[Zope] Dieter Mauer's Reference Product

[Brian Brinegar]

Our university relies heavily on a Zope product based on Dieter Maurer's
"Reference" product. Recently, we upgraded from Zope 2.9.6 to Zope
2.11.x and found some changes in behavior.

In short the Reference product creates a Symlink like pointer in the
Zope hierarchy. Dieter's product can be found on his site at:

  http://www.dieter.handshake.de/pyprojects/zope/index.html#bct_sec_5.9

First, the security machinery now prevents access to attributes of
References through page template path notation. For example, the
following fails:

 tal:content="container/MyReference/property_name"

Traceback:
  ...
  * Module zope.tales.expressions, line 217, in __call__
  * Module Products.PageTemplates.Expressions, line 133, in _eval
  * Module zope.tales.expressions, line 124, in _eval
  * Module Products.PageTemplates.Expressions, line 82, in
boboAwareZopeTraverse
  * Module OFS.Traversable, line 301, in restrictedTraverse
  * Module OFS.Traversable, line 232, in unrestrictedTraverse
    __traceback_info__: ([], 'property_name')

Unauthorized: You are not allowed to access 'property_name' in this context

Interestingly, the same access via dot notation works:

  tal:content="python:container.MyReference.property_name

There were substantial changes to Traversable.py between versions which
seem to cause the problem. Any suggestion on how to fix this would be
greatly appreciated.

Second, through path notation or URL traversal, References under the
previous version of Zope would default to using methods / objects within
the target before falling back to acquisition. Under Zope 2.11 acquired
methods/objects take priority (only when traversed).

For example, assuming there is an index_html in the root as well as in
the target, and using the following code:

 tal:content="container/MyReference/index_html/absolute_url_path"

Zope 2.11 yields the path to the acquired index_html:

 /index_html

Zope 2.9.6 yields the path to the index_html in the target:

 /Path/To/Target/index_html

Again, through python, both yield the second, desired output.

I realize this is an obscure product, and the changes seem to have to do
with the Five implementation. At this point we are looking for options
to restore the desired functionality which does not require perpetually
running Zope 2.9.x

One option may be to change everything to dot notation, however I would
at least like to understand why this change occurred.

Thanks for reading,
-- 
Brian Brinegar
Web Services Coordinator
Engineering Computer Network