Okay, we're toggling back. There is no way to identify which

protected attributes can really hold a __roles__ list. Also, subclasses
often want to set up different protection for inherited attributes, in
which case either a copy of the DTMLFile is needed or the roles have to
be stored separately.

lib/python/App/class_init.py

@@ -100,18 +100,12 @@ def default__class_init__(self):
     for name, v in dict_items:
         if hasattr(v,'_need__name__') and v._need__name__:
             v.__dict__['__name__']=name
-        if name=='manage' or name[:7]=='manage_':
-            if not hasattr(v, '__roles__'):
-                try:
-                    v.__roles__ = ('Manager',)
-                except:
-                    # This attribute can't hold a __roles__
-                    # attribute.  Try to store __roles__ in the
-                    # class instead.
-                    nr = name + '__roles__'
-                    if not have(nr):
-                        try: dict[nr] = ('Manager',)
-                        except: pass
+            if name=='manage' or name[:7]=='manage_':
+                name=name+'__roles__'
+                if not have(name): dict[name]=('Manager',)
+        elif name=='manage' or name[:7]=='manage_' and type(v) is ft:
+            name=name+'__roles__'
+            if not have(name): dict[name]='Manager',
 
     # Look for a SecurityInfo object on the class. If found, call its
     # apply() method to generate __ac_permissions__ for the class. We
@@ -131,4 +125,5 @@ def default__class_init__(self):
             pr=PermissionRole(pname)
             for mname in mnames:
                 try: getattr(self, mname).__roles__=pr
-                except: dict[mname+'__roles__']=pr
+                except: pass
+                dict[mname+'__roles__']=pr

lib/python/App/special_dtml.py

@@ -133,18 +133,28 @@ defaultBindings = {'name_context': 'context',
                    'name_subpath': 'traverse_subpath'}
 
 from Shared.DC.Scripts.Bindings import Bindings
-from Acquisition import Explicit
+from Acquisition import Explicit, aq_inner, aq_parent
 from DocumentTemplate.DT_String import _marker, DTReturn, render_blocks
 from DocumentTemplate.DT_Util import TemplateDict, InstanceDict
 from AccessControl import getSecurityManager
+from ComputedAttribute import ComputedAttribute
 
 class DTMLFile(Bindings, Explicit, ClassicHTMLFile):
     "HTMLFile with bindings and support for __render_with_namespace__"
     
     func_code = None
     func_defaults = None
+    _need__name__=1
 
     _Bindings_ns_class = TemplateDict
+    def _get__roles__(self):
+        imp = getattr(aq_parent(aq_inner(self)),
+                      '%s__roles__' % self.__name__)
+        if hasattr(imp, '__of__'):
+            return imp.__of__(self)
+        return imp
+
+    __roles__ = ComputedAttribute(_get__roles__, 1)
 
     # By default, we want to look up names in our container.
     _Bindings_client = 'container'