AW: Problem and fix: filteredTreeNodes doesn't respect hasAccess()

Thanks for the code proposal.
In fact the wording "accessible children" might be misunderstood; it should
be "visible children".

Anyway, I would prefer to take some conditional hasAccess() into the
presentation template - for example to show the objects the user will see,
if he has the access.

Best Reagrds
fh


-----Ursprüngliche Nachricht-----
Von: [email protected] [mailto:[email protected]]
Im Auftrag von Gregor Hoffleit
Gesendet: Mittwoch, 25. Juni 2008 16:01
An: [email protected]
Betreff: [zms-developers] Problem and fix: filteredTreeNodes doesn't respect
hasAccess()

I had some strange experiences when trying to protect a folder by
setting DC.accessRights.Restricted.

After some research, I noticed that most observations were due to the
fact that filteredTreeNodes() doesn't care about hasAccess(), in
contrast to its documentation:

    Returns a NodeList that contains all accessible children of this
    subtree in correct order. If none, this is a empty NodeList. 

Since the problem also affects at least firstFilteredChildNode() and
filteredChildNodes(), I applied the fix to isVisible():

--- zmsobject.py.ORIG	2008-06-25 14:54:07.000000000 +0200
+++ zmsobject.py    2008-06-25 15:20:31.000000000 +0200
@@ -376,6 +376,7 @@
     def isVisible(self, REQUEST):
       lang = REQUEST.get('lang',self.getPrimaryLanguage())
       visible = True
+      visible = visible and self.hasAccess(REQUEST) # User has access to
object.
       visible = visible and self.isTranslated(lang,REQUEST) # Object is
translated.
       visible = visible and self.isCommitted(REQUEST) # Object has been
committed.
       visible = visible and self.isActive(REQUEST) # Object is active.

Does this make sense?



Another thing:

With this fix applied, I got errors from hasAccess ("NoneType has no
attribute has_permission"). hasAccess() was not prepared for the case
that AUTHENTICATED_USER was not set (anonymous visitors). I patched away
my problem this way:

--- _accessmanager.py.ORIG  2008-06-25 15:05:48.000000000 +0200
+++ _accessmanager.py	2008-06-25 15:51:59.000000000 +0200
@@ -178,7 +178,7 @@
           access = access and ((not type(ob_access) is dict) or
(ob_access.get( 'edit') is None) or (len( self.intersection_list(
self.concat_list( ob_access.get( 'edit'), [ 'Manager']),
self.getUserRoles(auth_user))) > 0))
         access = access and auth_user.has_permission( 'ZMS Author', self)
in [ 1, True]
       else:
-        access = access and auth_user.has_permission( 'View', self) in [ 1,
True]
+        access = access and auth_user and auth_user.has_permission( 'View',
self) in [ 1, True]
         if not access:
           access = access or self.hasPublicAccess() 
       return access



Regards,
    Gregor Hoffleit