plone.batching 3.0.2__tar.gz → 3.0.3__tar.gz

{plone_batching-3.0.2 → plone_batching-3.0.3}/CHANGES.rst

@@ -8,6 +8,16 @@ Changelog
 
 .. towncrier release notes start
 
+3.0.3 (2026-11-10)
+------------------
+
+Bug fixes:
+
+
+- Declare only ``Batch`` public in the ``plone.batching`` module instead of opening the whole module to Restricted Python with ``allow_module``.
+  [maurits]
+
+
 3.0.2 (2026-11-03)
 ------------------
 

{plone_batching-3.0.2/src/plone.batching.egg-info → plone_batching-3.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plone.batching
-Version: 3.0.2
+Version: 3.0.3
 Summary: Batching facilities used in Plone
 Author-email: Plone Foundation <plone-developers@lists.sourceforge.net>
 Maintainer-email: Plone Foundation and contributors <plone-developers@lists.sourceforge.net>
@@ -163,6 +163,16 @@ Changelog
 
 .. towncrier release notes start
 
+3.0.3 (2026-11-10)
+------------------
+
+Bug fixes:
+
+
+- Declare only ``Batch`` public in the ``plone.batching`` module instead of opening the whole module to Restricted Python with ``allow_module``.
+  [maurits]
+
+
 3.0.2 (2026-11-03)
 ------------------
 

{plone_batching-3.0.2 → plone_batching-3.0.3}/pyproject.toml

@@ -10,7 +10,7 @@ requires = ["setuptools>=68.2,<83", "wheel"]
 
 [project]
 name = "plone.batching"
-version = "3.0.2"
+version = "3.0.3"
 description = "Batching facilities used in Plone"
 classifiers = [
     "Development Status :: 5 - Production/Stable",

plone_batching-3.0.3/src/plone/batching/__init__.py

@@ -0,0 +1,9 @@
+from AccessControl import allow_class
+from AccessControl import ModuleSecurityInfo
+from plone.batching.batch import Batch
+
+# Only declare Batch public.  Do not use allow_module here: that would make
+# every name in this module available to restricted code, including
+# imported names like allow_class.
+ModuleSecurityInfo("plone.batching").declarePublic("Batch")
+allow_class(Batch)

plone_batching-3.0.3/src/plone/batching/tests/test_security.py

@@ -0,0 +1,50 @@
+from AccessControl import Unauthorized
+from AccessControl.ZopeGuards import guarded_getattr
+from AccessControl.ZopeGuards import guarded_import
+
+import unittest
+
+
+class TestModuleSecurity(unittest.TestCase):
+    def test_batch_is_public(self):
+        from plone.batching import Batch
+
+        module = guarded_import("plone.batching", fromlist=["Batch"])
+        self.assertIs(guarded_getattr(module, "Batch"), Batch)
+        batch = Batch(range(10), 3)
+        self.assertEqual(guarded_getattr(batch, "pagesize"), 3)
+
+    def test_other_names_are_not_public(self):
+        import plone.batching
+
+        # Make sure the submodules are attributes of the package.
+        import plone.batching.batch  # noqa: F401
+        import plone.batching.browser  # noqa: F401
+        import plone.batching.utils  # noqa: F401
+
+        for name in (
+            "allow_class",
+            "allow_module",
+            "ModuleSecurityInfo",
+            "batch",
+            "browser",
+            "utils",
+        ):
+            if not hasattr(plone.batching, name):
+                continue
+            with self.subTest(name=name):
+                self.assertRaises(Unauthorized, guarded_getattr, plone.batching, name)
+                self.assertRaises(
+                    Unauthorized,
+                    guarded_import,
+                    "plone.batching",
+                    fromlist=[name],
+                )
+
+    def test_submodules_not_importable(self):
+        # guarded_import may raise the Unauthorized from zExceptions instead.
+        for name in ("plone.batching.batch", "plone.batching.utils"):
+            with self.subTest(name=name):
+                with self.assertRaises(Exception) as cm:
+                    guarded_import(name)
+                self.assertEqual(type(cm.exception).__name__, "Unauthorized")

{plone_batching-3.0.2 → plone_batching-3.0.3/src/plone.batching.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plone.batching
-Version: 3.0.2
+Version: 3.0.3
 Summary: Batching facilities used in Plone
 Author-email: Plone Foundation <plone-developers@lists.sourceforge.net>
 Maintainer-email: Plone Foundation and contributors <plone-developers@lists.sourceforge.net>
@@ -163,6 +163,16 @@ Changelog
 
 .. towncrier release notes start
 
+3.0.3 (2026-11-10)
+------------------
+
+Bug fixes:
+
+
+- Declare only ``Batch`` public in the ``plone.batching`` module instead of opening the whole module to Restricted Python with ``allow_module``.
+  [maurits]
+
+
 3.0.2 (2026-11-03)
 ------------------
 

{plone_batching-3.0.2 → plone_batching-3.0.3}/src/plone.batching.egg-info/SOURCES.txt

@@ -22,4 +22,5 @@ src/plone/batching/configure.zcml
 src/plone/batching/interfaces.py
 src/plone/batching/utils.py
 src/plone/batching/tests/__init__.py
-src/plone/batching/tests/test_batching.py
+src/plone/batching/tests/test_batching.py
+src/plone/batching/tests/test_security.py

plone_batching-3.0.2/src/plone/batching/__init__.py

@@ -1,6 +0,0 @@
-from AccessControl import allow_class
-from AccessControl import allow_module
-from plone.batching.batch import Batch
-
-allow_module("plone.batching")
-allow_class(Batch)