[ZCM] [ZC] 2190/ 3 Resolve "using browsermenu in z2.10 causes z3 security error"

Issue #2190 Update (Resolve) "using browsermenu in z2.10 causes z3 security error"
 Status Resolved, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2190

==============================================================
= Resolve - Entry #3 by philikon on Jan 8, 2007 12:34 pm

 Status: Accepted => Resolved

This has been fixed in Five 1.5 (r71815, 71818) and trunk (r71820) as well as Zope 2.10 (r71819) and trunk (r71821).
________________________________________
= Assign - Entry #2 by philikon on Sep 11, 2006 6:17 pm

 Status: Pending => Accepted

 Supporters added: philikon

Five used to marry Zope 2's AccessControl and the Zope 3 security system by applying a FiveSecurityPolicy in the Zope 3 world (which would feed back to the Zope 2 Security Manager). It did that by calling Five.security.newInteraction() during traversal.

Now that the whole traversal machinery has been incorporated into the ZPublisher, the ZPublisher should start and end those "compatibility interactions" whenever a new request is started and ended (the calls should probably be close to where the ZODB transactions are committed).
________________________________________
= Request - Entry #1 by hazmat on Sep 11, 2006 5:39 pm

trying to access a menu in zope 2.10 causes an error from a failed z3 security test, due to no interaction present in request. this works fine in zope 2.9

Traceback (innermost last):
  Module ZPublisher.Publish, line 115, in publish
  Module ZPublisher.mapply, line 88, in mapply
  Module ZPublisher.Publish, line 41, in call_object
  Module ore.library.browser.directory, line 110, in __call__
  Module zope.formlib.form, line 752, in __call__
  Module zope.formlib.form, line 746, in render
  Module Shared.DC.Scripts.Bindings, line 313, in __call__
  Module Shared.DC.Scripts.Bindings, line 350, in _bindAndExec
  Module Products.PageTemplates.PageTemplateFile, line 121, in _exec
  Module Products.PageTemplates.PageTemplate, line 89, in pt_render
  Module zope.pagetemplate.pagetemplate, line 117, in pt_render
  Module zope.tal.talinterpreter, line 271, in __call__
  Module zope.tal.talinterpreter, line 346, in interpret
  Module zope.tal.talinterpreter, line 891, in do_useMacro
  Module zope.tal.talinterpreter, line 346, in interpret
  Module zope.tal.talinterpreter, line 536, in do_optTag_tal
  Module zope.tal.talinterpreter, line 521, in do_optTag
  Module zope.tal.talinterpreter, line 516, in no_tag
  Module zope.tal.talinterpreter, line 346, in interpret
  Module zope.tal.talinterpreter, line 861, in do_defineMacro
  Module zope.tal.talinterpreter, line 346, in interpret
  Module zope.tal.talinterpreter, line 961, in do_defineSlot
  Module zope.tal.talinterpreter, line 346, in interpret
  Module zope.tal.talinterpreter, line 536, in do_optTag_tal
  Module zope.tal.talinterpreter, line 521, in do_optTag
  Module zope.tal.talinterpreter, line 516, in no_tag
  Module zope.tal.talinterpreter, line 346, in interpret
  Module zope.tal.talinterpreter, line 822, in do_loop_tal
  Module zope.tales.tales, line 682, in setRepeat
  Module zope.tales.tales, line 696, in evaluate
   - URL: index
   - Line 107, Column 9
   - Expression: <PathExpr standard:'context/@@view_get_menu/library_actions'>
   - Names:
      {'container': <ore.library.directory.LibraryDirectory object at 0x7944950>,
       'context': <ore.library.directory.LibraryDirectory object at 0x7944950>,
       'default': <object object at 0x40528>,
       'here': <ore.library.directory.LibraryDirectory object at 0x7944950>,
       'loop': {},
       'nothing': None,
       'options': {'args': ()},
       'repeat': <Products.PageTemplates.Expressions.SafeMapping object at 0x7947eb8>,
       'request': <HTTPRequest, URL=http://localhost:8080/tools/annotations/%40%40view>,
       'root': <Application at >,
       'template': <ImplicitAcquirerWrapper object at 0x794c070>,
       'traverse_subpath': [],
       'user': <User 'kapil'>,
       'view': <Products.Five.metaclass.SimpleViewClass from /Users/k_vertigo/projects/ore/lib/ore/library/browser/templates/directory-view.pt object at 0x79449b0>,
       'views': <zope.app.pagetemplate.viewpagetemplatefile.ViewMapper object at 0x794c710>}
  Module zope.tales.expressions, line 217, in __call__
  Module Products.PageTemplates.Expressions, line 122, in _eval
  Module zope.tales.expressions, line 124, in _eval
  Module Products.PageTemplates.Expressions, line 74, in boboAwareZopeTraverse
  Module zope.traversing.adapters, line 164, in traversePathElement
   - __traceback_info__: (<Products.Five.metaclass.MenuAccessView object at 0x7956370>, 'library_actions')
  Module zope.traversing.adapters, line 49, in traverse
   - __traceback_info__: (<Products.Five.metaclass.MenuAccessView object at 0x7956370>, 'library_actions', [])
  Module Products.Five.browser.menu, line 27, in __getitem__
  Module zope.app.publisher.browser.menu, line 176, in getMenu
  Module zope.app.publisher.browser.menu, line 53, in getMenuItems
  Module zope.app.publisher.browser.menu, line 101, in available
  Module zope.security.management, line 137, in checkPermission
AttributeError: 'zope.thread.local' object has no attribute 'interaction'

==============================================================