[Zope-dev] Possible security problem with DTML

[kosh]

I am having a problem where DTML is allowing access to an attribute of an 
object that restrictedTraverse and regular . notation denies from a python 
script.

I have a python product and I have the securit.setDefaultAccess('deny') so 
that items inside there without security declarations can't be called and 
this works for url traversal, restrictedTraverse and getting to the object 
via python scripts in that access is denied but dtml can get right in which 
is a problem.

Lets say I have container foo with object bar in an and inside bar an object 
which should not be allowed accessed.

<dtml-var "foo.bar.shouldnotwork"> gives the value of shouldnotwork

however

<dtml-var "restrictedTraverse('foo/bar/shouldnotwork')'> gives access denied


and from a python script 

return context.foo.bar.shouldnotwork gives an access denied also which is what 
I expect.

For a ZPT object I get the same result of access being denied for

<span tal:replace="here/foo/bar/shouldnotwork"></span>

Thus I suspect the problem is with DTML somewhere but I am not sure where. 
However I could also be doing something wrong in my python product but 
currently I can no imagine what would allow that dtml to do it but nothing 
else.

The variable shouldnotwork is just a string that is stored in object bar.