[Zope-CMF] Re: manage_pasteObjects - not obeying Proxy?
Thu, 19 Sep 2002 19:36:53 +0200
alan runyan writes:
> Is this going to be fixed? I also tried this in an ExternalMethod and
> it was complaining inside an External Method (which I thought bypassed
> *all* security).
It bypasses all direct Zope security, but
"OFS.CopySupport.CopyContainer._verifyObjectPaste" does its own
security checking and is a bit stupid:
It uses "SecurityManager.checkPermission" (which does not
take proxy roles into account) instead of a "validate"
of the "add" action in the destination context.
I expect it could easily be fixed.