[Zope] wierdness with 2.2, Security, and manage_addProduct[' ']..

[Anthony Baxter]

Ok, this is driving me slightly nutso.

Why won't this work in Zope 2.2? Make a DTML method containing:

<dtml-with "manage_addProduct['ZCatalog']">
  <dtml-call "manage_addVocabulary(id='doofus')">
</dtml-with>

I cannot find a way to make the security system let this through. method
is owned and executed by a user who is a manager, no wierd permissions,
nothing. I get a permission failure trying to look up and access the
'manage_addVocabulary' method.

The example of ZCatalog.Vocabulary is simply chosen because it is a standard
product that is a) a python product, b) using the "new-style" __init__ 
method (as opposed to the ancient one). The actual product I'm seeing
the problem on is a bit more complex, but Vocab will do.

It's been driving me insane for most of this evening - I'm positive 
you _used_ to be able to do stuff like this, and it works when the 
product is a ZClass-based one... 

I've pretty much convinced myself it's a bug in the 2.2 security system...

Anyone? Brian?

Anthony
--
Anthony Baxter     <anthony@interlink.com.au>
It's never too late to have a happy childhood.