Add security assertions, allow access to catalog in restrictedpython

plone / plone.app.contentlisting

Generic way to make listings of Plone content

2 stars 8 forks source link

Add security assertions, allow access to catalog in restrictedpython #30

Closed instification closed 2 years ago

instification commented 6 years ago

We are using contentlisting with collective.listingviews which allows us to modify the results using ttw code. However, access to the brains is not allowed in RestrictedPython as there are no security assertions on the CatalogContentListingObject class.

This PR adds those assertions.

jensens commented 5 years ago

I am pretty sure having all this just public might be a bad idea.
protected by "Access Contents Information" permission seems to be what's right here.
security should be used as a decorator (@security.protected("Access Contents Information")).

jensens commented 2 years ago

There was no activity on this for a while. I close this request for now. If you plan to work further on this please reopen and go on.