ida / adi.trash Goto Github PK

• Change browser-view-permission from "zope2.DeleteObjects" to "zope2.View"
  While it makes sense for the first phase to ask if delete-perms are given, that does not work when CSFR-protection gets in the way and makes the user stop at the view (which is otherwise not exposed directly to the user).

• Add auth-token to view, see: plone/plone.app.viewletmanager@c38b556

This is because entries for folder_buttons in actions.xml, do not take effect in the new folder_contents-view, see #plone/Products.CMFPlone#1269.

Refs:
plone/mockup#616
plone/plone.app.content#25

Possible solution:
Probably better use an event-listener instead of a browser-view.

"You do not possess the View management screens permission in the context of the container into which you are pasting, thus you are not able to perform this operation."

Hello !

is it possible to make a new release of this package ?

Thank you and regards,

Laurent.

When using a Plone 4.3.x installation with https://github.com/plone/plone.protect and trying to delete an object and the root of the site with a url like folder_contents?_authenticator=2c4b1c9a84b7d48b7ef39080239c62db34406382, you get

2017-07-26 16:07:54 ERROR Zope.SiteErrorLog 1501096074.850.287455953144 http://localhost:18928/Plone/@@adi_trash_view
Traceback (innermost last):
  Module ZPublisher.Publish, line 138, in publish
  Module ZPublisher.mapply, line 77, in mapply
  Module ZPublisher.Publish, line 48, in call_object
  Module adi.trash.browser.browser, line 63, in __call__
  Module plone.api.content, line 2, in move
  Module plone.api.validation, line 70, in wrapped
  Module plone.api.content, line 2, in move
  Module plone.api.validation, line 131, in wrapped
  Module plone.api.content, line 190, in move
  Module OFS.CopySupport, line 206, in manage_pasteObjects
  Module plone.dexterity.content, line 214, in _verifyObjectPaste
  Module Products.CMFCore.PortalFolder, line 421, in _verifyObjectPaste
ValueError: Disallowed subobject type: Plone Site

This happens because of this line:

if landing_url.endswith('/folder_contents'):

The if is always False and you wrongly enter in # We're coming from a folder_contents' delete-button: condition, when actually you're not there.

Something more robust should be used instead, like

from urlparse import urlparse
# We're coming from a folder_contents' delete-button:
if urlparse(landing_url).path.endswith('/folder_contents'):

This is a nice time to start adding tests infrastructure to this package.