[Erp5-dev] security-unaware catalog calls

[bartek]

Hello

If I am writing a Product class and I need to check something in the
portal_catalog, but bypassing security restrictions - is delegation to a
Script (Python) with proxy roles the only way to do it, or can it be
done from the class?

Bartek

[Jérôme Perrin]

Post by bartek
Hello
If I am writing a Product class and I need to check something in the
portal_catalog, but bypassing security restrictions - is delegation to a
Script (Python) with proxy roles the only way to do it, or can it be
done from the class?

ERP5Catalog lacks unrestrictedSearchResults methods that exists in
CMFCore.CatalogTool, this is probably the bug.

J?rome

[Jean-Paul Smets]

Post by bartek
Hello
If I am writing a Product class and I need to check something in the
portal_catalog, but bypassing security restrictions - is delegation to a
Script (Python) with proxy roles the only way to do it, or can it be
done from the class?

Using proxy roles on scripts does not help since catalog and SQL methods are
use the user security context.

Have a look to aq_dynamic of WebSection.py for an example of solution.

Another way is to add a method to catalog (ERP5 Catalog)
unrestrictedSearchResults
unrestrictedCountResults

which does not take into account allowedRoles and users. I do not know if
this is already implemented or not but it is generallt agreed to be
needed.

This method could be called from a script with proxy roles

JPS.

Post by bartek
Bartek
_______________________________________________
Erp5-dev mailing list
Erp5-dev at erp5.org
http://erp5.org/mailman/listinfo/erp5-dev

[Alexandre Boeglin]

Post by Jean-Paul Smets

Post by bartek
If I am writing a Product class and I need to check something in the
portal_catalog, but bypassing security restrictions - is delegation to a
Script (Python) with proxy roles the only way to do it, or can it be
done from the class?

Using a proxy role will not "bypass security", just allow to define
which role will be used.

Post by Jean-Paul Smets
Using proxy roles on scripts does not help since catalog and SQL methods are
use the user security context.

This was fixed in
http://svn.erp5.org/erp5/trunk/products/ERP5Catalog/CatalogTool.py?rev=11099&view=rev


Alex