cco/loops
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

restrict external editing for text and open admin interface to zope.ManageSite permission

Browse source 
git-svn-id: svn://svn.cy55.de/Zope3/src/loops/trunk@1643 fd906abe-77d9-0310-91a1-e0d9ade77398
This commit is contained in:
helmutm 2007-03-15 07:02:06 +00:00
parent 85c387992d
commit 4249d7c478
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
browser/common.py
View file

@ -37,7 +37,7 @@ from zope.publisher.browser import applySkin
from zope.publisher.interfaces.browser import IBrowserSkinType from zope.publisher.interfaces.browser import IBrowserSkinType
from zope import schema from zope import schema
from zope.schema.vocabulary import SimpleTerm from zope.schema.vocabulary import SimpleTerm
from zope.security import canAccess, canWrite from zope.security import canAccess, canWrite, checkPermission
from zope.security.proxy import removeSecurityProxy from zope.security.proxy import removeSecurityProxy
from zope.traversing.browser import absoluteURL from zope.traversing.browser import absoluteURL
from zope.traversing.api import getName from zope.traversing.api import getName
@ -252,6 +252,7 @@ class BaseView(GenericView):
def openEditWindow(self, viewName='edit.html'): def openEditWindow(self, viewName='edit.html'):
if self.editable: if self.editable:
#if self.request.principal.id == 'rootadmin' #if self.request.principal.id == 'rootadmin'
if checkPermission('zope.ManageSite', self.context):
return "openEditWindow('%s/@@%s')" % (self.url, viewName) return "openEditWindow('%s/@@%s')" % (self.url, viewName)
return '' return ''
@ -260,8 +261,9 @@ class BaseView(GenericView):
ct = getattr(self.context, 'contentType', '') ct = getattr(self.context, 'contentType', '')
if not ct or ct == 'application/pdf': if not ct or ct == 'application/pdf':
return False return False
if ct.startswith('text/'): if ct.startswith('text/') and ct != 'text/rtf':
return self.request.principal.id == 'rootadmin' return checkPermission('zope.ManageSite', self.context)
#return self.request.principal.id == 'rootadmin'
return canWrite(self.context, 'title') return canWrite(self.context, 'title')
@Lazy @Lazy