Ticket #13562 (confirmed Bug)

Opened 3 years ago

Last modified 3 years ago

supermodel parser fragility could create site lockout

Reported by: smcmahon Owned by: davisagli
Priority: major Milestone: 4.x
Component: Dexterity Version: 4.3
Keywords: Cc:

Description

With plone.autoform installed, plone.supermodel's parser does dotted name lookup for widgets and validators when it reads a model. If the dotted name can't be imported, a SupermodelParseError is raised.

If the validator or widget module supplying the dotted name changes or becomes unavailable, that exception is going to be raised whenever the FTI is read (when using an XML model). If there is an instance of the content type in the site root, it isn't possible to view the site -- or even open the ZMI at the site root.

That's a reasonable hazard -- unless the model is in the FTI for a TTW Dexterity type. In that case, it's going to be a big problem fixing the error. It is, in fact, possible to traverse to site/portal_types/my_content_type and fix the model field of the FTI, but that's going to be beyond many users.

If we have folks editing models TTW on any regular basis, this will become a nasty hazard.

Change History

comment:1 Changed 3 years ago by davisagli

Which is why you're validating the edits made TTW. So what's the problem?

If the SupermodelParseError doesn't make it clear what's wrong (name x is not importable) then that's a bug and we should improve the error reporting. But otherwise I think raising an error so the user knows they broke something is exactly the right thing to do, no?

comment:2 Changed 3 years ago by smcmahon

What got me a bit freaked out was having a whole site become unusable with no obvious way to fix it. I suppose that an improved error message and a good error message reference would really be adequate.

comment:3 Changed 3 years ago by kleist

  • Priority changed from minor to major
  • Status changed from new to confirmed
Note: See TracTickets for help on using tickets.