make api.user.has_permission work with permission ids too
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 101
- Forks
- 62
- Avg merge
- 15h 15m
- Merged PRs (30d)
- 1
Description
currently api.user.has_permission('cmf.ModifyPortalContent') returns True if logged in as Manager and False for users having the Modify portal content permission.
problem: the method can only handle permission titles and silently fails when called with permission ids (https://github.com/zopefoundation/Products.CMFCore/blob/2.3.0/Products/CMFCore/permissions.zcml#L30)
i previously used the following code in my project:
from AccessControl.security import checkPermission
def allowed(context):
return checkPermission('cmf.ModifyPortalContent', context)
when i started to replace this checks with plone.api.user.has_permission i did not notice there is a problem first because i was logged in as manager user.
now our customer found out that ui elements where missing for content editors because the updated permission checks did not work properly.
this is why i'd suggest to make plone.api.user.has_permission to work with permission titles as well as ids
if that is not possible it would also help when plone.api.user.has_permission('invalid permission string', context) raises an exception if the permission is not valid (i can file another ticket for this if you agree with that)
some pseudo-test-code:
setRoles(['Contributor'])
assertEqual(
api.user.has_permission('cmf.ModifyPortalContent'),
api.user.has_permission('Modify portal content'),
assertRaises(
api.user.has_permission,
'non existent permission',
PermissionNotFoundError
)
plone.api.user.has_permission('invalid permission string', context) should raise an exception if the permission id is not valid (i can file another ticket if you agree with that)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.