[Zope3-dev] ForbiddenAttribute error using vocabulary

[Fred L. Drake, Jr.]

Garrett Smith writes:
 > setField is being accessed on a SelectListWidget object at line 89 of
 > zope/app/browser/form/vocabularywidgets.py. The view declaration for the
 > field in question is:
...
 > setField doesn't fall under this permission...I can't see how this ever
 > worked :(

Much of the vocabulary work was done in an internal Zope 2 + Zope 3
environment, so that's how such a thing came to be.  The Zope 3
security machinery was not being used in that environment.

The unit tests clearly aren't strong enough, or this would have been
caught.  ;-(

I'll take a look at fixing this.  If you'd like to write the necessary
unit tests, I'd certainly appreciate it!


  -Fred

-- 
Fred L. Drake, Jr.  <fred at zope.com>
PythonLabs at Zope Corporation