From 06c10460ad6db52a5f370d36474e35ebae6d050f Mon Sep 17 00:00:00 2001
From: helmutm <helmutm@fd906abe-77d9-0310-91a1-e0d9ade77398>
Date: Tue, 15 Feb 2011 18:07:17 +0000
Subject: [PATCH] don't show 'delegate' action for non-privileged users

git-svn-id: svn://svn.cy55.de/Zope3/src/loops/trunk@4190 fd906abe-77d9-0310-91a1-e0d9ade77398
---
 organize/work/README.txt | 5 ++++-
 organize/work/browser.py | 8 ++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/organize/work/README.txt b/organize/work/README.txt
index 2651fa6..2189e25 100644
--- a/organize/work/README.txt
+++ b/organize/work/README.txt
@@ -136,10 +136,13 @@ work item, the form will be pre-filled with some of the item's data.
   >>> form.title
   u'Install Zope'
 
+The 'delegate' transition is omitted from the actions list because it is
+only available for privileged users.
+
   >>> form.actions
   [{'name': 'plan', 'title': 'plan'}, {'name': 'accept', 'title': 'accept'},
    {'name': 'start', 'title': 'start working'}, {'name': 'work', 'title': 'work'},
-   {'name': 'finish', 'title': 'finish'}, {'name': 'delegate', 'title': 'delegate'},
+   {'name': 'finish', 'title': 'finish'},
    {'name': 'cancel', 'title': 'cancel'}, {'name': 'modify', 'title': 'modify'}]
 
 
diff --git a/organize/work/browser.py b/organize/work/browser.py
index bbdc240..314f4d1 100644
--- a/organize/work/browser.py
+++ b/organize/work/browser.py
@@ -48,6 +48,7 @@ from loops.organize.tracking.browser import BaseTrackView
 from loops.organize.tracking.report import TrackDetails
 from loops.organize.work.base import WorkItem
 from loops.security.common import canAccessObject, canListObject, canWriteObject
+from loops.security.common import checkPermission
 from loops import util
 from loops.util import _
 
@@ -333,8 +334,11 @@ class CreateWorkItemForm(ObjectForm, BaseTrackView):
 
     @Lazy
     def actions(self):
-        return [dict(name=t.name, title=t.title)
-                    for t in self.track.getAvailableTransitions()]
+        result = [dict(name=t.name, title=t.title)
+                    for t in self.track.getAvailableTransitions()
+                    if t.name != 'delegate' or
+                        checkPermission('loops.ManageSite', self.context)]
+        return result
 
     @Lazy
     def candidates(self):