Cannot call "manage_copyObjects" from script with proxy roles

[Chris McDonough]

Script has proxy-role for manager and is called by anonymous:

id='foo'
clip=context.manage_copyObjects([id])
context.manage_pasteObjects(cb_copy_data=clip)

Error-message:

"The action against the id object could not be carried out. One of the following constraints caused the problem:

The object does not support this operation.

 -- OR --

The currently logged-in user does not have the Copy or Move permission respective to the object. "

"You are not authorized to access this resource."

[Dieter Maurer (d.maurer)]

patch (attachment leads to
insufficient privileges)

--- CopySupport.py~ 2003-06-10 09:10:14.000000000 +0200
+++ CopySupport.py 2003-11-13 14:40:08.000000000 +0100
@@ -23,6 +23,11 @@
 from zExceptions import Unauthorized
 from AccessControl import getSecurityManager

+# for "_verifyObjectPaste" fix
+from Globals import InitializeClass
+from Acquisition import Implicit
+from AccessControl import ClassSecurityInfo
+
 CopyError='Copy Error'

 _marker=[]
@@ -335,7 +340,15 @@
                 break

         if mt_permission is not None:
- if getSecurityManager().checkPermission( mt_permission, self ):
+ # DM: the following does not take executable security (owner
+ # ship, proxy roles) into account.
+ #if getSecurityManager().checkPermission( mt_permission, self ):
+ class _Proxy(Implicit):
+ security= ClassSecurityInfo()
+ _Proxy.security.declareObjectProtected(mt_permission)
+ InitializeClass(_Proxy)
+ _proxy= _Proxy().__of__(self)
+ if getSecurityManager().validate(None,self,None,_proxy):
                 if not validate_src:
                     return
                 # Ensure the user is allowed to access the object on the

[Andreas Jung (ajung)]

This patch applies only to the 2.6 branch but it can not
be applied to the 2.7 branch since the code there is
different.

-aj

[Tres Seaver (tseaver)]

Needs reverification on a modern Zope.

[Jens Vagelpohl (dataflake-deactivatedaccount-deactivatedaccount)]

This issue has been fixed along the way, I can run the example script without issues on Zope 2.12.8dev and get a copied instance in the ZODB.