[Zope-dev] Authorization failure

[Rik Hoekstra]

sander@innominate.de wrote:
> 
> Hi there !
> 
> I found a strange behaviour in Zope yesterday. I have the following
> contruction in an HTML - Object :
> 
>  <dtml-if "feldname == 'Freikonto'">
>      <dtml-call "REQUEST.set('freikonto', feldwert)">
>  <dtml-elif "feldname == 'Konto'">
>      <dtml-call "REQUEST.set('konto', feldwert)">
>  </dtml-if>
> 
> Now the "feldname == 'Freikonto'" clause isn't necessary anymore.
> So I thought I just comment this section. The result would look
> like this:
> 
> <dtml-comment>
>  <dtml-if "feldname == 'Freikonto'">
>      <dtml-call "REQUEST.set('freikonto', feldwert)">
>  </dtml-comment>
>  <dtml-if "feldname == 'Konto'">
>      <dtml-call "REQUEST.set('konto', feldwert)">
>  </dtml-if>
> 
> If I try to save these changes, Zope complains, that I'm not
> authorized although I'm superuser and have all rights.
> 
> But if I delete this lines instead commenting them, it works.
> 
> Really strange.
> 
> Any ideas ? Thanks.
> 

Hm, I believe, you have to close the <dtml-if> block even if it's in a
<dtml-comment>. It shouldn't but it does, this was discussed recently on
the list. THe unauthorized sometimes comes up when a dtml method is in
fault. THis is also strange, but a fact of life ;-). THis added up
accounts for your strange behaviour

Rik