-
-
Notifications
You must be signed in to change notification settings - Fork 33
Description
When you perform an action on item(s) in @@folder_contents it does a pre-check that you have the appropriate permission for that action. See https://github.com/plone/plone.app.content/blob/4.1.9/plone/app/content/browser/contents/__init__.py#L95 and https://github.com/plone/plone.app.content/blob/4.1.9/plone/app/content/browser/contents/workflow.py#L41.
For workflow changes this is not accurate and does not have the required level of granularity. In some cases "Modify portal content" may work, but each transition can have a different permission requirement. Perhaps more important, it is possible that the user does have permission to change the workflow state but does not have Modify portal content. Personally, we have sites like this where the user is required to check out content (iterate) to edit, but does have the ability to make it private.
The simplest solution is to just set required_obj_permission to None. Is it worth trying to look up permissions for all transitions as a pre-check, or just remove the pre-check here?