launchpad-dev team mailing list archive

[Jamal Fanaian <jamal.fanaian@xxxxxxxxx>]

Hi all,

I had brought this issue up before in the mailing list, but I am having some
trouble finding where the permissions for the API would be set so wanted to
see if I could get some hints. I'm looking into bug #515761 [1], which deals
with accessing a project's releases anonymously over the API. It turns out,
that you can't access the project's series anonymously. So I started
digging. It seems that lib/lp/browser/registry/configure.zcml has anything
related to viewing the series pages to zope.Public. Also,
lib/canonical/launchpad/security.py seems to allow Unauthenticated and
Authenticated access to ViewProductSeries.

Attempting to debug this issue, I changed the project page to use
launchpad.Edit as its permission. The site itself was affected, but I saw no
changes accessing projects through the API.

Where else could this permission for the API be set?

Thanks so much!

[1] https://bugs.edge.launchpad.net/launchpadlib/+bug/515761

--
Jamal Fanaian