[Zope] ZWiki RecentChanges don't work in Zope 2.2.x

[Martijn Pieters]

On Mon, Sep 25, 2000 at 04:14:03PM +0100, Chris Withers wrote:
> ...you get an authorization error :-(
> 
> This is because this Wiki isn't (and shouldn't) be publicly viewable or
> editable.
> 
> So, Anonymous doesn't have 'View' permission on the folder. I've given
> Anonymous 'Access Contents Information', the usual nasty hack I had to
> do before, but now that just changes the error message :-S (it's in a PS
> below)
> 
> I guess the Interfaces Wiki does pretty much this, but RecentChanges
> works there. What tweaks to permissions and code have been made there?
> 
> This all stems from the fact that DTML in Wiki code _always_ executes
> with the Anonymous role. That's stoopid :-(
> Wouldn't it make more sense for it to execute with whatever Proxy Roles
> that Wiki Page has?
> I would code this myself, but I don't know how. Any ideas?
> 
> Any other thoughts about the problem?

I have seen the same problem; the getSize method isn't accessible to
RecentChanges, even though the Authenticated User has the View permission.
Only when you explicitly give Anonymous the View permission on the Folder
(or every individual ZWiki page), will RecentChanges render.

This is caused by specific 'safetybelting', implemented by Jim Fulton, to
mitigate the risks of ZWikis becoming an easy entry point for a Trojan
Horse attack. 

With the new security policy in Zope 2.2, this is no longer necessary, and
you can comment out the restriction. Just remove or comment out the
'validate' method in the file Products/ZWiki/ZWikiPage.py and restart your
Zope server. Note that on a pre-2.2 server, this means that any DTML code
executed in a ZWiki page will be executed with the rights of the viewer!

If you still have problems, make sure that the Owner of the RecentChanges
object has rights to 'View' the ZWiki pages.

The Interfaces Wiki (and all other Zope.org Wikis) allow Anonymous to
View, only Editing and Adding new Wiki pages is restricted.

-- 
Martijn Pieters
| Software Engineer  mailto:mj@digicool.com
| Digital Creations  http://www.digicool.com/
| Creators of Zope   http://www.zope.org/
---------------------------------------------