@@getSource raises Vocabulary lookup not allowed on add form if user cannot modify the container

plone / plone.app.content

Various views for Plone, such as folder_contents, as well as general content infrastructure, such as base classes and name choosers.

https://pypi.org/project/plone.app.content/

7 stars 32 forks source link

Closed ale-rt closed 3 years ago

ale-rt commented 3 years ago

I have this use case:

in the container the user has the "Add portal content" permission
in the container the user has not the "Modify portal content" permission
the user wants to add a dexterity content type with a field that uses a plone.app.vocabularies.catalog.CatalogSource
when in the add form the widget fails to fetch the from the URL .../++add++.../++widget++form.widgets.field_name/@@getSource and returns Vocabulary lookup not allowed.

ale-rt commented 3 years ago

The problem, IMO, is related to this code: https://github.com/plone/plone.app.content/blob/084c91756382f785daa6c193625a620e109b39f7/plone/app/content/browser/vocabulary.py#L379-L386 which assumes that to fill that widget with data we need to have the "Modify portal content" permission