[Zope] What happens to acquisition when creating new permissions?

[Andy Smith]

Hi All,

I'm in the middle of changing the security handling on the Guestbook product
I submitted to the site not too long ago.

I now have a situation where I have a product (Guestbook), which adds and
manages sub-objects (GuestBookEntry). The permission 'Add Entry', instead of
being a permission of the enclosing folder, is now a permission associated
with the Guestbook. In the manage screen, a newly-created product instance
has the 'Acquire' box set, but doesn't have the 'Add Entry' permission
granted to any roles ('Anonymous' or 'Manager').

When the acquire box is ticked, I can add entries in a fresh browser without
having to enter any authentication info, even with no roles granted the
appropriate permission, so it seems as if the 'Add Entry' permission is
being acquired from somewhere, even tho no-one further up the chain has this
permission to acquire.

If I deselect the 'Acquire' box, I'm now get the authentication dialogue
when I try to add entries, and I have to grant the 'add entry' permission to
diferent roles if I want them to add entries. (i.e. this is the behaviour I
was kind of expecting when the acquire box was checked!).

Cheers,

Andy.