Problem and fix: filteredTreeNodes doesn't respect hasAccess()

I had some strange experiences when trying to protect a folder by
setting DC.accessRights.Restricted.

After some research, I noticed that most observations were due to the
fact that filteredTreeNodes() doesn't care about hasAccess(), in
contrast to its documentation:

    Returns a NodeList that contains all accessible children of this
    subtree in correct order. If none, this is a empty NodeList. 

Since the problem also affects at least firstFilteredChildNode() and
filteredChildNodes(), I applied the fix to isVisible():

--- zmsobject.py.ORIG	2008-06-25 14:54:07.000000000 +0200
+++ zmsobject.py    2008-06-25 15:20:31.000000000 +0200
@@ -376,6 +376,7 @@
     def isVisible(self, REQUEST):
       lang = REQUEST.get('lang',self.getPrimaryLanguage())
       visible = True
+      visible = visible and self.hasAccess(REQUEST) # User has access to object.
       visible = visible and self.isTranslated(lang,REQUEST) # Object is translated.
       visible = visible and self.isCommitted(REQUEST) # Object has been committed.
       visible = visible and self.isActive(REQUEST) # Object is active.

Does this make sense?



Another thing:

With this fix applied, I got errors from hasAccess ("NoneType has no
attribute has_permission"). hasAccess() was not prepared for the case
that AUTHENTICATED_USER was not set (anonymous visitors). I patched away
my problem this way:

--- _accessmanager.py.ORIG  2008-06-25 15:05:48.000000000 +0200
+++ _accessmanager.py	2008-06-25 15:51:59.000000000 +0200
@@ -178,7 +178,7 @@
           access = access and ((not type(ob_access) is dict) or (ob_access.get( 'edit') is None) or (len( self.intersection_list( self.concat_list( ob_access.get( 'edit'), [ 'Manager']), self.getUserRoles(auth_user))) > 0))
         access = access and auth_user.has_permission( 'ZMS Author', self) in [ 1, True]
       else:
-        access = access and auth_user.has_permission( 'View', self) in [ 1, True]
+        access = access and auth_user and auth_user.has_permission( 'View', self) in [ 1, True]
         if not access:
           access = access or self.hasPublicAccess() 
       return access



Regards,
    Gregor Hoffleit



-- 
Gregor Hoffleit <[email protected]>
Media Supervision Software Consulting GmbH
Georg-Friedrich-Haendel-Str. 13, 69214 Eppelheim/Heidelberg
Tel: +49 6221 705079-0  /  Fax: +49 6221 705079-80
Amtsgericht Mannheim, HRB 336821, Geschäftsführer Reinhard Kratzke
http://www.mediasupervision.de/