[Zope-CMF] Manager gets Unauthorized from Zclass portal content and ZPT with Parsed XML

[Brad Clements]

This may be a bug..

I had a zclass with a few methods.

One of the methods is a DTML Document that uses a Parsed XML document (which 
also a method of the zclass) to dynamically generate javascript output.

A higher level ZPT calls the DTML Document.

When I used this class instance as just a ZClass, it worked fine.

However I've rebased the zclass to be based on ZObject, _ZClass_for_PortalContent, 
_ZClass_for_DefaultDublinCoreImpl .

Now, when logged into the CMF as manager (i'm defined in the root level acl_users), I 
get an Unauthorized exception when trying to traverse the DOM in the ParsedXML doc 
within the DTML Document called from the ZPT in the zclass instance.

Anyone have any ideas how to track this down? Also the same exception occurs if I 
change the DTML Document to a DTML Method

Versions

Zope 2.3.3 on RH Linux 7.1 

Page Templates 1.3.2

CMF-1.1  (says beta in version.txt that's a release bug I think)

ParsedXML 1.1b1

Here are some fragments.

-- the players --

CategoriesToJava  (DTML Method or Document fails either way)

Edit (Page Template)

Product Categories (Parsed XML)

-- some code --

Page Template (Edit)

<span tal:replace="structure  here/standard_html_header" />
<p tal:replace="structure here/CategoriesToJava"></p>
<p tal:replace="structure here/FormJavaScript"></p>

 snip ...

DTML Method (CategoriesToJava)

<dtml-in "ProductCategories.getElementsByTagName('Category')">


And the exception traceback

   Site Error
An error was encountered while publishing this resource. 

Unauthorized

You are not authorized to access ProductCategories. 
Traceback (innermost last):
  File /usr/holmes/AdkWood/lib/python/ZPublisher/Publish.py, line 223, in publish_module
  File /usr/holmes/AdkWood/lib/python/ZPublisher/Publish.py, line 187, in publish
  File /usr/holmes/AdkWood/lib/python/ZPublisher/Publish.py, line 171, in publish
  File /usr/holmes/AdkWood/lib/python/ZPublisher/mapply.py, line 160, in mapply
    (Object: Edit)
  File /usr/holmes/AdkWood/lib/python/ZPublisher/Publish.py, line 112, in call_object
    (Object: Edit)
  File /usr/holmes/AdkWood/lib/python/Shared/DC/Scripts/Bindings.py, line 324, in __call__
    (Object: Edit)
  File /usr/holmes/AdkWood/lib/python/Shared/DC/Scripts/Bindings.py, line 354, in _bindAndExec
    (Object: Edit)
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/ZopePageTemplate.py, line 244, in _exec
    (Object: Edit)
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/PageTemplate.py, line 156, in pt_render
    (Object: Edit)
    (Info: {'container': <CompanyProduct instance at 87f0768>,
 'here': <CompanyProduct instance at 87f0768>,
 'modules': <Products.PageTemplates.ZPythonExpr._SecureModuleImporter instance at 8587098>,
 'nothing': None,
 'options': {'args': ()},
 'request': <h3>form</h3><table></table><h3>cookies</h3><table><tr valign="top" align="left"><th>zmi_use_css</th><td>'1'</td></tr><tr valign="top" align="left"><th>sql_pref__cols</th><td>'75'</td></tr><tr valign="top" align="left"><th>zmi_top_frame</th><td>'1'</td></tr><tr valign="top" align="lef
 'root': <Application instance at 87ffae8>,
 'template': <ZopePageTemplate instance at 8b69bf0>,
 'traverse_subpath': [],
 'user': bkc})
  File /usr/holmes/Zope-2.3.3/lib/python/TAL/TALInterpreter.py, line 232, in __call__
  File /usr/holmes/Zope-2.3.3/lib/python/TAL/TALInterpreter.py, line 265, in interpret
  File /usr/holmes/Zope-2.3.3/lib/python/TAL/TALInterpreter.py, line 503, in do_insertStructure_tal
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/TALES.py, line 283, in evaluate
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/Expressions.py, line 213, in __call__
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/Expressions.py, line 210, in _eval
    (Info: here)
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/Expressions.py, line 146, in render
    (Object: CategoriesToJava)
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/ZPythonExpr.py, line 134, in call_with_ns
    (Object: CategoriesToJava)
  File /usr/holmes/Zope-2.3.3/lib/python/OFS/DTMLMethod.py, line 182, in __call__
    (Object: CategoriesToJava)
  File /usr/holmes/Zope-2.3.3/lib/python/DocumentTemplate/DT_String.py, line 540, in __call__
    (Object: CategoriesToJava)
  File /usr/holmes/Zope-2.3.3/lib/python/DocumentTemplate/DT_In.py, line 655, in renderwob
    (Object: ProductCategories.getElementsByTagName('Category'))
  File /usr/holmes/Zope-2.3.3/lib/python/DocumentTemplate/DT_Util.py, line 333, in eval
    (Object: ProductCategories.getElementsByTagName('Category'))
    (Info: ProductCategories)
  File /usr/holmes/Zope-2.3.3/lib/python/Products/PageTemplates/ZPythonExpr.py, line 124, in validate
    (Object: DynamicType)
  File /usr/holmes/AdkWood/lib/python/AccessControl/SecurityManager.py, line 144, in validate
  File /usr/holmes/AdkWood/lib/python/AccessControl/ZopeSecurityPolicy.py, line 225, in validate
Unauthorized: (see above)



--------------------------------------------------------------------------------

Troubleshooting Suggestions

The URL may be incorrect. 
The parameters passed to this resource may be incorrect. 
A resource that this resource relies on may be encountering an error. 
For more detailed information about the error, please refer to the HTML source for this page. 

If the error persists please contact the site maintainer. Thank you for your patience. 
 



Brad Clements,                bkc@murkworks.com   (315)268-1000
http://www.murkworks.com                          (315)268-9812 Fax
netmeeting: ils://ils.murkworks.com               AOL-IM: BKClements