plone / plone/plone.api

make api.user.has_permission work with permission ids too

Open
#401 4 comments 3 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
101
Forks
62
Avg merge
15h 15m
Merged PRs (30d)
1

Description

currently api.user.has_permission('cmf.ModifyPortalContent') returns True if logged in as Manager and False for users having the Modify portal content permission.

problem: the method can only handle permission titles and silently fails when called with permission ids (https://github.com/zopefoundation/Products.CMFCore/blob/2.3.0/Products/CMFCore/permissions.zcml#L30)

i previously used the following code in my project:

from AccessControl.security import checkPermission

def allowed(context):
    return checkPermission('cmf.ModifyPortalContent', context)

when i started to replace this checks with plone.api.user.has_permission i did not notice there is a problem first because i was logged in as manager user.
now our customer found out that ui elements where missing for content editors because the updated permission checks did not work properly.

this is why i'd suggest to make plone.api.user.has_permission to work with permission titles as well as ids
if that is not possible it would also help when plone.api.user.has_permission('invalid permission string', context) raises an exception if the permission is not valid (i can file another ticket for this if you agree with that)

some pseudo-test-code:

setRoles(['Contributor'])
assertEqual(
   api.user.has_permission('cmf.ModifyPortalContent'),
   api.user.has_permission('Modify portal content'),
assertRaises(
  api.user.has_permission,
  'non existent permission',
  PermissionNotFoundError
) 

plone.api.user.has_permission('invalid permission string', context) should raise an exception if the permission id is not valid (i can file another ticket if you agree with that)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.