The bug:
http://zope.org/Collectors/CMF/259

The fix:
http://mail.zope.org/pipermail/zope-checkins/2004-August/028152.html

This effectively changes how acquisition works in restricted Python. I understand this may well be the point <wink>.

The consequences:
Zope sites experiencing seemingly random Unauthorized errors. [1]

I have added tests to the AccessControl suite on 2.7 branch that demonstrate the new behavior. Note that all of them pass in Zope 2.7.2.

What it _appears_ to mean is that when a container denies access, the object security of the acquiree is checked. Therefore, a potential acquiree (read: _any_ object) must make sure to declareObjectProtected or it may end up not being acquirable. This is not always the case in current Zope/CMF/Plone which would explain the Unauthorized errors we see.

Tres, I am happy to discuss this further once you had a look at the tests. I also have tests for the CMF in case you want them.

Stefan

[1]
http://zope.org/Collectors/CMF/318
http://zope.org/Collectors/Zope/1654
http://zope.org/Collectors/Zope/1669
http://plone.org/collector/3682


-- The time has come to start talking about whether the emperor is as well dressed as we are supposed to think he is. /Pete McBreen/

_______________________________________________
Zope-Dev maillist - Zope-Dev@zope.org
http://mail.zope.org/mailman/listinfo/zope-dev
** No cross posts or HTML encoding! **
(Related lists - http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )

Reply via email to