# HG changeset patch
# User Paul Boddie <paul@boddie.org.uk>
# Date 1358642700 -3600
# Node ID ed5637d0675c27f6f0e3508b61ae3228dbf0fa6d
# Parent  5187550c11de735a5f735662c831d2bb02f84a48
Added read permission checking for item store access operations.

diff -r 5187550c11de -r ed5637d0675c MoinSupport.py
--- a/MoinSupport.py	Sun Jan 20 01:13:24 2013 +0100
+++ b/MoinSupport.py	Sun Jan 20 01:45:00 2013 +0100
@@ -894,6 +894,16 @@
         user = self.page.request.user
         return user and user.may.write(self.page.page_name)
 
+    def can_read(self):
+
+        """
+        Return whether the user associated with the request can read from the
+        page owning this store.
+        """
+
+        user = self.page.request.user
+        return user and user.may.read(self.page.page_name)
+
     # High-level methods.
 
     def append(self, item):
@@ -905,4 +915,25 @@
 
         ItemDirectoryStore.append(self, item)
 
+    def __len__(self):
+
+        """
+        Return the number of the next item (which should also be the number of
+        items).
+        """
+
+        if not self.can_read():
+            return 0
+
+        return ItemDirectoryStore.__len__(self)
+
+    def __getitem__(self, number):
+
+        "Return the item with the given 'number'."
+
+        if not self.can_read():
+            raise IndexError, number
+
+        return ItemDirectoryStore.__getitem__(self, number)
+
 # vim: tabstop=4 expandtab shiftwidth=4