launchpad-dev team mailing list archive

[Jonathan Lange <jml@xxxxxxxxxxxxx>]

On Mon, Jul 26, 2010 at 11:46 AM, Julian Edwards
<julian.edwards@xxxxxxxxxxxxx> wrote:
...
> I've seen a proliferation recently of people writing code like:
>
> class FlangeGrobbler:
>    @classmethod
>    def new(cls, ...)
>
> which completely bypasses the security adapter when returning new objects.
>

It depends on how you do it.

You can declare a class as providing an interface and then register
the class as secured utility for that interface. Grep for
classProvides in the code to see examples.

The problem isn't how you write the class, it's how you invoke new().
You can still write new() as a classmethod and invoke it with
getUtility(IFooSet).new().

jml