Anonymous users and object editing

hietpasd · August 3, 2017, 8:45pm

Hi,

I'm looking for advice on how to go about the following. I need to have an IP restricted BrowserView (which is not the issue) which can be called by an anonymous user that can make changes on dexterity objects on the site. That anonymous user call will be coming from the another server.

My question is how do I go about setting up a BrowserView which will be executed by an anonymous user to make edits to objects on the site. I feel some sort of security bypass will be required. It is easy enough to get objects via unrestrictedTraverse but making edits seems restricted yet.

Or would it be easier using an external method? (which I'm not a fan of doing)

Thanks,
David

cdw9 · August 3, 2017, 8:58pm

Do you need an actual form for users to access in the site to make changes? Or will it be sent to Plone as a request?

If it's the latter, I recommend using plone.rest to accept a POST.

djay · August 4, 2017, 2:34am

@hietpasd A filesystem BrowserView is trusted python code and can do anything. The only time there are restrictions are when you are using TAL expressions, python scripts or other kinds of restricted python such as Rapido. So as long as its in your browserview there should be no issue.

hvelarde · August 4, 2017, 8:02pm

we had a similar use case some years ago and we solved it with the help of @davisagli.

take a look at the code of this package (it's Grok based but you'll get the idea):

github.com

interlegis/interlegis.portalmodelo.ombudsman/blob/master/src/interlegis/portalmodelo/ombudsman/browser/claim.py#L117-L139






class AddView(dexterity.AddForm):
    grok.name('Claim')
    grok.require('interlegis.portalmodelo.ombudsman.AddClaim')


    def show_recaptcha_widget(self):
        anon = api.user.is_anonymous()
        q_i = api.portal.get_tool(name='portal_quickinstaller')
        recaptcha_installed = q_i.isProductInstalled(
            'plone.formwidget.recaptcha')
        recaptcha_configured = False


        if recaptcha_installed:
            from plone.formwidget.recaptcha.interfaces import IReCaptchaSettings
            registry = queryUtility(IRegistry)
            settings = registry.forInterface(IReCaptchaSettings)
            recaptcha_configured = (len(settings.public_key) > 0)
        return (recaptcha_installed and recaptcha_configured)

This file has been truncated. show original

github.com

interlegis/interlegis.portalmodelo.ombudsman/blob/master/src/interlegis/portalmodelo/ombudsman/profiles/default/rolemap.xml#L4-L6


    <role name="Ombudsman" />
</roles>
<permissions>

@ramiroluz has been contributing lately to this package, so maybe he can help you further.

tkimnguyen · August 5, 2017, 2:07pm

As @cdw9 asked, it's not clear if you want a human or software to do the edits. If software, you can (and probably should) still have it authenticate, to be on the safe side, since firewalls are not going to protect you 100%. Even if it's a human doing the editing "anonymously", you might still want to log the IP addresses, the way Wikipedia does it.

hietpasd · August 7, 2017, 12:23pm

Yes it will be a process not a user doing the edits. There will be zero form fields passed into this process. All the process is going to do is updating cache data and sets it in the required dexterity objects. Only the server the plone site is running on will be able to call the process.

Thanks Dylan. You are right there are no restrictions which is perfect for our needs.

espenmn · August 7, 2017, 2:34pm

... it it was a user, one way could be to have a form / view that stores the fields 'somewhere else', then sends an email to confirm (together with a checksum), and the content is updated by clicking on the email link (which redirects to a browser 'confirm view'.

The confirm view could check for 'legal emails ( contains yourplace.com )