Hi all again, We have been written last week about some attribute permission problems with Zope 2.7.3 beta due to a patch applied by Tres. First of all, Tres, apologies for my too fast written test case and my too late test of Zope 2.7.3. Now, with some more time, I've tested and debugged on Zope 2.7.3 and found exactly what's happen. Supose we have a structure of objects like this: A.__of__(B) "A" inherits from Acquisition.Implicit, has security assertions, but has not __allow_access_to_unprotected_subojects__ We want to access, from a Zope Page Template, an attribute of "B" that is not present in "A" Accessing B.our_attribute attribute works fine. But accessing A.__of__(B).our_attribute fails, and should work. The problem is the call to "validate" done in "guarded_getattr" method of ImplPython.py. The actual call is "if validate(inst, inst, name, v)", but the validate function says: Arguments: accessed -- the object that was being accessed container -- the object the value was found in name -- The name used to access the value value -- The value retrieved though the access. roles -- The roles of the object if already known. Now, "accessed" and "container" are always the same, and in some cases should be different. I attach a patch to solve this case that works for me. I'm not sure if my code is the best way to solve the problem but, as I said, it seems to work fine. Of course, If the patch is accepted, the same change should be done in the C version. Thanks Santi Camps http://www.earcon.com --- ImplPython.py 2004-08-07 19:15:48.000000000 +0200 +++ /usr/local/zope273/lib/python/AccessControl/ImplPython.py 2004-10-29 10:56:11.000000000 +0200 @@ -534,6 +534,12 @@ # exceptions are caught early. try: v = getattr(inst, name) + container = inst + while hasattr(container,'aq_explicit') and \ + not(hasattr(container.aq_explicit, name)) and \ + hasattr(container, 'aq_parent'): + # Find real container when attribute is acquired + container = container.aq_parent except AttributeError: if default is not _marker: return default @@ -551,6 +557,6 @@ return v validate = SecurityManagement.getSecurityManager().validate - if validate(inst, inst, name, v): + if validate(inst, container, name, v): return v raise Unauthorized, name