def __verifyAcl(self, path, access, parentAcl): """Verify one step in the ACL chain""" if AclConstants.SUPER_USER_GROUP_NAME in self.__aclIdents: return 1 if path in self.__aclCache: t = self.__aclCache[path].get(access) if t == AclConstants.ALLOWED: return if t == AclConstants.DENIED: raise FtServerServerException(Error.PERMISSION_DENIED, level=access, path=path) acl,owner = self.__getResourceAcl(PathImp.QuickCreate(path)) if parentAcl is not None: parentAcl.update(acl) acl = parentAcl if access not in acl and parentAcl is None: testPath = path while 1: if testPath == '/': break #Calculate the parent path testPath = '/'.join(testPath.split('/')[:-1]) if not testPath: testPath = '/' parentAcl,o = self.__getResourceAcl(PathImp.QuickCreate(testPath)) parentAcl.update(acl) acl = parentAcl if access in acl: break cur = acl.get(access,{}) #Resolve any owner ids if AclConstants.OWNER in cur and owner not in cur: cur[owner] = cur[AclConstants.OWNER] #See if we are explicitly disallowed for a in self.__aclIdents: #'world' is an identifier associated with every user if not cur.get(a, 1): self.__setCache(path, access, AclConstants.DENIED) raise FtServerServerException(Error.PERMISSION_DENIED, level=access, path=path) #See if we are allowed for a in self.__aclIdents: if cur.get(a, 0): self.__setCache(path, access, AclConstants.ALLOWED) return acl self.__setCache(path, access, AclConstants.DENIED) raise FtServerServerException(Error.PERMISSION_DENIED, level=access, path=path)