Ticket #13188 (reopened Bug)

Opened 4 years ago

Last modified 3 years ago

plone.app.discussion Conversation class does not have a proper Acquisition chain

Reported by: gforcada Owned by:
Priority: minor Milestone: 4.x
Component: Commenting/Discussion Version: 4.3
Keywords: Cc:

Description

Somehow you can only access its parent but not anything else upper in the chain.

This is quite troublesome as permissions could be higher up in the chain and thus the fix that was introduced in [1] (the permission check) only works if the permission is set explicitly on the comment itself, does not work if the comment inherits its parent.

For example, if you have a document with comments enabled, users add some comments but later someone decides to make the document private, the comments still show up on searches, but the link to them, if the user does not have enough permissions looks broken.

[1]  https://github.com/plone/plone.app.discussion/commit/53428fe5f65842ec48af62d54653160275420975

Change History

comment:1 Changed 4 years ago by kleist

  • Status changed from new to confirmed
  • Component changed from Unknown to Commenting/Discussion

comment:2 Changed 3 years ago by maartenkling

  • Status changed from confirmed to closed
  • Resolution set to duplicate

dub #12531

comment:3 Changed 3 years ago by khink

  • Status changed from closed to reopened
  • Version changed from 4.2 to 4.3
  • Resolution duplicate deleted

Not really a duplicate of https://dev.plone.org/ticket/12531.

This bug is purely about the Acquisition chain being incomplete. This can be illustrated as follows using "./bin/instance debug", on a Plone 4.3 site that has a Document with id 'testpage' in the site root, which has a comment:

>>> plone = app.Plone
>>> from AccessControl.SpecialUsers import nobody as user_nobody
>>> page = plone.testpage
>>> page
<ATDocument at /Plone/testpage>
>>> conversation = IConversation(page)
>>> comment = [c for c in conversation._comments.values()][0]
>>> comment
<plone.app.discussion.comment.Comment object at 0x8cba8c0>
>>> comment.text
u'test kommentar'
>>> from Acquisition import aq_chain
>>> aq_chain(comment)
[<plone.app.discussion.comment.Comment object at 0x8cba8c0>, <plone.app.discussion.conversation.Conversation object at 0x8cba7d0>, <ATDocument at testpage>]
>>> aq_chain(conversation)
[<plone.app.discussion.conversation.Conversation object at 0x8cba7d0>, <ATDocument at /Plone/testpage>, <PloneSite at /Plone>, <Application at >, <ZPublisher.BaseRequest.RequestContainer object at 0x8ca9f50>]

This shows the comment has an amputated acquisition chain. The conversation's acquisition chain however is complete.

References:  http://plone.293351.n2.nabble.com/comments-and-Acquisition-question-td7564899.html

comment:4 Changed 3 years ago by khink

Last edited 3 years ago by khink (previous) (diff)
Note: See TracTickets for help on using tickets.