AccessControl 7.3__tar.gz → 7.4__tar.gz

{accesscontrol-7.3 → accesscontrol-7.4}/.manylinux-install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 
 set -e -x
 
@@ -33,6 +33,7 @@ tox_env_map() {
         *"cp312"*) echo 'py312';;
         *"cp313"*) echo 'py313';;
         *"cp314"*) echo 'py314';;
+        *"cp315"*) echo 'py315';;
         *) echo 'py';;
     esac
 }
@@ -44,9 +45,15 @@ for PYBIN in /opt/python/*/bin; do
        [[ "${PYBIN}" == *"cp311/"* ]] || \
        [[ "${PYBIN}" == *"cp312/"* ]] || \
        [[ "${PYBIN}" == *"cp313/"* ]] || \
-       [[ "${PYBIN}" == *"cp314/"* ]] ; then
-        "${PYBIN}/pip" install -e /io/
-        "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+       [[ "${PYBIN}" == *"cp314/"* ]] || \
+       [[ "${PYBIN}" == *"cp315/"* ]] ; then
+        if [[ "${PYBIN}" == *"cp315/"* ]] ; then
+            "${PYBIN}/pip" install --pre -e /io/
+            "${PYBIN}/pip" wheel /io/ --pre -w wheelhouse/
+        else
+            "${PYBIN}/pip" install -e /io/
+            "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        fi
         if [ `uname -m` == 'aarch64' ]; then
           cd /io/
           ${PYBIN}/pip install tox

{accesscontrol-7.3 → accesscontrol-7.4}/.manylinux.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 
 set -e -x
 

{accesscontrol-7.3 → accesscontrol-7.4}/.pre-commit-config.yaml

@@ -1,9 +1,9 @@
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 minimum_pre_commit_version: '3.6'
 repos:
   - repo: https://github.com/pycqa/isort
-    rev: "7.0.0"
+    rev: "8.0.1"
     hooks:
     - id: isort
   - repo: https://github.com/hhatto/autopep8
@@ -12,7 +12,7 @@ repos:
     - id: autopep8
       args: [--in-place, --aggressive, --aggressive]
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.21.0
+    rev: v3.21.2
     hooks:
     - id: pyupgrade
       args: [--py310-plus]
@@ -20,6 +20,7 @@ repos:
     rev: 0.4.3
     hooks:
     - id: teyit
+      language_version: python3.13
   - repo: https://github.com/PyCQA/flake8
     rev: "7.3.0"
     hooks:

{accesscontrol-7.3 → accesscontrol-7.4}/CHANGES.rst

@@ -4,6 +4,24 @@ Change log
 For changes before version 3.0, see ``HISTORY.rst``.
 
 
+7.4 (2026-07-13)
+----------------
+
+- Fix a parity defect between the Python and C implementations of
+  ``guarded_getattr``: the pure-Python implementation keyed the container
+  assertion on ``type(value.__self__)`` instead of ``type(inst)``, so under
+  ``PURE_PYTHON`` a bound method of an allow-listed simple type (e.g.
+  ``tuple``/``bytes``/``range``) was returned without calling ``validate()``.
+  The Python implementation now keys on ``type(inst)``, matching the C
+  implementation, and a regression test guards the behaviour.
+
+- Add preliminary support for Python 3.15 as of 3.15b1.
+
+- Add support for automatically building and publishing Windows/ARM64 wheels.
+
+- Add support for automatically building and publishing source distributions.
+
+
 7.3 (2025-11-16)
 ----------------
 

{accesscontrol-7.3 → accesscontrol-7.4}/CONTRIBUTING.md

@@ -1,6 +1,6 @@
 <!--
-Generated from:
-https://github.com/zopefoundation/meta/tree/master/config/c-code
+Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 -->
 # Contributing to zopefoundation projects
 

{accesscontrol-7.3 → accesscontrol-7.4}/MANIFEST.in

@@ -1,5 +1,5 @@
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 include *.md
 include *.rst
 include *.txt

accesscontrol-7.4/PKG-INFO

@@ -0,0 +1,431 @@
+Metadata-Version: 2.4
+Name: AccessControl
+Version: 7.4
+Summary: Security framework for Zope
+Author-email: Zope Foundation and contributors <zope-dev@zope.dev>
+Maintainer-email: Plone Foundation and contributors <zope-dev@zope.dev>
+License-Expression: ZPL-2.1
+Project-URL: Issues, https://github.com/zopefoundation/AccessControl/issues
+Project-URL: Source, https://github.com/zopefoundation/AccessControl
+Project-URL: Changelog, https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst
+Keywords: security,access,authorization
+Classifier: Development Status :: 6 - Mature
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Zope
+Classifier: Framework :: Zope :: 5
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Requires-Python: >=3.10
+Description-Content-Type: text/x-rst
+License-File: LICENSE.txt
+Requires-Dist: Acquisition
+Requires-Dist: AuthEncoding
+Requires-Dist: BTrees
+Requires-Dist: DateTime
+Requires-Dist: ExtensionClass
+Requires-Dist: Persistence
+Requires-Dist: RestrictedPython
+Requires-Dist: transaction
+Requires-Dist: zExceptions
+Requires-Dist: zope.component
+Requires-Dist: zope.configuration
+Requires-Dist: zope.deferredimport
+Requires-Dist: zope.interface
+Requires-Dist: zope.publisher
+Requires-Dist: zope.schema
+Requires-Dist: zope.security
+Requires-Dist: zope.testing
+Provides-Extra: test
+Requires-Dist: zope.testrunner>=6.4; extra == "test"
+Dynamic: license-file
+
+.. image:: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml/badge.svg
+   :target: https://github.com/zopefoundation/AccessControl/actions/workflows/tests.yml
+
+.. image:: https://coveralls.io/repos/github/zopefoundation/AccessControl/badge.svg?branch=master
+   :target: https://coveralls.io/github/zopefoundation/AccessControl?branch=master
+
+.. image:: https://img.shields.io/pypi/v/AccessControl.svg
+   :target: https://pypi.org/project/AccessControl/
+   :alt: Current version on PyPI
+
+.. image:: https://img.shields.io/pypi/pyversions/AccessControl.svg
+   :target: https://pypi.org/project/AccessControl/
+   :alt: Supported Python versions
+
+
+AccessControl
+=============
+
+AccessControl provides a general security framework for use in Zope.
+
+Change log
+==========
+
+For changes before version 3.0, see ``HISTORY.rst``.
+
+
+7.4 (2026-07-13)
+----------------
+
+- Fix a parity defect between the Python and C implementations of
+  ``guarded_getattr``: the pure-Python implementation keyed the container
+  assertion on ``type(value.__self__)`` instead of ``type(inst)``, so under
+  ``PURE_PYTHON`` a bound method of an allow-listed simple type (e.g.
+  ``tuple``/``bytes``/``range``) was returned without calling ``validate()``.
+  The Python implementation now keys on ``type(inst)``, matching the C
+  implementation, and a regression test guards the behaviour.
+
+- Add preliminary support for Python 3.15 as of 3.15b1.
+
+- Add support for automatically building and publishing Windows/ARM64 wheels.
+
+- Add support for automatically building and publishing source distributions.
+
+
+7.3 (2025-11-16)
+----------------
+
+- Move all supported package metadata into ``pyproject.toml``.
+
+- Add support for Python 3.14.
+
+- Drop support for Python 3.8 and 3.9.
+
+
+7.2 (2024-11-03)
+----------------
+
+- Prevent untrusted access to ``AccessControl.userfolder.UserFolder.data``
+  (fixes `GHSA-g5vw-3h65-2q3v <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v>`_).
+
+
+7.1 (2024-10-10)
+----------------
+
+- Add final support for Python 3.13.
+
+- Respect ``PURE_PYTHON`` environment variable set to ``0`` when running tests.
+
+- Let the roles access in ``rolesForPermissionOn`` interpret ``AttributeError``
+  and ``Unauthorized`` as "no roles definition for this permission at this
+  object" and report any other exception (for the Python and C implementation).
+  We have to treat ``Unauthorized`` like ``AttributeError`` to support
+  ``Shared.DC.Scripts.Bindings.UnauthorizedBinding`` which raises
+  ``Unauthorized`` for any access.
+
+
+7.0 (2024-05-30)
+----------------
+
+- Add preliminary support for Python 3.13 as of 3.13b1.
+
+- Remove support for Python 3.7.
+
+- Build Windows wheels on GHA.
+
+- Make dict views (`.keys()`, `.items()` and `.values()`) behave like their
+  unrestricted versions.
+  (`#147 <https://github.com/zopefoundation/AccessControl/pull/147>`_)
+
+- Make `.items()` validate each keys and values, like `.keys()` and
+  `.values()` do.
+
+- Fix build errors on recent macOS versions.
+
+
+6.3 (2023-11-20)
+----------------
+
+- Add support for Python 3.12.
+
+
+6.2 (2023-09-04)
+----------------
+
+- Fix information disclosure through ``str.format_map``.
+  (CVE-2023-41050)
+
+
+6.1 (2023-05-22)
+----------------
+- Update C header files for ``ExtensionClass`` and ``Acquisition``
+  from the original packages where needed.
+  (`#140 <https://github.com/zopefoundation/AccessControl/issues/140>`_)
+
+- Add preliminary support for Python 3.12a5.
+
+
+6.0 (2023-01-12)
+----------------
+
+- Build Linux binary wheels for Python 3.11
+
+- Drop support for Python 2.7, 3.5, 3.6.
+
+
+5.7 (2022-11-17)
+----------------
+
+- Add support for building arm64 wheels on macOS.
+
+
+5.6 (2022-11-03)
+----------------
+
+- Add support for final Python 3.11 release.
+
+
+5.5 (2022-10-10)
+----------------
+
+- Switch from ``-Ofast`` to ``-O3`` when compiling code for Linux wheels.
+  (`#133 <https://github.com/zopefoundation/AccessControl/pull/133>`_)
+
+- Add support for Python 3.11 (as of 3.11.0rc2).
+
+
+5.4 (2022-08-26)
+----------------
+
+- Add support for Python 3.11 (as of 3.11.0b5).
+
+- Support ``default`` argument in ``next`` built-in function.
+  (`#131 <https://github.com/zopefoundation/AccessControl/pull/131>`_)
+
+
+5.3.1 (2022-03-29)
+------------------
+
+- Prevent race condition in guarded_import
+  (`#123 <https://github.com/zopefoundation/AccessControl/issues/123>`_)
+
+
+5.3 (2022-02-25)
+----------------
+
+- Provide ``AccessControl.get_safe_globals`` to facilitate safe use.
+
+- Honor ``PURE_PYTHON`` environment variable to enable python implementation
+  during runtime.
+
+- Add support for Python 3.10.
+
+
+5.2 (2021-07-30)
+----------------
+
+- Fix Appveyor configuration so tests can run and wheels build.
+
+
+5.1 (2021-07-30)
+----------------
+NOTE: This release has been yanked from PyPI due to wheel build issues.
+
+- Fix a remote code execution issue by preventing access to
+  ``string.Formatter`` from restricted code.
+
+
+5.0 (2020-10-07)
+----------------
+
+- Add support for Python 3.9.
+
+- Remove deprecated classes and functions in
+  (see `#32 <https://github.com/zopefoundation/AccessControl/issues/32>`_):
+
+  + ``AccessControl/DTML.py``
+  + ``AccessControl/Owned.py``
+  + ``AccessControl/Role.py``
+  + ``AccessControl/Permissions.py``
+
+- Add deprecation warnings for BBB imports in:
+
+  + ``AccessControl/AuthEncoding.py``
+  + ``AccessControl/Owned.py``
+  + ``AccessControl/Role.py``
+  + ``AccessControl/User.py``
+
+- Although this version might run on Zope 4, it is no longer supported because
+  of the dropped deprecation warnings.
+
+
+4.2 (2020-04-20)
+----------------
+
+- Add missing permission ``Manage WebDAV Locks``
+
+- Fix regression for BBB import of ```users.UnrestrictedUser``
+  (`#94 <https://github.com/zopefoundation/AccessControl/issues/94>`_)
+
+- Add a check if database is present in ``.owner.ownerInfo``.
+  (`#91 <https://github.com/zopefoundation/AccessControl/issues/91>`_).
+
+
+4.1 (2019-09-02)
+----------------
+
+- Python 3: Allow iteration over the result of ``dict.{keys,values,items}``
+  (`#89 <https://github.com/zopefoundation/AccessControl/issues/89>`_).
+
+
+4.0 (2019-05-08)
+----------------
+
+Changes since 3.0.12:
+
+- Add support for Python 3.5, 3.6, 3.7 and 3.8.
+
+- Restore simple access to bytes methods in Python 3
+  (`#83 <https://github.com/zopefoundation/AccessControl/issues/83>`_)
+
+- Clarify deprecation warnings for several BBB shims.
+  (`#32 <https://github.com/zopefoundation/AccessControl/issues/32>`_)
+
+- Add a test to prove that a user folder flag cannot be acquired elsewhere.
+  (`#7 <https://github.com/zopefoundation/AccessControl/issues/7>`_)
+
+- Tighten basic auth string handling in ``BasicUserFolder.identify``
+  (`#56 <https://github.com/zopefoundation/AccessControl/issues/56>`_)
+
+- Prevent the Zope 4 ZMI from showing an add dialog for the user folder.
+  (`#82 <https://github.com/zopefoundation/AccessControl/issues/82>`_)
+
+- Fix order of roles returned by
+  ``AccessControl.rolemanager.RoleManager.userdefined_roles``.
+
+- Add configuration for `zodbupdate`.
+
+- Add ``TaintedBytes`` besides ``TaintedString`` in ``AccessControl.tainted``.
+  (`#57 <https://github.com/zopefoundation/AccessControl/issues/57>`_)
+
+- Security fix: In ``str.format``, check the security for attributes that are
+  accessed. (Ported from 2.13).
+
+- Port ``override_container`` context manager here from 2.13.
+
+- Add AppVeyor configuration to automate building Windows eggs.
+
+- Fix for compilers that only support C89 syntax (e.g. on Windows).
+
+- Sanitize and test `RoleManager` role handling.
+
+- Depend on RestrictedPython >= 4.0.
+
+- #16: Fixed permission handling by avoiding column and row numbers as
+  identifiers for permissions and roles.
+
+- Extract ``.AuthEncoding`` to its own package for reuse.
+
+- Declare missing dependency on BTrees.
+
+- Drop `Record` dependency, which now does its own security declaration.
+
+- Remove leftovers from history support dropped in Zope.
+
+- Remove duplicate guard against * imports.
+  (`#60 <https://github.com/zopefoundation/AccessControl/issues/60>`_)
+
+
+3.0.12 (2015-12-21)
+-------------------
+
+- Avoid acquiring ``access`` from module wrapped by
+  ``SecurityInfo._ModuleSecurityInfo``.  See:
+  https://github.com/zopefoundation/AccessControl/issues/12
+
+
+3.0.11 (2014-11-02)
+-------------------
+
+- Harden test fix for machines that do not define `localhost`.
+
+
+3.0.10 (2014-11-02)
+-------------------
+
+- Test fix for machines that do not define `localhost`.
+
+
+3.0.9 (2014-08-08)
+------------------
+
+- GitHub #6: Do not pass SecurityInfo instance itself to declarePublic/declarePrivate
+  when using the public/private decorator. This fixes ``Conflicting security declarations``
+  warnings on Zope startup.
+
+- LP #1248529: Leave existing security manager in place inside
+  ``RoleManager.manage_getUserRolesAndPermissions``.
+
+
+3.0.8 (2013-07-16)
+------------------
+
+- LP #1169923:  ensure initialization of shared ``ImplPython`` state
+  (used by ``ImplC``) when using the "C" security policy.  Thanks to
+  Arnaud Fontaine for the patch.
+
+
+3.0.7 (2013-05-14)
+------------------
+
+- Remove long-deprecated 'Shared' roles support (pre-dates Zope, never
+  used by Zope itself)
+
+- Prevent infinite loop when looking up local roles in an acquisition chain
+  with cycles.
+
+
+3.0.6 (2012-10-31)
+------------------
+
+- LP #1071067: Use a stronger random number generator and a constant time
+  comparison function.
+
+
+3.0.5 (2012-10-21)
+------------------
+
+- LP #966101: Recognize special `zope2.Private` permission in ZCML
+  role directive.
+
+
+3.0.4 (2012-09-09)
+------------------
+
+- LP #1047318: Tighten import restrictions for restricted code.
+
+
+3.0.3 (2012-08-23)
+------------------
+
+- Fix a bug in ZopeSecurityPolicy.py. Global variable `rolesForPermissionOn`
+  could be overridden if `__role__` had custom rolesForPermissionOn.
+
+
+3.0.2 (2012-06-22)
+------------------
+
+- Add Anonymous as a default role for Public permission.
+
+
+3.0.1 (2012-05-24)
+------------------
+
+- Fix tests under Python 2.6.
+
+
+3.0 (2012-05-12)
+----------------
+
+- Added decorators for public, private and protected security declarations.
+
+- Update tests to take advantage of automatic test suite discovery.

{accesscontrol-7.3 → accesscontrol-7.4}/pyproject.toml

@@ -1,7 +1,5 @@
-# 
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
-
+# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
+# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/c-code
 [build-system]
 requires = [
     "setuptools",
@@ -11,10 +9,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "AccessControl"
-version = "7.3"
+version = "7.4"
 description = "Security framework for Zope"
 keywords = ["security", "access", "authorization"]
-readme = "README.rst"
+dynamic = ["readme"]
 requires-python = ">=3.10"
 license = "ZPL-2.1"
 authors = [
@@ -102,3 +100,12 @@ source = [
     ".tox/*/lib/python*/site-packages/",
     ".tox/pypy*/site-packages/",
 ]
+
+[tool.setuptools.dynamic]
+readme = {file = ["README.rst", "CHANGES.rst"]}
+
+
+
+[tool.zest-releaser]
+create-wheel = false
+upload-pypi = false

{accesscontrol-7.3 → accesscontrol-7.4}/setup.cfg

@@ -1,6 +1,3 @@
-[zest.releaser]
-create-wheel = no
-
 [flake8]
 doctests = 1
 per-file-ignores = 

{accesscontrol-7.3 → accesscontrol-7.4}/src/AccessControl/ImplPython.py

@@ -724,6 +724,16 @@ def guarded_getattr(inst, name, default=_marker):
     if name[:1] == '_':
         raise Unauthorized(name)
 
+    if name in ('format', 'format_map'):
+        if isinstance(inst, str):
+            from AccessControl.safe_formatter import safe_format
+            from AccessControl.safe_formatter import safe_format_map
+            if name == 'format':
+                return safe_format(inst, name)
+            return safe_format_map(inst, name)
+        if isinstance(inst, type) and issubclass(inst, str):
+            raise Unauthorized(name)
+
     # Try to get the attribute normally so that unusual
     # exceptions are caught early.
     try:
@@ -733,12 +743,14 @@ def guarded_getattr(inst, name, default=_marker):
             return default
         raise
 
-    try:
-        container = v.__self__
-    except AttributeError:
-        container = aq_parent(aq_inner(v)) or inst
-
-    assertion = Containers(type(container))
+    # The container assertion must be keyed on the type of the accessed
+    # object, to match the C implementation (see ``cAccessControl.c``, which
+    # uses ``Containers(type(inst))``).  Keying on ``type(v.__self__)``
+    # instead let a bound method whose ``__self__`` is an allow-listed simple
+    # type (e.g. ``tuple``, ``bytes``, ``range``) take the truthy-assertion
+    # short-circuit and be returned without calling ``validate()`` -- a
+    # divergence from the C engine.
+    assertion = Containers(type(inst))
 
     if isinstance(assertion, dict):
         # We got a table that lets us reason about individual