AccessControl 7.2__tar.gz → 7.4__tar.gz

{accesscontrol-7.2 → accesscontrol-7.4}/.manylinux-install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 
 set -e -x
 
@@ -28,12 +28,12 @@ yum -y install libffi-devel
 
 tox_env_map() {
     case $1 in
-        *"cp38"*) echo 'py38';;
-        *"cp39"*) echo 'py39';;
         *"cp310"*) echo 'py310';;
         *"cp311"*) echo 'py311';;
         *"cp312"*) echo 'py312';;
         *"cp313"*) echo 'py313';;
+        *"cp314"*) echo 'py314';;
+        *"cp315"*) echo 'py315';;
         *) echo 'py';;
     esac
 }
@@ -41,14 +41,19 @@ tox_env_map() {
 # Compile wheels
 for PYBIN in /opt/python/*/bin; do
     if \
-       [[ "${PYBIN}" == *"cp38/"* ]] || \
-       [[ "${PYBIN}" == *"cp39/"* ]] || \
        [[ "${PYBIN}" == *"cp310/"* ]] || \
        [[ "${PYBIN}" == *"cp311/"* ]] || \
        [[ "${PYBIN}" == *"cp312/"* ]] || \
-       [[ "${PYBIN}" == *"cp313/"* ]] ; then
-        "${PYBIN}/pip" install -e /io/
-        "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+       [[ "${PYBIN}" == *"cp313/"* ]] || \
+       [[ "${PYBIN}" == *"cp314/"* ]] || \
+       [[ "${PYBIN}" == *"cp315/"* ]] ; then
+        if [[ "${PYBIN}" == *"cp315/"* ]] ; then
+            "${PYBIN}/pip" install --pre -e /io/
+            "${PYBIN}/pip" wheel /io/ --pre -w wheelhouse/
+        else
+            "${PYBIN}/pip" install -e /io/
+            "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        fi
         if [ `uname -m` == 'aarch64' ]; then
           cd /io/
           ${PYBIN}/pip install tox
@@ -60,7 +65,10 @@ for PYBIN in /opt/python/*/bin; do
     fi
 done
 
+# Show what wheels we have
+echo "Fixing up the following wheels:"
+ls -l wheelhouse/accesscontrol*.whl
 # Bundle external shared libraries into the wheels
-for whl in wheelhouse/AccessControl*.whl; do
+for whl in wheelhouse/accesscontrol*.whl; do
     auditwheel repair "$whl" -w /io/wheelhouse/
 done

{accesscontrol-7.2 → accesscontrol-7.4}/.manylinux.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 
 set -e -x
 

{accesscontrol-7.2 → accesscontrol-7.4}/.pre-commit-config.yaml

@@ -1,27 +1,28 @@
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 minimum_pre_commit_version: '3.6'
 repos:
   - repo: https://github.com/pycqa/isort
-    rev: "5.13.2"
+    rev: "8.0.1"
     hooks:
     - id: isort
   - repo: https://github.com/hhatto/autopep8
-    rev: "v2.3.1"
+    rev: "v2.3.2"
     hooks:
     - id: autopep8
       args: [--in-place, --aggressive, --aggressive]
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.17.0
+    rev: v3.21.2
     hooks:
     - id: pyupgrade
-      args: [--py38-plus]
+      args: [--py310-plus]
   - repo: https://github.com/isidentical/teyit
     rev: 0.4.3
     hooks:
     - id: teyit
+      language_version: python3.13
   - repo: https://github.com/PyCQA/flake8
-    rev: "7.1.1"
+    rev: "7.3.0"
     hooks:
     - id: flake8
       additional_dependencies:

{accesscontrol-7.2 → accesscontrol-7.4}/CHANGES.rst

@@ -1,8 +1,37 @@
-Changelog
-=========
+Change log
+==========
 
 For changes before version 3.0, see ``HISTORY.rst``.
 
+
+7.4 (2026-07-13)
+----------------
+
+- Fix a parity defect between the Python and C implementations of
+  ``guarded_getattr``: the pure-Python implementation keyed the container
+  assertion on ``type(value.__self__)`` instead of ``type(inst)``, so under
+  ``PURE_PYTHON`` a bound method of an allow-listed simple type (e.g.
+  ``tuple``/``bytes``/``range``) was returned without calling ``validate()``.
+  The Python implementation now keys on ``type(inst)``, matching the C
+  implementation, and a regression test guards the behaviour.
+
+- Add preliminary support for Python 3.15 as of 3.15b1.
+
+- Add support for automatically building and publishing Windows/ARM64 wheels.
+
+- Add support for automatically building and publishing source distributions.
+
+
+7.3 (2025-11-16)
+----------------
+
+- Move all supported package metadata into ``pyproject.toml``.
+
+- Add support for Python 3.14.
+
+- Drop support for Python 3.8 and 3.9.
+
+
 7.2 (2024-11-03)
 ----------------
 
@@ -244,16 +273,19 @@ Changes since 3.0.12:
   ``SecurityInfo._ModuleSecurityInfo``.  See:
   https://github.com/zopefoundation/AccessControl/issues/12
 
+
 3.0.11 (2014-11-02)
 -------------------
 
 - Harden test fix for machines that do not define `localhost`.
 
+
 3.0.10 (2014-11-02)
 -------------------
 
 - Test fix for machines that do not define `localhost`.
 
+
 3.0.9 (2014-08-08)
 ------------------
 
@@ -264,6 +296,7 @@ Changes since 3.0.12:
 - LP #1248529: Leave existing security manager in place inside
   ``RoleManager.manage_getUserRolesAndPermissions``.
 
+
 3.0.8 (2013-07-16)
 ------------------
 
@@ -271,6 +304,7 @@ Changes since 3.0.12:
   (used by ``ImplC``) when using the "C" security policy.  Thanks to
   Arnaud Fontaine for the patch.
 
+
 3.0.7 (2013-05-14)
 ------------------
 
@@ -280,39 +314,46 @@ Changes since 3.0.12:
 - Prevent infinite loop when looking up local roles in an acquisition chain
   with cycles.
 
+
 3.0.6 (2012-10-31)
 ------------------
 
 - LP #1071067: Use a stronger random number generator and a constant time
   comparison function.
 
+
 3.0.5 (2012-10-21)
 ------------------
 
 - LP #966101: Recognize special `zope2.Private` permission in ZCML
   role directive.
 
+
 3.0.4 (2012-09-09)
 ------------------
 
 - LP #1047318: Tighten import restrictions for restricted code.
 
+
 3.0.3 (2012-08-23)
 ------------------
 
 - Fix a bug in ZopeSecurityPolicy.py. Global variable `rolesForPermissionOn`
   could be overridden if `__role__` had custom rolesForPermissionOn.
 
+
 3.0.2 (2012-06-22)
 ------------------
 
 - Add Anonymous as a default role for Public permission.
 
+
 3.0.1 (2012-05-24)
 ------------------
 
 - Fix tests under Python 2.6.
 
+
 3.0 (2012-05-12)
 ----------------
 

{accesscontrol-7.2 → accesscontrol-7.4}/CONTRIBUTING.md

@@ -1,7 +1,7 @@
 <!--
-Generated from:
-https://github.com/zopefoundation/meta/tree/master/config/c-code
---> 
+Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
+-->
 # Contributing to zopefoundation projects
 
 The projects under the zopefoundation GitHub organization are open source and

{accesscontrol-7.2 → accesscontrol-7.4}/MANIFEST.in

@@ -1,5 +1,5 @@
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 include *.md
 include *.rst
 include *.txt

{accesscontrol-7.2 → accesscontrol-7.4}/PKG-INFO

@@ -1,39 +1,38 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: AccessControl
-Version: 7.2
-Summary: Security framework for Zope.
-Home-page: https://github.com/zopefoundation/AccessControl
-Author: Zope Foundation and Contributors
-Author-email: zope-dev@zope.dev
-License: ZPL 2.1
-Project-URL: Issue Tracker, https://github.com/zopefoundation/AccessControl/issues
-Project-URL: Sources, https://github.com/zopefoundation/AccessControl
-Keywords: security access authorization
+Version: 7.4
+Summary: Security framework for Zope
+Author-email: Zope Foundation and contributors <zope-dev@zope.dev>
+Maintainer-email: Plone Foundation and contributors <zope-dev@zope.dev>
+License-Expression: ZPL-2.1
+Project-URL: Issues, https://github.com/zopefoundation/AccessControl/issues
+Project-URL: Source, https://github.com/zopefoundation/AccessControl
+Project-URL: Changelog, https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst
+Keywords: security,access,authorization
 Classifier: Development Status :: 6 - Mature
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Zope
 Classifier: Framework :: Zope :: 5
-Classifier: License :: OSI Approved :: Zope Public License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: CPython
-Requires-Python: >=3.8
+Requires-Python: >=3.10
 Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Requires-Dist: Acquisition
 Requires-Dist: AuthEncoding
 Requires-Dist: BTrees
 Requires-Dist: DateTime
-Requires-Dist: ExtensionClass>=4.2.1
-Requires-Dist: Persistence>=3.0a3
-Requires-Dist: RestrictedPython>=7.4
+Requires-Dist: ExtensionClass
+Requires-Dist: Persistence
+Requires-Dist: RestrictedPython
 Requires-Dist: transaction
 Requires-Dist: zExceptions
 Requires-Dist: zope.component
@@ -45,7 +44,8 @@ Requires-Dist: zope.schema
 Requires-Dist: zope.security
 Requires-Dist: zope.testing
 Provides-Extra: test
-Requires-Dist: zope.testrunner; extra == "test"
+Requires-Dist: zope.testrunner>=6.4; extra == "test"
+Dynamic: license-file
 
 .. image:: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml/badge.svg
    :target: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml
@@ -67,12 +67,40 @@ AccessControl
 
 AccessControl provides a general security framework for use in Zope.
 
-
-Changelog
-=========
+Change log
+==========
 
 For changes before version 3.0, see ``HISTORY.rst``.
 
+
+7.4 (2026-07-13)
+----------------
+
+- Fix a parity defect between the Python and C implementations of
+  ``guarded_getattr``: the pure-Python implementation keyed the container
+  assertion on ``type(value.__self__)`` instead of ``type(inst)``, so under
+  ``PURE_PYTHON`` a bound method of an allow-listed simple type (e.g.
+  ``tuple``/``bytes``/``range``) was returned without calling ``validate()``.
+  The Python implementation now keys on ``type(inst)``, matching the C
+  implementation, and a regression test guards the behaviour.
+
+- Add preliminary support for Python 3.15 as of 3.15b1.
+
+- Add support for automatically building and publishing Windows/ARM64 wheels.
+
+- Add support for automatically building and publishing source distributions.
+
+
+7.3 (2025-11-16)
+----------------
+
+- Move all supported package metadata into ``pyproject.toml``.
+
+- Add support for Python 3.14.
+
+- Drop support for Python 3.8 and 3.9.
+
+
 7.2 (2024-11-03)
 ----------------
 
@@ -314,16 +342,19 @@ Changes since 3.0.12:
   ``SecurityInfo._ModuleSecurityInfo``.  See:
   https://github.com/zopefoundation/AccessControl/issues/12
 
+
 3.0.11 (2014-11-02)
 -------------------
 
 - Harden test fix for machines that do not define `localhost`.
 
+
 3.0.10 (2014-11-02)
 -------------------
 
 - Test fix for machines that do not define `localhost`.
 
+
 3.0.9 (2014-08-08)
 ------------------
 
@@ -334,6 +365,7 @@ Changes since 3.0.12:
 - LP #1248529: Leave existing security manager in place inside
   ``RoleManager.manage_getUserRolesAndPermissions``.
 
+
 3.0.8 (2013-07-16)
 ------------------
 
@@ -341,6 +373,7 @@ Changes since 3.0.12:
   (used by ``ImplC``) when using the "C" security policy.  Thanks to
   Arnaud Fontaine for the patch.
 
+
 3.0.7 (2013-05-14)
 ------------------
 
@@ -350,39 +383,46 @@ Changes since 3.0.12:
 - Prevent infinite loop when looking up local roles in an acquisition chain
   with cycles.
 
+
 3.0.6 (2012-10-31)
 ------------------
 
 - LP #1071067: Use a stronger random number generator and a constant time
   comparison function.
 
+
 3.0.5 (2012-10-21)
 ------------------
 
 - LP #966101: Recognize special `zope2.Private` permission in ZCML
   role directive.
 
+
 3.0.4 (2012-09-09)
 ------------------
 
 - LP #1047318: Tighten import restrictions for restricted code.
 
+
 3.0.3 (2012-08-23)
 ------------------
 
 - Fix a bug in ZopeSecurityPolicy.py. Global variable `rolesForPermissionOn`
   could be overridden if `__role__` had custom rolesForPermissionOn.
 
+
 3.0.2 (2012-06-22)
 ------------------
 
 - Add Anonymous as a default role for Public permission.
 
+
 3.0.1 (2012-05-24)
 ------------------
 
 - Fix tests under Python 2.6.
 
+
 3.0 (2012-05-12)
 ----------------
 

accesscontrol-7.4/pyproject.toml

@@ -0,0 +1,111 @@
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
+[build-system]
+requires = [
+    "setuptools",
+    "wheel",
+]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "AccessControl"
+version = "7.4"
+description = "Security framework for Zope"
+keywords = ["security", "access", "authorization"]
+dynamic = ["readme"]
+requires-python = ">=3.10"
+license = "ZPL-2.1"
+authors = [
+  { name = "Zope Foundation and contributors", email = "zope-dev@zope.dev" },
+]
+maintainers = [
+  { name = "Plone Foundation and contributors", email = "zope-dev@zope.dev" },
+]
+classifiers = [
+  "Development Status :: 6 - Mature",
+  "Environment :: Web Environment",
+  "Framework :: Zope",
+  "Framework :: Zope :: 5",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: Implementation :: CPython",
+]
+dependencies = [
+  "Acquisition",
+  "AuthEncoding",
+  "BTrees",
+  "DateTime",
+  "ExtensionClass",
+  "Persistence",
+  "RestrictedPython",
+  "transaction",
+  "zExceptions",
+  "zope.component",
+  "zope.configuration",
+  "zope.deferredimport",
+  "zope.interface",
+  "zope.publisher",
+  "zope.schema",
+  "zope.security",
+  "zope.testing",
+]
+
+[project.entry-points."zodbupdate.decode"]
+decodes = "AccessControl:zodbupdate_decode_dict"
+
+[project.optional-dependencies]
+test = [
+  "zope.testrunner >= 6.4",
+]
+
+[project.urls]
+Issues = "https://github.com/zopefoundation/AccessControl/issues"
+Source = "https://github.com/zopefoundation/AccessControl"
+Changelog = "https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst"
+
+[tool.coverage.run]
+branch = true
+source = ["AccessControl"]
+relative_files = true
+
+[tool.coverage.report]
+fail_under = 80
+precision = 2
+ignore_errors = true
+show_missing = true
+exclude_lines = [
+    "pragma: no cover",
+    "pragma: nocover",
+    "except ImportError:",
+    "raise NotImplementedError",
+    "if __name__ == '__main__':",
+    "self.fail",
+    "raise AssertionError",
+    "raise unittest.Skip",
+]
+
+[tool.coverage.html]
+directory = "parts/htmlcov"
+
+[tool.coverage.paths]
+source = [
+    "src/",
+    ".tox/*/lib/python*/site-packages/",
+    ".tox/pypy*/site-packages/",
+]
+
+[tool.setuptools.dynamic]
+readme = {file = ["README.rst", "CHANGES.rst"]}
+
+
+
+[tool.zest-releaser]
+create-wheel = false
+upload-pypi = false

{accesscontrol-7.2 → accesscontrol-7.4}/setup.cfg

@@ -1,6 +1,3 @@
-[zest.releaser]
-create-wheel = no
-
 [flake8]
 doctests = 1
 per-file-ignores = 

accesscontrol-7.4/setup.py

@@ -0,0 +1,32 @@
+##############################################################################
+#
+# Copyright (c) 2010 Zope Foundation and Contributors.
+# All Rights Reserved.
+#
+# This software is subject to the provisions of the Zope Public License,
+# Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
+# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
+# FOR A PARTICULAR PURPOSE.
+#
+##############################################################################
+
+from os.path import join
+
+from setuptools import Extension
+from setuptools import setup
+
+
+ext_modules = [
+    Extension(
+        name='AccessControl.cAccessControl',
+        include_dirs=['include', 'src'],
+        sources=[join('src', 'AccessControl', 'cAccessControl.c')],
+        depends=[join('include', 'ExtensionClass', 'ExtensionClass.h'),
+                 join('include', 'ExtensionClass', '_compat.h'),
+                 join('include', 'Acquisition', 'Acquisition.h')]),
+]
+
+
+setup(ext_modules=ext_modules)

{accesscontrol-7.2 → accesscontrol-7.4}/src/AccessControl/ImplPython.py

@@ -724,6 +724,16 @@ def guarded_getattr(inst, name, default=_marker):
     if name[:1] == '_':
         raise Unauthorized(name)
 
+    if name in ('format', 'format_map'):
+        if isinstance(inst, str):
+            from AccessControl.safe_formatter import safe_format
+            from AccessControl.safe_formatter import safe_format_map
+            if name == 'format':
+                return safe_format(inst, name)
+            return safe_format_map(inst, name)
+        if isinstance(inst, type) and issubclass(inst, str):
+            raise Unauthorized(name)
+
     # Try to get the attribute normally so that unusual
     # exceptions are caught early.
     try:
@@ -733,12 +743,14 @@ def guarded_getattr(inst, name, default=_marker):
             return default
         raise
 
-    try:
-        container = v.__self__
-    except AttributeError:
-        container = aq_parent(aq_inner(v)) or inst
-
-    assertion = Containers(type(container))
+    # The container assertion must be keyed on the type of the accessed
+    # object, to match the C implementation (see ``cAccessControl.c``, which
+    # uses ``Containers(type(inst))``).  Keying on ``type(v.__self__)``
+    # instead let a bound method whose ``__self__`` is an allow-listed simple
+    # type (e.g. ``tuple``, ``bytes``, ``range``) take the truthy-assertion
+    # short-circuit and be returned without calling ``validate()`` -- a
+    # divergence from the C engine.
+    assertion = Containers(type(inst))
 
     if isinstance(assertion, dict):
         # We got a table that lets us reason about individual

{accesscontrol-7.2 → accesscontrol-7.4}/src/AccessControl/SecurityInfo.py

@@ -320,7 +320,7 @@ class _ModuleSecurityInfo(SecurityInfo):
     def __init__(self, module_name=None):
         self.names = {}
         if module_name is not None:
-            global _moduleSecurity
+            global _moduleSecurity  # noqa: F824
             _moduleSecurity[module_name] = self
 
     __call____roles__ = ACCESS_PRIVATE