security proxied __getslice__ on ResultSet

[Jürgen Kartnaller]

Slicing on a security proxied ResultSet is not possible.

This happens because Python first checks for the existence of __getslice__.

__getslice__ is not included in IResultSet which leads to an attribute error.

Solution :
 - add __getslice__ to IResultSet
 - or add <allow attributes="__getslice__" /> to the zcml class directive.

Workaround until this is fixed :

Add this to your zcml :

<class class="storm.store.ResultSet">
   <allow attributes="__getslice__" />
</class>

[Jamu Kakar (jkakar)]

I've pushed a branch with the following trivial diff:

=== modified file 'storm/zope/configure.zcml'
--- storm/zope/configure.zcml 2007-08-05 22:15:26 +0000
+++ storm/zope/configure.zcml 2008-06-05 22:01:38 +0000
@@ -11,6 +11,7 @@

     <class class="storm.store.ResultSet">
         <allow interface=".interfaces.IResultSet" />
+ <allow attributes="__getslice__" />
     </class>

     <class class="storm.store.EmptyResultSet">

The reason I'm not merging it directly to trunk is that I'm not 100%
sure we want this. Isn't __getitem__ used in preference to
__getslice__?

[Gustavo Niemeyer (niemeyer)]

+1 on the change!

Indeed __getitem__ is preferrable, but the issue is that CPython will look
for __getslice__ even if it's not using it.

[James Henstridge (jamesh)]

I'd add the method to IResultSet, actually. That way it'll apply to EmptyResultSet too.

Other than that, +1 from me.

[Gustavo Niemeyer (niemeyer)]

But the method isn't actually present in either of them, James. We're just allowing
Python to see that the method it should use is __getitem__. If we add it to the
interface we'll have to implement and test it on them too.

[James Henstridge (jamesh)]

Fair enough. In any case, I'd like to see __getslice__ as an allowed attribute on EmptyResultSet if it is allowed on ResultSet.

[Jürgen Kartnaller (jukart)]

I would also prefer the "allow attributes" variant because __getslice__ is not really implemented.
Adding it to the interface would mislead one to use it.
And of course it should then also be added to EmptyResultSet.

[Jamu Kakar (jkakar)]

Merged to trunk [r=jamesh,niemeyer].

[Jamu Kakar (jkakar)]

Oops, apparently I forgot to commit the merge. This is now in
storm/trunk r239.

[James Henstridge (jamesh)]

Fix released in 0.13.