[Zope] Monkey Patching Grief with Zope 2.9.4

[Mark Wilson]

Hello Zope Listers

We've been working on a Zope web app which has been built and running on Zope 
2.7.0 for over 2 years now. Recently I've been trying to move it to Zope 
2.9.4 but have encountered some severe difficulties with a couple (at least) 
of monkey patches that are essential to our app and which worked fine with 
the earlier version.

Here's a synopsis of what I'm doing (PF2 is the code name of the app)

#--------------------------------------------------------------------

from AccessControl.User import SpecialUser 

class PF2SpecialUser( SpecialUser ):
    """ a "pretend" subclass of SpecialUser """

    def PF2SpecialUser_allowed( self, object, object_roles=None ):
        """ reimplementation of allowed() for PF2 """

                    # if we're not anon, we must be superuser, so do the
                    # normal SpecialUser.allowed() stuff (see patching below)
        if self.getUserName() != 'Anonymous User':
            return self.PF2Superuser_allowed( object, object_roles )

                    # else we're anonymous - do our special handling which
                    #    basically allows the anonymous role to be assigned
                    #    arbitrary perms at any point in the folder hierarchy

	# more code here - return True if anon user can access object



# now the monkey patching - ooh ooh eeeek ooh

                    # save original method for use by superuser 
                    #    (see PF2SpecialUser.PF2SpecialUser_allowed)
    PF2SpecialUser.PF2Superuser_allowed = SpecialUser.allowed
                    # replace with our custom method
    SpecialUser.allowed = PF2SpecialUser.PF2SpecialUser_allowed

#--------------------------------------------------------------------

As I said, with 2.7.0 this all works fine and dandy, but with 2.9.4 I get this 
error when trying to access (say) a Page Tempplate as the anonymous user:

"unbound method PF2SpecialUser_allowed() must be called with PF2SpecialUser 
instance as first argument"

Investigating in more detail, I switched to the Python security 
implementation. As an experiment, based on research, I changed line 437 of 
AccessControl/ImplPython.py from...

            if self._authenticated and context.user.allowed(value, roles):

to...

            if self._authenticated and \ 
                  context.user.allowed.im_func(context.user, value, roles):

to sidestep the type checking of the self argument. This does indeed prevent 
the above error, but its not a good solution at all (its not in C), and I'm 
sure its incomplete - there are other places where allowed() gets called.

Has anyone got any smart ideas as to how I can accomplish my goal with Zope 
2.9.4 and with minimal changes to our code? If its necessary I'm happy for us 
to run with minor modifications to "core" zope (we already have one or two in 
place already).

Also, if anyone can tell me exactly what it is that's caused this new 
behaviour then I'd be really grateful since I've not been able to figure it 
out myself.

Thanks in advance for any help anyone can offer.

Mark