...you get an authorization error :-( This is because this Wiki isn't (and shouldn't) be publicly viewable or editable. So, Anonymous doesn't have 'View' permission on the folder. I've given Anonymous 'Access Contents Information', the usual nasty hack I had to do before, but now that just changes the error message :-S (it's in a PS below) I guess the Interfaces Wiki does pretty much this, but RecentChanges works there. What tweaks to permissions and code have been made there? This all stems from the fact that DTML in Wiki code _always_ executes with the Anonymous role. That's stoopid :-( Wouldn't it make more sense for it to execute with whatever Proxy Roles that Wiki Page has? I would code this myself, but I don't know how. Any ideas? Any other thoughts about the problem? cheers, Chris PS: Unauthorized You are not authorized to access getSize Traceback (innermost last): File /mnt/data/2/zope/2-2-2_base/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /mnt/data/2/zope/2-2-2_base/lib/python/ZPublisher/Publish.py, line 187, in publish File /mnt/data/2/zope/2-2-2_base/lib/python/ZPublisher/Publish.py, line 171, in publish File /mnt/data/2/zope/2-2-2_base/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: RecentChanges) File /mnt/data/2/zope/2-2-2_base/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: RecentChanges) File /usr/local/zope/2-2-2_base/lib/python/Products/ZWiki/ZWikiPage.py, line 178, in __call__ (Object: RecentChanges) File /usr/local/zope/2-2-2_base/lib/python/Products/ZWiki/ZWikiPage.py, line 223, in render_htmldtml (Object: RecentChanges) File /mnt/data/2/zope/2-2-2_base/lib/python/OFS/DTMLDocument.py, line 177, in __call__ (Object: RecentChanges) File /mnt/data/2/zope/2-2-2_base/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: RecentChanges) File /mnt/data/2/zope/2-2-2_base/lib/python/DocumentTemplate/DT_In.py, line 691, in renderwob (Object: aq_parent.objectValues(spec='ZWiki Page')) File /mnt/data/2/zope/2-2-2_base/lib/python/DocumentTemplate/DT_Util.py, line 337, in eval (Object: _.getitem('sequence-item').getSize()) (Info: _) File <string>, line 0, in ? File /mnt/data/2/zope/2-2-2_base/lib/python/DocumentTemplate/DT_Util.py, line 140, in careful_getattr File /usr/local/zope/2-2-2_base/lib/python/Products/ZWiki/ZWikiPage.py, line 501, in validate (Object: RecentChanges) Unauthorized: (see above)
On Mon, Sep 25, 2000 at 04:14:03PM +0100, Chris Withers wrote:
...you get an authorization error :-(
This is because this Wiki isn't (and shouldn't) be publicly viewable or editable.
So, Anonymous doesn't have 'View' permission on the folder. I've given Anonymous 'Access Contents Information', the usual nasty hack I had to do before, but now that just changes the error message :-S (it's in a PS below)
I guess the Interfaces Wiki does pretty much this, but RecentChanges works there. What tweaks to permissions and code have been made there?
This all stems from the fact that DTML in Wiki code _always_ executes with the Anonymous role. That's stoopid :-( Wouldn't it make more sense for it to execute with whatever Proxy Roles that Wiki Page has? I would code this myself, but I don't know how. Any ideas?
Any other thoughts about the problem?
I have seen the same problem; the getSize method isn't accessible to RecentChanges, even though the Authenticated User has the View permission. Only when you explicitly give Anonymous the View permission on the Folder (or every individual ZWiki page), will RecentChanges render. This is caused by specific 'safetybelting', implemented by Jim Fulton, to mitigate the risks of ZWikis becoming an easy entry point for a Trojan Horse attack. With the new security policy in Zope 2.2, this is no longer necessary, and you can comment out the restriction. Just remove or comment out the 'validate' method in the file Products/ZWiki/ZWikiPage.py and restart your Zope server. Note that on a pre-2.2 server, this means that any DTML code executed in a ZWiki page will be executed with the rights of the viewer! If you still have problems, make sure that the Owner of the RecentChanges object has rights to 'View' the ZWiki pages. The Interfaces Wiki (and all other Zope.org Wikis) allow Anonymous to View, only Editing and Adding new Wiki pages is restricted. -- Martijn Pieters | Software Engineer mailto:mj@digicool.com | Digital Creations http://www.digicool.com/ | Creators of Zope http://www.zope.org/ ---------------------------------------------
Martijn Pieters wrote:
I have seen the same problem; the getSize method isn't accessible to RecentChanges, even though the Authenticated User has the View permission.
Yup, that's the one...
With the new security policy in Zope 2.2, this is no longer necessary, and you can comment out the restriction. Just remove or comment out the 'validate' method in the file Products/ZWiki/ZWikiPage.py and restart your Zope server.
This is Zope 2.2.1 adn I did. Same problem... :-(
If you still have problems, make sure that the Owner of the RecentChanges object has rights to 'View' the ZWiki pages.
RecentChanges is owned indirectly (through acquisition) by chris (acl_users) I'm a Manager, so I can view the pages... still no joy :-( *sigh* Chris
Chris Withers wrote:
With the new security policy in Zope 2.2, this is no longer necessary, and you can comment out the restriction. Just remove or comment out the 'validate' method in the file Products/ZWiki/ZWikiPage.py and restart your Zope server.
This is Zope 2.2.1 adn I did. Same problem... :-(
Of course, the server was actually running Zope 2.2.2, hence patching 2.2.1 wouldn't help :-S On patching the right copy of ZWikiPage.py, everything works fine... *embarrassed grin* Chris
participants (2)
-
Chris Withers -
Martijn Pieters