Re: [Zope] Simpleton requests help - what's this mapping malarkey ?:)
-----Original Message----- From: chas <panda@skinnyhippo.com> To: zope@zope.org <zope@zope.org> Date: Sunday, September 19, 1999 5:21 PM Subject: [Zope] Simpleton requests help - what's this mapping malarkey ?:)
eg. Ok, so let's look at a typical "define permissions" page :
- Access contents information <disabled> - Change DTML Methods <disabled> - Change permissions <disabled> - Change proxy roles <disabled> - Delete objects <disabled> - FTP access <disabled> - Manage properties <disabled> - View <view> - View management screens <disabled>
OK, so "view management screens" is now disable and nobody can view them. Fair enough. But say I want to enable them, why would I want to map "view management screens" to anything other than, er, "view management screens" ? And where is the correlation between this action and a user's identity ?
I think the idea here is that you may wish to factor out permissions a bit more. Perhaps the standard "view management screens" permission works fine for most objects, but you have a particular widget that you want to handle more specifically. So, you can set map the permission to "View Widget Screens". Then, users whose role gives them the "view management screens" permission is free to do so with standard items, but they can't view those screens for your Widget class unless their role specifically gives them "View Widget Screens" permission. Sure, you could muddle with the Security tab of each instance so that only the right people can view the management screens... but, using a mapping like this, you can set it at a higher level in the hierarchy and be done with it. Hope this helps/makes sense... Kevin
Thanks for the rapid response Kevin,
I think the idea here is that you may wish to factor out permissions a bit more. Perhaps the standard "view management screens" permission works fine for most objects, but you have a particular widget that you want to handle more specifically. So, you can set map the permission to "View Widget Screens". Then, users whose role gives them the "view management screens" permission is free to do so with standard items, but they can't view those screens for your Widget class unless their role specifically gives them "View Widget Screens" permission.
Ok, so we need a corresponding "Zope permission" instance. So, here's a step-by-step (pretty much following what I can make out of your KmNews product). Consider a product MyProduct : /MyProduct /MyClass /index_html /method2 /MyClass_add_permission /MyClass_factory /MyClass_add /MyClass_addForm To add permissions to let method2 change properties : 1) add a Zope Permission to the MyProduct folder. Let's call it "MyPermission" 2) go to MyClass and click on the "Permissions" tab. 3) select "MyPermission" from the multiple select list. This is saying 'any instances of this product have the permission MyPermission'. This seems to be very much like a role. 4) go to MyClass and then click on the "Define permissions" tab. 5) opposite the "Manage Properties" label, select the "MyPermission" ie. allow any instances of the class to manage the properties. However, I seem to have missed something since nowhere did we specify *who* has this permission. (eg. anonymous users, or just managers.). Damn, I feel dense.
Sure, you could muddle with the Security tab of each instance so that only the right people can view the management screens... but, using a mapping like this, you can set it at a higher level in the hierarchy and be done with it.
Actually, I'd have really liked it if there were a security tab on the zclass (not the instance) - but I notice that there are no security tabs there.... only these wonderful "define permission" pages. Wait, perhaps that's a clue - why *aren't* there "security" tabs in zclasses ? I mean, for something as simple as setting "anonymous user can manage properties", a standard security tab would have done the job fine.
Hope this helps/makes sense...
Half way .... and your help is much appreciated. Do you remember at school there was that annoying kid who stuck his hand up, asked a question, the teacher replied, yet still he didn't understand ? I'm that kid :) chas
participants (2)
-
chas -
Kevin Dangoor