[Zope-CMF] folder_factories and add permissions

[Florent Guillaume]

Jens-E. Hansen <Jens-E.Hansen@gis.de> wrote:
> I would like to achieve that a Member can add only selected portal
> types in a PortalContentFolder.

In CMF it is a design decision that all content creation is controlled
through the same permissions, 'Add portal content'. Thus it would seem
that this is an all-or-nothing. However the Portal Types can give you
some control on the allowed object types that can be created in a
folder.

Unfortunately the "allowed types" in the Types Tool is just a cosmetic
UI restriction and, as you mention, doesn't prevent someone from
calling invokeFactory directly.

Actually this could be considered a bug, either
PortalFolder.invokeFactory or TypesTool.constructContent should
enforce the allowed types.

Could a CMF designer comment on this ?


Florent
-- 
Florent Guillaume, Nuxeo (Paris, France)
+33 1 40 33 79 10  http://nuxeo.com  mailto:fg@nuxeo.com