moo.core.tests.test_security_queryset.test_acl_enumeration_via_relatedmanager

moo.core.tests.test_security_queryset.test_acl_enumeration_via_relatedmanager(t_init, t_wizard)

get_protected_attribute and safe_getattr check can_caller(‘grant’) before returning the acl RelatedManager on AccessibleMixin instances. Since all verbs run in RestrictedPython, verb code accessing obj.acl as a non-privileged caller gets AccessError instead of the ACL queryset.