Skip to content

Permission check on folder_contents workflow change is inaccurate #300

@ewohnlich

Description

@ewohnlich

When you perform an action on item(s) in @@folder_contents it does a pre-check that you have the appropriate permission for that action. See https://github.com/plone/plone.app.content/blob/4.1.9/plone/app/content/browser/contents/__init__.py#L95 and https://github.com/plone/plone.app.content/blob/4.1.9/plone/app/content/browser/contents/workflow.py#L41.

For workflow changes this is not accurate and does not have the required level of granularity. In some cases "Modify portal content" may work, but each transition can have a different permission requirement. Perhaps more important, it is possible that the user does have permission to change the workflow state but does not have Modify portal content. Personally, we have sites like this where the user is required to check out content (iterate) to edit, but does have the ability to make it private.

The simplest solution is to just set required_obj_permission to None. Is it worth trying to look up permissions for all transitions as a pre-check, or just remove the pre-check here?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions