fix & document setImplementation semantics

lib/python/AccessControl/Implementation.py

@@ -31,12 +31,18 @@ def getImplementationName():
 
 
 def setImplementation(name):
-    """Select the policy implementation to use.
-
-    'name' must be either 'PYTHON' or 'C'.
+    """Select the policy implementation to use. The 'name' must be either
+       'PYTHON' or 'C'. NOTE: this function is intended to be called
+       exactly once, so that the Zope config file can dictate the policy
+       implementation to be used. Subsequent calls to this function will
+       have no effect!!
     """
     import sys
     global _implementation_name
+    global _implementation_set
+
+    if _implementation_set:
+        return
 
     name = name.upper()
     if name == _implementation_name:
@@ -57,8 +63,10 @@ def setImplementation(name):
         if hasattr(mod, "initialize"):
             mod.initialize(impl)
 
+    _implementation_set = 1
 
 _implementation_name = None
+_implementation_set = 0
 
 _policy_names = {
     "AccessControl": ("setDefaultBehaviors",

lib/python/AccessControl/tests/testImplementation.py

@@ -37,17 +37,27 @@ class AccessControlImplementationTest(unittest.TestCase):
     def tearDown(self):
         setImplementation(self.original)
 
-    def test_setImplemenationC(self):
-        setImplementation("C")
-        name = getImplementationName()
-        if self.have_cAccessControl:
-            self.assertEqual(name, "C")
-        else:
-            self.assertEqual(name, "PYTHON")
+## Note - this test is disabled because the intent for 2.7 was *not*
+## to support the ability to arbitrarily switch the security policy
+## at any time (which would currently be nearly impossible to do in
+## a way that would be sane for 3rd party apps that may already have
+## imported parts of the security machinery), but just to make sure
+## that the config file could be used to initially set the implementation
+## to be used. The policy setting is 'initialize once' - setImplementation
+## should not be called either by user code or unit tests, as the
+## effects are officially undefined.
+        
+##     def test_setImplemenationC(self):
+##         setImplementation("C")
+##         name = getImplementationName()
+##         if self.have_cAccessControl:
+##             self.assertEqual(name, "C")
+##         else:
+##             self.assertEqual(name, "PYTHON")
 
-    def test_setImplemenationPython(self):
-        setImplementation("Python")
-        self.assertEqual(getImplementationName(), "PYTHON")
+##     def test_setImplemenationPython(self):
+##         setImplementation("Python")
+##         self.assertEqual(getImplementationName(), "PYTHON")
 
 
 def test_suite():