[Zope-CMF] Re: odd __roles__ behavior in certain CMF tools

[Gary Poster]

From: "Tres Seaver" <tseaver@zope.com>

> Can you describe the problem which the absence of '__roles__'
> in the class dictionary causes?
>
> Tres.

Thanks, Tres.  Yes, adding those lines to the problematic CMF tools solved
my product's problem.  Thanks for the pointer.  Now I wonder if it would be
a big deal to make the tools public (or with ['Manager', 'Anonymous'] as the
folder-based tools are listed) in the actual CMF distribution.

The context in which this was an issue was
Products.PageTemplates.Expressions.restrictedTraverse.  When a zpt requests,
for instance
tal:define="utool nocall:here/portal_url"
then the zpt uses restricted traverse to find the portal_url tool.
portal_url doesn't have a __roles__, as we've discussed, and the
Expressions.py restrictedTraverse doesn't send along a container associated
with it in the call to securityManager.validate.
AccessControl.ZopeSecurityPolicy.ZopeSecurityPolicy then doesn't have
__roles__ anywhere, and bails.

This obviously isn't a problem with the normal cmf zpt functionality, and to
be honest I'm not sure why not.  The security policy clearly requires a
__roles__ somewhere, and there's not a container passed along to help the
__role__-less CMF tools out.  And yet it doesn't break under normal
circumstances.

The product I'm working on, among other things, allows functionality similar
to a TransparentFolder, taken a step further.  It is an Alias component in
my VirtualHostFolder product.  For any given virtual host, it can insert
itself in the traversal path, so that, for that host only, an alias to
another part of your Zope tree can be inserted.

For instance, if I have a folder at /cmf_instance/a_folder and content in a
folder elsewhere, let's say at /someplace_else/subfolder/content_folder,
then I can create an alias that will appear to a given virtual host to be in
/cmf_instance/a_folder and that will appear to contain the content at
/someplace_else/subfolder/content_folder.  Thus,
/cmf_instance/a_folder/my_alias_name/index_html will produce the index_html
actually found at /someplace_else/subfolder/content_folder/index_html, but
all of the dynamically generated links will treat the fake alias path as the
real McCoy (kinda like what the VirtualHostMonster does to keep links in
line when the virtual root is not the zope root).

If I place a zpt in /someplace_else/subfolder/content_folder that uses a zpt
in a cmf-skin-understandable format (like using
metal:use-macro="here/main_template/macros/master" in the remote zpt) *then*
I get these errors.

Fairly odd, I know, but very useful functionality, and I'm not sure what the
advantage to not having a __roles__ definition is for those particular cmf
tools.

Um.

Did I convince you to add them?  :)  Anything else I can tell ya?

In any case, thanks again.

Gary