[Erp5-dev] "Allowed content type" does not matter?

[Jacek Medrzycki]

Hello

We have just find out on our site that its possible to add a content to
an object regardless of the settings in "Allowed content type" box.

For instance, it was possible to add (by the script) a Person to a
Person, despite the fact that Person is not an allowed content type for
Person.

I've made an svn update for products but the problem persists.

Is it really a bug?

Regards,
Jacek

[Ivan Tyagov]

Hi,

Post by Jacek Medrzycki
We have just find out on our site that its possible to add a content to
an object regardless of the settings in "Allowed content type" box.
For instance, it was possible to add (by the script) a Person to a
Person, despite the fact that Person is not an allowed content type for
Person.

Yes, it's possible because such a check is not applied.
This patch to Products.ERP5Type.Core.Folder (see attached) implements
this check but still it's not tested thoroughly. You can try it and
maybe send feedback?

Post by Jacek Medrzycki
I've made an svn update for products but the problem persists.

It should persists. Patch is not (yet) applied to SVN.

Post by Jacek Medrzycki
Is it really a bug?

I think we can classify it as a bug unless that's the "expected/normal"
behavior?

Regards
Ivan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: allowed_content_types.patch
Type: text/x-patch
Size: 851 bytes
Desc: not available
URL: <http://mail.tiolive.com/pipermail/erp5-dev/attachments/20070214/0c6a4aa6/attachment.bin>

[bartek]

Post by Ivan Tyagov
Hi,

Post by Jacek Medrzycki
We have just find out on our site that its possible to add a content
to an object regardless of the settings in "Allowed content type" box.
For instance, it was possible to add (by the script) a Person to a
Person, despite the fact that Person is not an allowed content type
for Person.

Yes, it's possible because such a check is not applied.
This patch to Products.ERP5Type.Core.Folder (see attached) implements
this check but still it's not tested thoroughly. You can try it and
maybe send feedback?

The weird thing about it is that some time ago it did work as expected -
if you tried to add an object of a type which was not in allowed
types, the system would raise an exception. So the check was
implemented, but apparently is not there anymore. Was it removed, or what?

Bartek

Post by Ivan Tyagov

Post by Jacek Medrzycki
I've made an svn update for products but the problem persists.

It should persists. Patch is not (yet) applied to SVN.

Post by Jacek Medrzycki
Is it really a bug?

I think we can classify it as a bug unless that's the "expected/normal"
behavior?
Regards
Ivan
------------------------------------------------------------------------
Index: Folder.py
===================================================================
--- Folder.py (revision 12682)
+++ Folder.py (working copy)
@@ -88,7 +88,13 @@
# XXX This feature is very confusing
# And made the code more difficult to update
portal_type = container.allowedContentTypes()[0].id
-
+ # is portal_type allowed to add ?
+ allowed_content_types = []
+ allowed_content_types.append(pt.id)
+ raise RuntimeError, \
+ "You are not allowed to add %s type to container (%s)." %(portal_type, container.getRelativeUrl())
from Products.ERP5Type import Document
# we get an object from factory only for first temp container object
------------------------------------------------------------------------
_______________________________________________
Erp5-dev mailing list
Erp5-dev at erp5.org
http://erp5.org/mailman/listinfo/erp5-dev

[Ivan Tyagov]

Post by bartek
The weird thing about it is that some time ago it did work as

expected -

Post by bartek
if you tried to add an object of a type which was not in allowed types,
the system would raise an exception. So the check was implemented, but
apparently is not there anymore. Was it removed, or what?
Bartek

I couldn't find traces in svn logs, maybe looking at the wrong place?

Post by bartek
If the patch is accepted, is it possible to change the exception to

raise an

Post by bartek
Unauthorized ?
J?rome

It's possible. My only concern is that it can make debugging of such
problems (if patch applied) more difficult because the problem is
different. It's a developer's fault not an user credentials problem.

Ivan

[Jérôme Perrin]

Post by Ivan Tyagov

Post by Jacek Medrzycki
Is it really a bug?

I think we can classify it as a bug unless that's the "expected/normal"
behavior?

I'm don't know if it's a bug, but I agree it's very strange (especially
because you can call it from the URL).

If the patch is accepted, is it possible to change the exception to raise an
Unauthorized ?

J?rome

[Sebastien Robin]

Hi,

I guess the patch should not be integrated. But I was able to reproduce this
problem.

We need:
1 - write a test for this
2 - check ERP5Type/ERP5Type.py , the method constructInstance should do the
work, but I don't know why it is not working.

Seb.

Post by Ivan Tyagov
Hi,

Post by Jacek Medrzycki
We have just find out on our site that its possible to add a content to
an object regardless of the settings in "Allowed content type" box.
For instance, it was possible to add (by the script) a Person to a
Person, despite the fact that Person is not an allowed content type for
Person.

Yes, it's possible because such a check is not applied.
This patch to Products.ERP5Type.Core.Folder (see attached) implements
this check but still it's not tested thoroughly. You can try it and
maybe send feedback?

Post by Jacek Medrzycki
I've made an svn update for products but the problem persists.

It should persists. Patch is not (yet) applied to SVN.

Post by Jacek Medrzycki
Is it really a bug?

I think we can classify it as a bug unless that's the "expected/normal"
behavior?
Regards
Ivan

[Jérôme Perrin]

Post by Sebastien Robin
Hi,
I guess the patch should not be integrated. But I was able to reproduce
this problem.
1 - write a test for this
2 - check ERP5Type/ERP5Type.py , the method constructInstance should do the
work, but I don't know why it is not working.

In CMF, the check is done in PortalFolder.invokeFactory ( which we don't use )

J?rome

[Jérôme Perrin]

Post by Jérôme Perrin
In CMF, the check is done in PortalFolder.invokeFactory ( which we don't use )

Seb, JP and I discussed this, we added the check in newContent, as Ivan
suggested. Thanks.
And btw, we'll finally raise a ValueError, just like PortalFolder does ;)

J?rome