Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix allowedRolesAndUsers by using 'Access contents information' #2723

Merged
merged 2 commits into from
Feb 6, 2019
Merged

fix allowedRolesAndUsers by using 'Access contents information' #2723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bcbf032
fix allowedRolesAndUsers by using 'Access contents information'
agitator Feb 6, 2019
c19ec49
Merge branch 'master' into fix_allowed_users_and_roles
ale-rt Feb 6, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion Products/CMFPlone/CatalogTool.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,12 @@ def allowedRolesAndUsers(obj):
"""Return a list of roles and users with View permission.
Used to filter out items you're not allowed to see.
"""
allowed = set(rolesForPermissionOn('View', obj))

# 'Access contents information' is the correct permission for
# accessing and displaying metadata of an item.
# 'View' should be reserved for accessing the item itself.
allowed = set(rolesForPermissionOn('Access contents information', obj))

# shortcut roles and only index the most basic system role if the object
# is viewable by either of those
if 'Anonymous' in allowed:
Expand Down
2 changes: 2 additions & 0 deletions news/260.bugfix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Switched allowedRolesAndUsers indexer from 'View' to the correct permission 'Access contents information' for displaying metadata. 'View' permission should be used on the item itself. The change should not matter for default Plone workflows, since they always use those permissions together.
[agitator]