[Zope-dev] Re: Builtins on Zope 2.6.3

[Michael Haubenwallner]

Tres Seaver wrote:
> Christian Theune wrote:
> 
>> Hi,
>>
>> i have the strange feeling that somebody forgot to include the
>> AccessControl.ZopeGuard.safe_builtins for DTML.
>>
>> See DT_Utils.py around line 56 and the corresponding imports as well as
>> the definition of safe_builtins in ZopeGuard.py.
>>
>> Could someone verify this?
> 
> 
> Could you suggest a fragment of DTML which would serve as a test case? 
> Such a fragment would either:
> 
>   - fails if your suspicion is true, but shouldn't?
> 
>   - doesn't fail, but should.
> 

What i found with a fresh 2.6.3-win32 and CMF-1.4.2 was this:

Traceback (innermost last):
   Module ZPublisher.Publish, line 98, in publish
   Module ZPublisher.mapply, line 88, in mapply
   Module ZPublisher.Publish, line 39, in call_object
   Module Products.CMFCore.utils, line 348, in manage_propertiesForm
   Module Shared.DC.Scripts.Bindings, line 261, in __call__
   Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec
   Module App.special_dtml, line 174, in _exec
   Module DocumentTemplate.DT_In, line 703, in renderwob
   Module DocumentTemplate.DT_Let, line 76, in render
   Module DocumentTemplate.DT_Util, line 201, in eval
    - __traceback_info__: select_variable
   Module <string>, line 0, in ?
AttributeError: min

This is in part already mentioned here:
http://zope.org/Collectors/Zope/1169

The bad with the missing "min" is, that it is used in CMF at 
portal_types/{typename}/manage_propertiesForm (OFS/properties.dtml) to 
create the size of the multiple select boxes.
So TTW/ZMI type-property administration is not possible.

-- 
Michael