I'm trying to display only the folders that a User has viewing rights to. The following code snippets are my two different attempts that both seem flawed. I created a user and a role. Only when that user is assigned the Manager role at the root level will the ifs test true. I'm deselecting Acquire permission settings and checking view for the role. I know this is working because I can view the folder. I tested this by unchecking View and relying on Acquisition. When I did this, I could not view the folder, just as it should be. So it seems something in these code snippets is screwy. What could it be? <dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if "AUTHENTICATED_USER.has_permission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in> <dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if expr="_.SecurityCheckPermission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in>
How about: <dtml-in expr="PARENTS[0].objectValues('Folder')" skip_unauthorized=1> ?? ----- Original Message ----- From: "Montagne, Michael" <montagne@BOORA.com> To: <zope@zope.org> Sent: Thursday, August 02, 2001 12:35 AM Subject: [Zope] Show Viewable folders
I'm trying to display only the folders that a User has viewing rights to. The following code snippets are my two different attempts that both seem flawed. I created a user and a role. Only when that user is assigned the Manager role at the root level will the ifs test true. I'm deselecting Acquire permission settings and checking view for the role. I know this
is
working because I can view the folder. I tested this by unchecking View and relying on Acquisition. When I did this, I could not view the folder, just as it should be. So it seems something in these code snippets is screwy. What could it be?
<dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if "AUTHENTICATED_USER.has_permission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in>
<dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if expr="_.SecurityCheckPermission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in>
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
Phil Harris writes:
How about:
<dtml-in expr="PARENTS[0].objectValues('Folder')" skip_unauthorized=1> Folders are protected by the "Access content information" permission.
If the user has "Access content information" but not "View" permission for a folder, the folder will be included in the list. Dieter
Hi Michael, what do you want to express with '<dtml-sequence-item>' ? This is only a string with the chars: <,d,t,m,l,-,s,...,i,t,e,m,> May be its a lot easyer, if you just try: <dtml-in expr="PARENTS[0].objectValues('Folder')" skip_unauthorized> ... </dtml-in Folderloop> The skip_unauthorized attribute suppresses the exception that would otherwise cause a reauthentication to gain the rights to access an object. HTH Tino --On Mittwoch, 1. August 2001 16:35 -0700 "Montagne, Michael" <montagne@BOORA.com> wrote:
I'm trying to display only the folders that a User has viewing rights to. The following code snippets are my two different attempts that both seem flawed. I created a user and a role. Only when that user is assigned the Manager role at the root level will the ifs test true. I'm deselecting Acquire permission settings and checking view for the role. I know this is working because I can view the folder. I tested this by unchecking View and relying on Acquisition. When I did this, I could not view the folder, just as it should be. So it seems something in these code snippets is screwy. What could it be?
<dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if "AUTHENTICATED_USER.has_permission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in>
<dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if expr="_.SecurityCheckPermission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in>
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
Montagne, Michael writes:
I'm trying to display only the folders that a User has viewing rights to. .... <dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if "AUTHENTICATED_USER.has_permission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in>
<dtml-in expr="PARENTS[0].objectValues('Folder')"> <dtml-if expr="_.SecurityCheckPermission('View','<dtml-sequence-item>')"> <li><a href="<dtml-var absolute_url>"><dtml-var title_or_id></a> <dtml-else> Nope<br> </dtml-if> </dtml-in> You have not yet been reached by the information that you cannot use "dtml-*" inside a Python expression?
Inside "...", you are in a Python expression context. '<dtml-sequence-item>' is there the literal string "<dtml-sequence-item>", no interpretation of "sequence-item" as you seem to expect.... Use in similar situations something like: <dtml-let folder=sequence-item> ... "... folder ..." ... </dtml-let> In your case, you can use: <dtml-let folder=sequence-item> <dtml-if expr="_.SecurityCheckPermission('View',folder)"> ... </dtml-if> </dtml-let> Unfortunately, this will not work for all permissions and for all objects: It will e.g. fail for 'View' and DTML objects and for 'Access Contents Information' and folders. I think this is a bug in Zope's security subsystem. If you feel like me, please put it into the collector. Dieter
participants (4)
-
Dieter Maurer -
Montagne, Michael -
Phil Harris -
Tino Wildenhain