[Zope] security assertions and Python scripts
Mitchell L Model
mlm@acm.org
Fri, 21 Sep 2001 17:39:33 -0400
I'm aware that Python scripts (as opposed to Extension methods) do
not have access to the entire Python library, but I'm confused by the
following and would appreciate both an explanation and, if it's
possible, instructions for setting things up so that (during
development) what I tried to do would be permitted.
At the beginning of one of my Python scripts I put:
import pdb
pdb.set_trace()
which I had gotten used to doing in my product's Python code. It
doesn't complain about the import (which, in retrospect, surprises
me, since I thought there were only a small number of library modules
that could be imported). However, when it gets to the
pdb.set_trace(), it prompts for a login name and password (even
though I'm already logged in) and doesn't accept mine. When I
finally cancel out of the repeated login prompts, it gives me the
following error:
Site Error
An error was encountered while publishing this resource.
Unauthorized
Access denied for because its container, , has no security assertions.
....
File Script (Python), line 2, in TestScript
(Object: guarded_getattr)
File /Zope/zope/lib/python/AccessControl/ZopeGuards.py, line
122, in guarded_getattr
(Object: pdb)
File /Zope/zope/lib/python/AccessControl/SecurityManager.py,
line 149, in validate
File
/Zope/Zope-2.4.0/lib/python/Products/ZDebug/DebugSecurityPolicy.py,
line 185, in validate
(I don't know why the container is blank.) In retrospect, I would
have thought that access would be categorically denied as being
unsafe from the web. However, the error message implies that it
would be allowed if I had the right security assertions set up. How
would I do that (if it is indeed possible)?