[Zope-CMF] Re: manage_pasteObjects - not obeying Proxy?

[Dieter Maurer]

alan runyan writes:
 > ...
 > Is this going to be fixed?  I also tried this in an ExternalMethod and
 > it was complaining inside an External Method (which I thought bypassed
 > *all* security).
It bypasses all direct Zope security, but
"OFS.CopySupport.CopyContainer._verifyObjectPaste" does its own
security checking and is a bit stupid:

  It uses "SecurityManager.checkPermission" (which does not
  take proxy roles into account) instead of a "validate"
  of the "add" action in the destination context.

I expect it could easily be fixed.


Dieter