

@@ -0,0 +1,68 @@
+Metadata-Version: 2.4
+Name: AccessControl
+Version: 7.3
+Summary: Security framework for Zope
+Author-email: Zope Foundation and contributors <zope-dev@zope.dev>
+Maintainer-email: Plone Foundation and contributors <zope-dev@zope.dev>
+License-Expression: ZPL-2.1
+Project-URL: Issues, https://github.com/zopefoundation/AccessControl/issues
+Project-URL: Source, https://github.com/zopefoundation/AccessControl
+Project-URL: Changelog, https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst
+Keywords: security,access,authorization
+Classifier: Development Status :: 6 - Mature
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Zope
+Classifier: Framework :: Zope :: 5
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Requires-Python: >=3.10
+Description-Content-Type: text/x-rst
+License-File: LICENSE.txt
+Requires-Dist: Acquisition
+Requires-Dist: AuthEncoding
+Requires-Dist: BTrees
+Requires-Dist: DateTime
+Requires-Dist: ExtensionClass
+Requires-Dist: Persistence
+Requires-Dist: RestrictedPython
+Requires-Dist: transaction
+Requires-Dist: zExceptions
+Requires-Dist: zope.component
+Requires-Dist: zope.configuration
+Requires-Dist: zope.deferredimport
+Requires-Dist: zope.interface
+Requires-Dist: zope.publisher
+Requires-Dist: zope.schema
+Requires-Dist: zope.security
+Requires-Dist: zope.testing
+Provides-Extra: test
+Requires-Dist: zope.testrunner>=6.4; extra == "test"
+Dynamic: license-file
+
+.. image:: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml/badge.svg
+   :target: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml
+
+.. image:: https://coveralls.io/repos/github/zopefoundation/AccessControl/badge.svg?branch=master
+   :target: https://coveralls.io/github/zopefoundation/AccessControl?branch=master
+
+.. image:: https://img.shields.io/pypi/v/AccessControl.svg
+   :target: https://pypi.org/project/AccessControl/
+   :alt: Current version on PyPI
+
+.. image:: https://img.shields.io/pypi/pyversions/AccessControl.svg
+   :target: https://pypi.org/project/AccessControl/
+   :alt: Supported Python versions
+
+
+AccessControl
+=============
+
+AccessControl provides a general security framework for use in Zope.

{accesscontrol-7.1 → accesscontrol-7.3}/src/AccessControl.egg-info/SOURCES.txt

@@ -59,7 +59,6 @@ src/AccessControl.egg-info/PKG-INFO
 src/AccessControl.egg-info/SOURCES.txt
 src/AccessControl.egg-info/dependency_links.txt
 src/AccessControl.egg-info/entry_points.txt
-src/AccessControl.egg-info/not-zip-safe
 src/AccessControl.egg-info/requires.txt
 src/AccessControl.egg-info/top_level.txt
 src/AccessControl/tests/__init__.py

{accesscontrol-7.1 → accesscontrol-7.3}/src/AccessControl.egg-info/requires.txt

@@ -2,9 +2,9 @@ Acquisition
 AuthEncoding
 BTrees
 DateTime
-ExtensionClass>=4.2.1
-Persistence>=3.0a3
-RestrictedPython>=7.4
+ExtensionClass
+Persistence
+RestrictedPython
 transaction
 zExceptions
 zope.component
@@ -17,4 +17,4 @@ zope.security
 zope.testing
 
 [test]
-zope.testrunner
+zope.testrunner>=6.4

{accesscontrol-7.1 → accesscontrol-7.3}/tox.ini

@@ -3,18 +3,18 @@
 [tox]
 minversion = 4.0
 envlist =
+    release-check
     lint
-    py38,py38-pure
-    py39,py39-pure
     py310,py310-pure
     py311,py311-pure
     py312,py312-pure
     py313,py313-pure
+    py314,py314-pure
     coverage
 
 [testenv]
 deps =
-    setuptools  <74
+    setuptools >= 78.1.1,< 81
 setenv =
     pure: PURE_PYTHON=1
     !pure-!pypy3: PURE_PYTHON=0
@@ -47,7 +47,8 @@ description = ensure that the distribution is ready to release
 basepython = python3
 skip_install = true
 deps =
-    setuptools <74
+    setuptools
+    wheel
     twine
     build
     check-manifest
@@ -56,7 +57,7 @@ deps =
 commands_pre =
 commands =
     check-manifest
-    check-python-versions --only setup.py,tox.ini,.github/workflows/tests.yml
+    check-python-versions --only pyproject.toml,setup.py,tox.ini,.github/workflows/tests.yml
     python -m build --sdist --no-isolation
     twine check dist/*