question about permissions and conditional portal-tabs

[David Hostetler]

Hello,

I'm struggling with a portal-tabs issue and hoping to get some suggestions.

I have automatic tab generation disabled, and am managing the set of
tabs explicitly through the ZMI via portal_actions/portal_tabs.

But I need for each tab to display conditionally, only when the user
actually has 'View' permission on the target location for the tab.
This is one of the things that happens 'for free' when automatic tab
generation is enabled, but which is lost as soon as I start doing the
tab management manually, and I need to recreate the behavior.

It looks like the permission filter for automatic tabs happens when
the portal_catalog is searched using a query that's crafted in
CatalogNavigationTabs.topLevelTabs().   I.e. -- the catalog itself is
doing the view permission check (similar to how the navigation portlet
gets constructed, presumably).

So at first glance it seems like I might have to do a catalog query
(or multiple queries) to get the same effect for my manual tabs, and
I'm hoping there's a smarter way to do this.

Basically -- what it seems like I need is a checkPermission() call
that works on portal path strings rather than directly on portal
objects.  Or the functional equivalent.

Any ideas?

Apologies if this isn't appropriate for product-developers.   I
suppose I'm doing this as part of a 'policy product' for a deployment,
if that counts.  :)


regards,

-hoss


David Hostetler
[hidden email]

_______________________________________________
Product-Developers mailing list
[hidden email]
http://lists.plone.org/mailman/listinfo/product-developers

[taito]

Hello,

I have automatic tab generation disabled, and am managing the set of
tabs explicitly through the ZMI via portal_actions/portal_tabs.

But I need for each tab to display conditionally, only when the user
actually has 'View' permission on the target location for the tab.

Selecting "View" for Permission with visible option should work if it's about
through ZMI setting.

Taito

_______________________________________________
Product-Developers mailing list
[hidden email]
http://lists.plone.org/mailman/listinfo/product-developers

[Espen Moe-Nilssen]

Some javascript/style in this post has been disabled (why?)

I think there also is a product that let you manage these from the UI. If you have to do this often, it might be an idea to look at that product

Espen Moe-Nilssen

_______________________________________________

Author of Subskins III , build your own theme for Plone. Try it at:

http://subskins.medialog.no

Den 26. jul. 2009 kl. 11.48 skrev Taito Horiuchi:

Hello,

I have automatic tab generation disabled, and am managing the set of
tabs explicitly through the ZMI via portal_actions/portal_tabs.

But I need for each tab to display conditionally, only when the user
actually has 'View' permission on the target location for the tab.

Selecting "View" for Permission with visible option should work if it's about
through ZMI setting.

Taito

_______________________________________________

Product-Developers mailing list

[hidden email]

http://lists.plone.org/mailman/listinfo/product-developers

_______________________________________________
Product-Developers mailing list
[hidden email]
http://lists.plone.org/mailman/listinfo/product-developers

[Gilles Lenfant]

Le 26 juil. 09 à 11:48, Taito Horiuchi a écrit :

> Hello,
>
> I have automatic tab generation disabled, and am managing the set of
> tabs explicitly through the ZMI via portal_actions/portal_tabs.
>
> But I need for each tab to display conditionally, only when the user
> actually has 'View' permission on the target location for the tab.
>
> Selecting "View" for Permission with visible option should work if  
> it's about
> through ZMI setting.

This is not the solution for David. This just asserts that the user  
has the View permission on the context object and *not* on the link  
target object.

If your target is "string: $portal_url/some/path", then the condition  
should be:

"python:checkPermission('View', portal.unrestrictedTraverse('/some/
path')"

HTH
--
Gilles Lenfant

>
> Taito
>
> _______________________________________________
> Product-Developers mailing list
> [hidden email]
> http://lists.plone.org/mailman/listinfo/product-developers


_______________________________________________
Product-Developers mailing list
[hidden email]
http://lists.plone.org/mailman/listinfo/product-developers

[David Hostetler]

Thanks for the tip -- unrestrictedTraverse() seems like a viable approach.

However, my first attempt caused an unexpected issue: using an
expression like the one you provided, as the condition for the action
in portal_actions/portal_tabs, caused an 'Unauthorized' exception to
be raised.

using restrictedTraverse() didn't change the behavior.

Do I need to push this down into an external method, so that I can use
unrestrictedTraverse()?

It seems like just attempting to get the object so that I can apply
the checkPermission() test on it, causes the same permission exception
that I'm trying to test for in the first place.  Bit of a
chicken-and-egg scenario.


thanks,

-hoss


On Mon, Jul 27, 2009 at 05:01, Gilles
Lenfant<[hidden email]> wrote:

>
> This is not the solution for David. This just asserts that the user has the
> View permission on the context object and *not* on the link target object.
>
> If your target is "string: $portal_url/some/path", then the condition should
> be:
>
> "python:checkPermission('View', portal.unrestrictedTraverse('/some/path')"
>
> HTH
> --
> Gilles Lenfant
>

_______________________________________________
Product-Developers mailing list
[hidden email]
http://lists.plone.org/mailman/listinfo/product-developers

[David Hostetler]

Ok, I got it to work, I needed to use restrictedTraverse() and to give
it a default value of False, which would suppress the Unauthorized
exception and just return False:


checkPermission('View', portal.restrictedTraverse('<some path>', default=False))


I still have a bit of a concern about the cost associated with having
this kind of 'full object' check for multiple tabs, as it takes the
restrictedTraverse() hit on every page request.  But I'm not aware of
any other way to get this behavior.

Thanks for the help!

-hoss


On Mon, Jul 27, 2009 at 12:18, David Hostetler<[hidden email]> wrote:

> Thanks for the tip -- unrestrictedTraverse() seems like a viable approach.
>
> However, my first attempt caused an unexpected issue: using an
> expression like the one you provided, as the condition for the action
> in portal_actions/portal_tabs, caused an 'Unauthorized' exception to
> be raised.
>
> using restrictedTraverse() didn't change the behavior.
>
> Do I need to push this down into an external method, so that I can use
> unrestrictedTraverse()?
>
> It seems like just attempting to get the object so that I can apply
> the checkPermission() test on it, causes the same permission exception
> that I'm trying to test for in the first place.  Bit of a
> chicken-and-egg scenario.
>
>
> thanks,
>
> -hoss
>
>
> On Mon, Jul 27, 2009 at 05:01, Gilles
> Lenfant<[hidden email]> wrote:
>>
>> This is not the solution for David. This just asserts that the user has the
>> View permission on the context object and *not* on the link target object.
>>
>> If your target is "string: $portal_url/some/path", then the condition should
>> be:
>>
>> "python:checkPermission('View', portal.unrestrictedTraverse('/some/path')"
>>
>> HTH
>> --
>> Gilles Lenfant
>>
>

_______________________________________________
Product-Developers mailing list
[hidden email]
http://lists.plone.org/mailman/listinfo/product-developers