Errors when using manage_roles page in ZMI

[mauritsvanrees]

This is in Plone 5.2, using PluggableAuthService 2.0, with both Python 2 and 3. The traceback is different.

Steps to reproduce:

• Create fresh Plone Site
• Go to acl_users in the Zope root.
• Add a user.
• Go to the assignments for the Manager role: http://localhost:8080/acl_users/roles/manage_roles. Title of the page says: "Assign Role: Manager"
• Click the Search button to search for the newly created user. Title now is: "Assign Role: ['Manager', 'Manager’]”. The default admin user is no longer in the list, because no user has the ['Manager', 'Manager’] role.
• Select your new user and click the button to move him from available to active. Result is a traceback:

On Python 3:

Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 155, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 337, in publish_module
  Module ZPublisher.WSGIPublisher, line 255, in publish
  Module ZPublisher.mapply, line 85, in mapply
  Module ZPublisher.WSGIPublisher, line 61, in call_object
  Module Products.PluggableAuthService.utils, line 4, in wrapper
  Module <string>, line 4, in manage_assignRoleToPrincipals
  Module AccessControl.requestmethod, line 88, in _curried
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 421, in manage_assignRoleToPrincipals
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 303, in assignRoleToPrincipal
TypeError: '<' not supported between instances of 'str' and ‘list'

On Python 2 the traceback looks exactly the same, except that the error is clearer:

Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 155, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 337, in publish_module
  Module ZPublisher.WSGIPublisher, line 255, in publish
  Module ZPublisher.mapply, line 85, in mapply
  Module ZPublisher.WSGIPublisher, line 61, in call_object
  Module Products.PluggableAuthService.utils, line 4, in wrapper
  Module <string>, line 4, in manage_assignRoleToPrincipals
  Module AccessControl.requestmethod, line 88, in _curried
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 421, in manage_assignRoleToPrincipals
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 303, in assignRoleToPrincipal
KeyError: ["['Manager', 'Manager']", "['Manager', 'Manager']"]

• Start over and go back to the "Assign Role: Manager” page.
• Select the admin user and click the button to move him from active to available. Result is again a traceback:

On Python 3:

Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 155, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 337, in publish_module
  Module ZPublisher.WSGIPublisher, line 255, in publish
  Module ZPublisher.mapply, line 85, in mapply
  Module ZPublisher.WSGIPublisher, line 61, in call_object
  Module Products.PluggableAuthService.utils, line 4, in wrapper
  Module <string>, line 4, in manage_removeRoleFromPrincipals
  Module AccessControl.requestmethod, line 88, in _curried
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 444, in manage_removeRoleFromPrincipals
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 328, in removeRoleFromPrincipal
TypeError: '<' not supported between instances of 'str' and 'list'

On Python 2, again the traceback looks exactly the same, except that the error is clearer:

Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 155, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 337, in publish_module
  Module ZPublisher.WSGIPublisher, line 255, in publish
  Module ZPublisher.mapply, line 85, in mapply
  Module ZPublisher.WSGIPublisher, line 61, in call_object
  Module Products.PluggableAuthService.utils, line 4, in wrapper
  Module <string>, line 4, in manage_removeRoleFromPrincipals
  Module AccessControl.requestmethod, line 88, in _curried
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 444, in manage_removeRoleFromPrincipals
  Module Products.PluggableAuthService.plugins.ZODBRoleManager, line 328, in removeRoleFromPrincipal
KeyError: ['Manager', 'Manager']

For fun, try clicking the Search button a couple of times. Title changes to something like this:

Assign Role: ['[\'[\\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\', \\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\']\', \'[\\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\', \\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\']\']', '[\'[\\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\', \\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\']\', \'[\\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\', \\\'["[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']", "[\\\\\\\'Manager\\\\\\\', \\\\\\\'Manager\\\\\\\']"]\\\']\']']

Note that in core Zope, it works fine, because there is no manage_roles page.

I will see if I can create a PR.

[mauritsvanrees]

Wait, it seems fixed on master.

[mauritsvanrees]

Duplicate of issue #43. I did look for similar issues, but did not use a matching search term.