[Zope] security assertions and Python scripts

Mitchell L Model mlm@acm.org
Fri, 21 Sep 2001 17:39:33 -0400


I'm aware that Python scripts (as opposed to Extension methods) do 
not have access to the entire Python library, but I'm confused by the 
following and would appreciate both an explanation and, if it's 
possible, instructions for setting things up so that (during 
development) what I tried to do would be permitted.

At the beginning of one of my Python scripts I put:

	import pdb
	pdb.set_trace()

which I had gotten used to doing in my product's Python code.  It 
doesn't complain about the import (which, in retrospect, surprises 
me, since I thought there were only a small number of library modules 
that could be imported).  However, when it gets to the 
pdb.set_trace(), it prompts for a login name and password (even 
though I'm already logged in) and doesn't accept mine.  When I 
finally cancel out of the repeated login prompts, it gives me the 
following error:

     Site Error

     An error was encountered while publishing this resource.

     Unauthorized

     Access denied for because its container, , has no security assertions.

     ....
     File Script (Python), line 2, in TestScript
         (Object: guarded_getattr)
       File /Zope/zope/lib/python/AccessControl/ZopeGuards.py, line 
122, in guarded_getattr
         (Object: pdb)
       File /Zope/zope/lib/python/AccessControl/SecurityManager.py, 
line 149, in validate
       File 
/Zope/Zope-2.4.0/lib/python/Products/ZDebug/DebugSecurityPolicy.py, 
line 185, in validate


(I don't know why the container is blank.)  In retrospect, I would 
have thought that access would be categorically denied as being 
unsafe from the web.  However, the error message implies that it 
would be allowed if I had the right security assertions set up.  How 
would I do that (if it is indeed possible)?