chameleon.zpt.template.Macros is missing a security declaration

[icemac]

Imagine the following scenario in Zope 2.13 using through the web PageTemplates:

Contents of PageTemplage named master:

<span metal:define-macro="foo">bar</span>

Contents of another PageTemplate:

<span metal:use-macro="here/master/macros/foo" />
<span metal:use-macro="python:here.master.macros['foo']" />

The latter PageTemplate renders as bar bar.

On Zope 4 the same scenario behaves differently:

<span metal:use-macro="here/master/macros/foo" />

successfully renders bar but

<span metal:use-macro="python:here.master.macros['foo']" />

raises an Unauthorized exception which manifests in a basic auth password dialog.

The reason seems to be that the following classes have no security declarations:

• chameleon.zpt.template.Macros
• chameleon.zpt.template.Macro

This breaks using the __getitem__ style when using macros.