Hi Curtis,

Sorry for the late reply, I've been on holiday :S

Curtis Matthews wrote:
> I've just recently noticed I'm not able to call the JumpSearch and
> RecentChanges methods in the Basic ZWiki because I'm not authorized to call
> a method called aq_parent. Has anyone else had this problem, and is there a
> solution?

This is a 'feature' of ZWiki according to Simon Michael, it's author, I
think it's a bug ;-)

Basically, ZWiki Pages (RecentChanges is a ZWiki Page) execute DTML
contained in themselves with the 'Anonymous' role, supposedly as a
security precaution.
This means that 'Anonymous' must have the 'Access Contents Information'
permission for RecentChanges and several other things to work.

This makes it practically impossible to have a Wiki that is secure :/

This is a hard problem to solve, see Jim Fulton's server side trojan
stuff for a detailed discussion. I don't like the current solution, it's
A better, but not best ;-), solution would be to make ZWiki pages
execute with any proxy roles they have and only those roles, or even
have a seperate 'This Wiki Page has these roles' configuration box.

A workaround would be to make RecentChanges a DTML method rather than a
ZWiki page. You should just be able to copy and paste the contents.



Zope maillist  -  [EMAIL PROTECTED]
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-dev )

Reply via email to