[Zope] Module security assertions fail

[Josef Albert Meile]

Hi,

sorry if you see this message twice, but I posted it yesterday and didn't 
found it on the list today.

So here goes it again:

I have two packages "TranslationUtils" and "JMZPTMacros", which I want to 
use from a zope product. I have implemented the module and class security 
assertions as indicated on the Zope Developer's Gide, but I got always an 
Unauthorized error (see the traceback attached at the bottom of this 
message).

Here is the structure:

* Some metal macros I want to use with my Products:
MyInstanceHome/Products/JMUtils/JMZPTMacros

* Some calls to the avalaible Translation services:
MyInstanceHome/Products/JMUtils/TranslationUtils

* Zope product, which uses the previous packages:
MyInstanceHome/Products/JMColorPicker

I've had success with JMZPTMacros, but not with TranslationUtils.

Here is what I have done (Please note that I put some extra dashes at the 
begining of the lines, where the indentation is required):

----->Begin of MyInstanceHome/Products/JMUtils/__init__.py

__doc__='''JMUtilities'''
__version__='0.2'

from Products.PythonScripts.Utility import allow_module, allow_class
allow_module('Products.JMUtils')
allow_module('Products.JMUtils.JMZPTMacros')
allow_module('Products.JMUtils.TranslationUtils')

#JMZPTMacros has a class inside. On the contrary,
#TranslationUtils is only a package of functions
from Products.JMUtils.JMZPTMacros import JMZPTMacros
allow_class(JMZPTMacros)

----->End of MyInstanceHome/Products/JMUtils/__init__.py


----->Begin of MyInstanceHome/Products/JMUtils/JMZPTMacros.py

from Products.PageTemplates.PageTemplateFile import PageTemplateFile
from AccessControl import ClassSecurityInfo
import Globals

class JMZPTMacros:
--security=ClassSecurityInfo()
--security.declarePublic()

--security.declarePublic('generic_add')
--generic_add=PageTemplateFile('zpt/generic_add',globals())
--generic_add._owner=None

--#The same was done with the rest of my templates on
--#the zpt directory of JMUtils

# finally
Globals.InitializeClass(JMZPTMacros)

----->End of MyInstanceHome/Products/JMUtils/JMZPTMacros.py


----->Begin of MyInstanceHome/Products/JMUtils/TranslationUtils.py

from AccessControl import ModuleSecurityInfo
security=ModuleSecurityInfo()

security.declarePublic('checkTranslationService')
def checkTranslationService():
--"""Some code comes here

#The same was done for the rest of the functions on this package

#Finally
security.apply(globals())


----->End of MyInstanceHome/Products/JMUtils/TranslationUtils.py

Then I have a manage_add page template with the following line inside:

  <span tal:define="TranslationUtils 
modules/Products/JMUtils/TranslationUtils;">
    Something comes here
  </span>

When I try to add the product on the zope manage interface, I get:

Traceback (innermost last):
  Module ZPublisher.Publish, line 100, in publish
  Module ZPublisher.mapply, line 88, in mapply
  Module ZPublisher.Publish, line 40, in call_object
  Module Products.JMColorPicker.JMColorPicker, line 24, in 
manage_addJMColorPickerForm
  Module Shared.DC.Scripts.Bindings, line 306, in __call__
  Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec
  Module Products.PageTemplates.PageTemplateFile, line 106, in _exec
  Module Products.PageTemplates.PageTemplate, line 96, in pt_render
   - <PageTemplateFile at /temp/JMColorPicker_Add>
  Module TAL.TALInterpreter, line 189, in __call__
  Module TAL.TALInterpreter, line 233, in interpret
  Module TAL.TALInterpreter, line 663, in do_useMacro
  Module TAL.TALInterpreter, line 233, in interpret
  Module TAL.TALInterpreter, line 406, in do_optTag_tal
  Module TAL.TALInterpreter, line 388, in no_tag
  Module TAL.TALInterpreter, line 233, in interpret
  Module TAL.TALInterpreter, line 459, in do_setLocal_tal
  Module Products.PageTemplates.TALES, line 220, in evaluate
   - URL: generic_add
   - Line 20, Column 2
   - Expression: standard:'modules/Products/JMUtils/TranslationUtils'
   - Names:
      {'container': <__FactoryDispatcher__ instance at 9751938>,
       'context': <__FactoryDispatcher__ instance at 9751938>,
       'default': <Products.PageTemplates.TALES.Default instance at 
0x8b337e4>,
       'here': <__FactoryDispatcher__ instance at 9751938>,
       'loop': <SafeMapping instance at 8778eb0>,
       'modules': <Products.PageTemplates.ZRPythonExpr._SecureModuleImporter 
instance at 0x8b47c1c>,
       'nothing': None,
       'options': {'Kind': 'JMColorPicker', 'args': ()},
       'repeat': <SafeMapping instance at 8778eb0>,
       'request': <HTTPRequest, 
URL=https://129.132.39.139:8080/temp/manage_addProduct/JMColorPicker/manage_addJMColorPickerForm>,
       'root': <Application instance at 8999b40>,
       'template': <PageTemplateFile at /temp/JMColorPicker_Add>,
       'traverse_subpath': [],
       'user': admin}
  Module Products.PageTemplates.Expressions, line 201, in __call__
  Module Products.PageTemplates.Expressions, line 189, in _eval
  Module Products.PageTemplates.Expressions, line 145, in _eval
   - __traceback_info__: modules
  Module Products.PageTemplates.Expressions, line 340, in restrictedTraverse
   - __traceback_info__: {'path': ['Products', 'JMUtils', 
'TranslationUtils'], 'TraversalRequestNameStack': []}
Unauthorized: You are not allowed to access 'TranslationUtils' in this 
context


But if I create the following pythonscript (no parameters and return value 
were given):

from Products.JMUtils import TranslationUtils

then I hit the test tab and try again to create an instance of my product, 
it will magically work till zope is restarted. Am I missing something?

Thanks in advanced,
Josef Meile

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*. 
http://join.msn.com/?page=features/featuredemail