[Zope-dev] aq_.* names reserved?

[Dieter Maurer]

Steve Alexander writes:
 > I'm hacking around with some external methods called aq_containment and
 > aq_context.
 > 
 > I just found out that I can't call them from DTML. I can call them from
 > the URL line of a browser just fine.
 > 
 > If I rename them to a_containment and a_context, they work from DTML.
 > 
 > I guess there's something in Acquisistion.c that reserves all aq_.*
 > names.
The code is in "AccessControl.ZopeSecurityPolicy.validate".
It allows access to "aq_explicit" and "aq_parent" only.

I am a bit astonished that URL traversal is possible.
Probably, this was not intended.



Dieter