[Zope3-Users] Re: zope.ManageContent Permission on field descriptions?

[Andreas Elvers]

Hi,

Hey... stripping the app down to nearly nothing helped to find a hint.
And I lied... in the example below I ask getFieldsInOrder for IPerson
which I imported in the same file.

 > from zope import schema
 > from schematesting.interfaces import IPerson
 >
 > class Details(object):
 >     def getDetails(self):
 >         fields = schema.getFieldsInOrder(IPerson)
 >         data = dict([(i,getattr(self.context,i,None))
 >                      for i in schema.getFieldNamesInOrder(IPerson)])
 >         return {'fields':fields,
 >                 'data':data}
 >

Let's say I define a class variable schema in the content object:

class Person(object):
     schema = IPerson

and make the details view a bit more flexible like this:
     def getDetails(self):
          fields = schema.getFieldsInOrder(self.context.schema)

In this case the field description attributes are only accessible with the
permission zope.ManageContent.

I suspect this is a wanted behavior for security reasons ?

Thanks for any insights,
- Andreas