Kozea/Radicale — pull request #100 by chripo (2014-01-15 23:00:30+00:00)
Title: Fix access

under certain conditions it was possible to pass the final access control if-clause.
the master branch grants access if:

```python
if ((read_allowed_items or write_allowed_items)
and (not user or auth.is_authenticated(user, password))) or \
function == self.options or not items:
# Collections found, or OPTIONS request, or no items at all
```
the easy-connect branch from pull request #99 extends it with:

```python
(is_authenticated and function == self.propfind) or \
```

the last `or not items` condition levers out the previous authentication and access control. that isn't that big secuity issue because in this case there are no collection and items at all. but "bad" and anonymous users could gather data and information which not destined for them.

the first commit 1778dcb simplifies the if-clause to:

```python
is_valid_user = is_authenticated or not user

if is_valid_user and ( \
(read_allowed_items or write_allowed_items) or \
is_authenticated or \
function == self.options):
```

the second commit 4b8f4a9 is an improvement, it gathers items for valid user only.