[ZPatterns] Getting "'Manager' role required" when logged in as Manager traversing into a security-protected Specialist

R. David Murray bitz@bitdance.com
Mon, 29 Oct 2001 18:55:56 -0500 (EST)


Zope 2.3.3, ZPatterns-stevea-20010204

I have a transactions Specialist with a postgres backed rack of
transactions.  I'm trying to protect the transaction info
from prying eyes.  So I go onto the Specialist security tab,
uncheck inherit permissions from View and Access Contents Information,
and check those permissions back on for Manager.  Then I try
to view a method that lists the transactions.  Get a log in
box.  So far so good.

I log in as a manager account.  Get the listing (which requires
calling a method of the Specialist).  The listing has links to
individual transactions.  Click on a link, which causes a
traverse into the Specialist, which should trigger the normal
loading of the ZClass for the transaction and a display using
that ZClass's index_html.

What I get is Zope's hardcoded error page, and in the stupid log I see:

  Unauthorized: User Anonymous User is not allowed to access /store/transactions/June14, which is contained in /store/transactions/June14. The user, whose roles are ('Anonymous',), would need to have one of the following roles: ('Manager', 'webmaster').

I don't get this at all, since Netscape should be sending the auth
credentials, and if it's not a login box should pop up, but it doesn't.
(By the way, Netscape 4.77 and w3m both give the same result here).

Just for fun I tried putting back just one of either View or
Access Contents Info.  In either case, I got the same result, except
that the error message changed to an error on

  /store/transactions/June14/calcLineItemTotal

which is a method on the ZClass.

Any clues?  I'm assuming this is a ZPatterns issue, but I could be
wrong <grin>.  I can't remember exactly why I'm running the ZPatterns
version I'm running, so if someone wants to recommend a better
version to run with Zope 2.3.3, I'll try it.

--RDM