[Zope] change password through script messes up session

[Dieter Maurer]

Laurence Rowe wrote at 2008-10-6 09:52 -0400:
>IIRC CookieCrumbler just stores the username:password on the __ac 
>cookie. You probably need to force it to set another cookie when you 
>change the password, or move to a different implementation like 
>plone.session that uses signed cookies and avoids the requirement to 
>store the password on a cookie.

PAS has a standard method to indicate that credentials have been changed
("updateCredentials" or something like this).

If it is used (and the plugins set up correctly), then the
"Unauthorized" should not happen -- provided the password change
is at an appropriate place (the "updateCredentials" assumes to
be called in the normal request -- not somewhere during traversal).



-- 
Dieter