What is ForbiddenAttribute exception/error?
Ref: http://mail.zope.org/pipermail/zope3-users/2006-August/004027.html ForbiddenAttribute? are always (ALWAYS!!!) a lack of missing security declarations or code accessing stuff it shouldn’t. Since accessing updateOrder seems reasonable to do, you’re most definitely lacking a security declaration for it. Zope will not allow anything if you don’t declare it.