-- I am developing a CMF "link" product which defines its own traverse method: def __bobo_traverse__(self, request, name=None): "Traverse method hook" if hasattr(self, name): # return own attributes/subobjects return getattr(self, name) else: t= self.getTarget() if hasattr(t, name): # return target's attributes/subobjects return getattr(t, name) else: return t -- It works fine under the ZMI but when I try to access an object of this product into a CMF portal using the CMF interface, Zope requests me login name and password (even if I am admin!!), which it doesn't accept, so the only way to continue is to cancel instead of triying to log in. Once I click on the cancel button Zope throws the following error: Site Error An error was encountered while publishing this resource. Unauthorized Sorry, a site error occurred. Traceback (innermost last): File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/ZPublisher/Publish.py, line 150, in publish_module File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Products/Localizer/__init__.py, line 65, in new_publish File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/ZPublisher/Publish.py, line 114, in publish File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Zope/__init__.py, line 159, in zpublisher_exception_hook (Object: Link) File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/ZPublisher/Publish.py, line 98, in publish File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/ZPublisher/mapply.py, line 88, in mapply (Object: metadata_edit_form) File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/ZPublisher/Publish.py, line 39, in call_object (Object: metadata_edit_form) File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Shared/DC/Scripts/Bindings.py, line 252, in __call__ (Object: metadata_edit_form) File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Shared/DC/Scripts/Bindings.py, line 283, in _bindAndExec (Object: metadata_edit_form) File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Products/PageTemplates/Expressions.py, line 186, in _eval File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Products/PageTemplates/Expressions.py, line 143, in _eval (Info: here) File /home/Zope/Zope-2.5.1-linux2-x86/lib/python/Products/PageTemplates/Expressions.py, line 339, in restrictedTraverse (Object: Link) (Info: {'path': ['portal_url'], 'TraversalRequestNameStack': []}) Unauthorized: You are not allowed to access portal_url in this context -- I know 'portal_url' is a URLTool at the CMF portal root which my product acquires, so it's like an attribute of this object that Zope or CMF tries to access for some reason. I've also been tracing "restrictedTraverse" in Expressions.py but I couldn't see the information obtained as useful information. Any suggestions/questions? Kind regards.
On Wed, 2002-09-25 at 06:41, Ignacio Dosil Lago wrote:
-- I am developing a CMF "link" product which defines its own traverse method:
def __bobo_traverse__(self, request, name=None): "Traverse method hook"
if hasattr(self, name): # return own attributes/subobjects return getattr(self, name) else: t= self.getTarget() if hasattr(t, name): # return target's attributes/subobjects return getattr(t, name) else: return t
-- It works fine under the ZMI but when I try to access an object of this product into a CMF portal using the CMF interface, Zope requests me login name and password (even if I am admin!!), which it doesn't accept, so the only way to continue is to cancel instead of triying to log in.
I don't know why it would work in the ZMI; this smells like a problem in the way you wrap (or don't) the target object returned by 'getTarget'. Try the following to test that: from Acquisition import aq_base, aq_parent def __bobo_traverse__(self, request, name=None): "Traverse method hook" if hasattr(self, name): # return own attributes/subobjects return getattr(self, name) else: t = self.getTarget() t = aq_base( t ).__of__( aq_parent( self ) ) if hasattr(t, name): # return target's attributes/subobjects return getattr(t, name) else: return t This version addresses the issue that the security machinery expects to crawl up the containment part of the acquisition chain to verify that the user and the accessed object are in proper relation to one another; it does this by ripping off any existing acquisition wrapper (the 'aq_base' call) and re-wrapping the object in the context of the link's parent ( the '__of__' call). Hope this helps, Tres. -- =============================================================== Tres Seaver tseaver@zope.com Zope Corporation "Zope Dealers" http://www.zope.com
participants (2)
-
Ignacio Dosil Lago -
Tres Seaver