[Zope-dev] Re: 2.7.3 beta attribute permission problems

[Tres Seaver]

Santi Camps wrote:

> Here you are a test case for that problem.   It's a very simple case of 
> what my framework does.
> 
> How to proceed:
> 1) Install the product in a Zope 2.7.3 beta
> 2) Add an instance of meta type "AccessControl Test"
> 3) Try http://localhost:8080/AccessControlTest/get_sum_of_values.  It 
> works fine (is a method of Test class)
> 4) Try http://localhost:8080/AccessControlTest/get_product_of_values.  
> It also works fine  (is a method of Adapter class)
> 5) Try http://localhost:8080/AccessControlTest/crashing_test (is a ZPT 
> trying to access previous methods).  It crashes !!
> *
> Error Type: Unauthorized*
> *Error Value: The container has no security assertions Access to 
> 'get_sum_of_values' of (Adapter instance at 40ae6ac0) denied.*
> 
> Obviously, this is not a reasonable behaviour.   If I can access those 
> methods directly from an URL, I should be able to do it from a ZPT.
> 
> Doing the same on Zope 2.7.2 works fine.

To make this a useful test case, I need the product which implements the 
"AccessControl Test" objects.  Even better would be able to reproduce 
the behviour using a minimal "dummy" class.

Tres.
-- 
===============================================================
Tres Seaver                                tseaver at zope.com
Zope Corporation      "Zope Dealers"       http://www.zope.com