开发者

Modifying read permissions on DublinCore metadata and Plone 4

I have created a custom content-type using Dexterity that works fine. This content should be viewable but its creator kept hidden from unpriviledged members.

I can obviously accomplish this by removing the document-byline from the template, but if I append, as a normal member, '/Creator' to the content I can still see the creator.

I can solve this by overriding Products.CMFDefault.DublinCore.DefaultDublinCoreImpl.Creator() and introducing an additional check, of course, but it's dirty and unmaintainable.

What's the best approach to selectively hide content DublinCore metadata from unpriviledged users, in the context开发者_StackOverflow社区 of Dexterity (if applicable)?


Another solution is to redefine Zope security for this context:

import Globals
from AccessControl import ClassSecurityInfo
from Products.CMFDefault.permissions import ManagePortal

from plone.directives.dexterity import Item


Item.security = ClassSecurityInfo()
Item.security.declareProtected(ManagePortal, 'Creator')

Globals.InitializeClass(Item)

This redefines security for the 'Creator' method of dexterity.Item so that only users with the ManagePortal permission can access this information.

However, ajung notes that this might break any code that makes assumptions about the Creator method and doesn't find it, not having the required permission. It also removes all the previous security declarations for this method.

Any other ideas?

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜