Ticket #13188 (reopened Bug)
plone.app.discussion Conversation class does not have a proper Acquisition chain
Reported by: | gforcada | Owned by: | |
---|---|---|---|
Priority: | minor | Milestone: | 4.x |
Component: | Commenting/Discussion | Version: | 4.3 |
Keywords: | Cc: |
Description
Somehow you can only access its parent but not anything else upper in the chain.
This is quite troublesome as permissions could be higher up in the chain and thus the fix that was introduced in [1] (the permission check) only works if the permission is set explicitly on the comment itself, does not work if the comment inherits its parent.
For example, if you have a document with comments enabled, users add some comments but later someone decides to make the document private, the comments still show up on searches, but the link to them, if the user does not have enough permissions looks broken.
[1] https://github.com/plone/plone.app.discussion/commit/53428fe5f65842ec48af62d54653160275420975
Change History
comment:1 Changed 4 years ago by kleist
- Status changed from new to confirmed
- Component changed from Unknown to Commenting/Discussion
comment:2 Changed 3 years ago by maartenkling
- Status changed from confirmed to closed
- Resolution set to duplicate
dub #12531
comment:3 Changed 3 years ago by khink
- Status changed from closed to reopened
- Version changed from 4.2 to 4.3
- Resolution duplicate deleted
Not really a duplicate of https://dev.plone.org/ticket/12531.
This bug is purely about the Acquisition chain being incomplete. This can be illustrated as follows using "./bin/instance debug", on a Plone 4.3 site that has a Document with id 'testpage' in the site root, which has a comment:
>>> plone = app.Plone >>> from AccessControl.SpecialUsers import nobody as user_nobody >>> page = plone.testpage >>> page <ATDocument at /Plone/testpage> >>> conversation = IConversation(page) >>> comment = [c for c in conversation._comments.values()][0] >>> comment <plone.app.discussion.comment.Comment object at 0x8cba8c0> >>> comment.text u'test kommentar' >>> from Acquisition import aq_chain >>> aq_chain(comment) [<plone.app.discussion.comment.Comment object at 0x8cba8c0>, <plone.app.discussion.conversation.Conversation object at 0x8cba7d0>, <ATDocument at testpage>] >>> aq_chain(conversation) [<plone.app.discussion.conversation.Conversation object at 0x8cba7d0>, <ATDocument at /Plone/testpage>, <PloneSite at /Plone>, <Application at >, <ZPublisher.BaseRequest.RequestContainer object at 0x8ca9f50>]
This shows the comment has an amputated acquisition chain. The conversation's acquisition chain however is complete.
References: http://plone.293351.n2.nabble.com/comments-and-Acquisition-question-td7564899.html