accessing the SMI directly if public view access restrictions is set leads to AttributeError instead of authorization

[Clemens Robbenhaar]

Steps to reproduce:

 a) set an access restriction on the Silva Root of
    e.g. "Viewer" (at least not authenticated)
 b) logout or resart the browser
 c) go directly to the SMI without visiting the public view

instead of an authorization popup one gets an error page with
an AttributeError

This has been originally reported by Samuel Schluep in

http://lists.infrae.com/pipermail/silva-dev/2003q4/000870.html

(and earlier by myself in
http://lists.infrae.com/pipermail/silva-dev/2003q2/000168.html
but I did not figure out that the view restriction is an important part
of the puzzle, so nobody has been able to reproduce this :-/ )

Surprisingly this does not cause problems when accessing the SMI
via appending "/edit/tab_edit", only when appending "/edit"

A possible fix is to declare a security restriction on
the "edit" attribute of SilvaObject.
 I have just checked this and it seems to work.

Before I check in anything related to this issue, could please someone
else try to reploduce it?

[Philipp Schroeder (philipp.schroeder)]

Hi Clemens,

We have discovered this bug a couple of weeks ago, but didn't submit it becasue
we couldn't figure out whether it really was a silva bug or something we were
doing wrong with our general zope permission settings!

So yes, I can reproduce this with Silva 0.9.2.5.

[Clemens Robbenhaar (crobbenhaar)]

I am going to check in a fix this evening (not earlier, sorry).

This should fix the issue for Silva-0.9.2 and .3

unfortunately I don't have an operable instance for the tip
of the 0.9.1-branch yet. Is someone else there who could
put in the chnages there?

[Clemens Robbenhaar (crobbenhaar)]

Issue should be fixed on the cvs head
and the 0.9.2 branch

[Samuel Schluep (schluep)]

I have tested the new SilvaObject of the Silva-0.9.2 branch. It is ok. Thanks!

[Joachim Scmitz (js-aixtraware)]

tested with 0.9.3 o.k.

[Joachim Scmitz (js-aixtraware)]

could someone test this with 0.9.1

[Clemens Robbenhaar (crobbenhaar)]

no need to test:
it is not fixed in 0.9.1 if I did not overlooked something

[Joachim Scmitz (js-aixtraware)]

tested with 0.9.2 o.k.

so setting to resolved

[Joachim Scmitz (js-aixtraware)]

forgott to resolve

[Martijn Faassen (faassen)]

> it is not fixed in 0.9.1 if I did not overlooked something

Reviving this one, though I hope we can re-resolve it quickly. It seems the
problem may still persist in 0.9.1? Or did I miss something and was this tested
and resolved as well?

[Clemens Robbenhaar (crobbenhaar)]

no, isn't fixed for 0.9.1.

 a simple 'cvs up -j 1.83.2.3 -j 1.83.2.4 SilvaObject.py'
+ commit on a checkout of the Silva-0_9_1-branch should fix it.

I don't have a running 0.9.1-instance thus I did not do it.

[Clemens Robbenhaar (crobbenhaar)]

Well, this issue _should_ be fixed right now on the 0.9.1-branch, too.

[Kit Blake (kitblake)]

(Old issue cleanup)