Use restrictedTraverse instead of getattr to prevent Unauthorized error

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@24659 20353a03-c40f-0410-a6d1-a30d3c3de9de

bt5/erp5_base/SkinTemplateItem/portal_skins/erp5_base/CurrencyModule_getCurrencyItemList.xml

@@ -60,9 +60,11 @@ def getCurrencyItemList(include_empty=1, portal_path=""):\n
   result = []\n
   if include_empty :\n
     result = [[\'\', \'\'],]\n
-  currency_module = getattr(portal, \'currency_module\',\n
-                        getattr(portal, \'currency\', None))\n
+  currency_module = portal.restrictedTraverse(\n
+                             \'currency_module\', \n
+                             portal.restrictedTraverse(\'currency\', None))\n
 \n
+  if currency_module is not None:\n
     for currency in LazyFilter(currency_module.contentValues(), skip=\'View\'):\n
       if not skip_invalidated or \\\n
             currency.getProperty(\'validation_state\', \'default\') != \'invalidated\':\n

bt5/erp5_base/bt/revision

-469
+470
\ No newline at end of file