Re: Why is manage_pasteObjects protected with "Modify portal content"?

Hi,

There is a package I use on all my projects: atreal.monkeyplone (
https://pypi.python.org/pypi/atreal.monkeyplone/2.0.0)
It modifies some settings with copy, paste, delete security (not in
dexterity of course it is 2011) in a more suitable way for Plone usecases
(for example with this product we use Add portal content permission for
pasting contents).

I use it for years without any border effect (at a functional point of
view. i'm not a security expert)
I think that we should have a look on this. IMHO all those modifications
are good.


2013/12/9 Sean Upton <[email protected]>

> The subject-line is self-explanatory:
>
>
> https://github.com/plone/Products.CMFPlone/blob/master/Products/CMFPlone/Portal.py#L46
>
>
> https://github.com/plone/Products.Archetypes/blob/master/Products/Archetypes/BaseFolder.py#L42
>
>
> https://github.com/plone/plone.dexterity/blob/master/plone/dexterity/content.py#L580
>
> Ideally, this really should be 'Add portal content' -- so that folks
> who have permission to view the content in source, and add content to
> target can paste?
>
> Working around this requires jumping through hoops (for example, I
> have a workflow definition that only allows those with the manager
> role to Modify an item in a "Published" state, which forces me to
> workaround by creating a distinct workflow definition for my folder
> just to route around the wrong, but long-standing conventional
> permission).
>
> Is this a simple long-standing mistake that could eventually be
> corrected?  Am I missing something?  If not, should I PLIP changing
> this for Plone 5?
>
> Sean
>
>
> ------------------------------------------------------------------------------
> Sponsored by Intel(R) XDK
> Develop, test and display web and hybrid apps with a single code base.
> Download it for free now!
>
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
> _______________________________________________
> Plone-developers mailing list
> Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/plone-developers
>



-- 
Thomas Desvenain

Téléphone : 09 51 37 35 18

------------------------------------------------------------------------------
Sponsored by Intel(R) XDK 
Develop, test and display web and hybrid apps with a single code base.
Download it for free now!
http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk

_______________________________________________
Plone-developers mailing list
Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/plone-developers