I'm having some trouble to set up the permissions to users groups on a Plone 4.3.9 site.
When I configure an user group with the roles Contributor (Can Add) and Reader (Can View) on a folder, they can navigate to it and add content to it. But if they click on the action /folder_contents they get an "You are not authorized to access this resource" error.
When I activate Editor (Can Edit) for the group, they can use the /folder_content but now they can also change the folder title and description and that's a problem for us.
I checked the permissions granted on the view "/manage_reportUserPermissions" and "Can Add" grants these permissions:
Access Transient Objects
**Access contents information**
Access future portal content
Access inactive portal content
Access session data
Add portal content
Add portal folders
Allow sendto
CMFEditions: Access previous versions
CMFEditions: Apply version control
CMFEditions: Save new version
Copy or Move
**List folder contents**
Mail forgotten password
Public, everyone can access
Reply to item
Search ZCatalog
Set own password
Set own properties
Use Database Methods
**View**
plone.app.contenttypes: Add Document
plone.app.contenttypes: Add File
plone.app.contenttypes: Add Folder
plone.app.contenttypes: Add Image
plone.app.contenttypes: Add Link
While "Can Edit" grants also these 5:
Change Images and Files
Change portal events
Manage properties
**Modify portal content**
Request review
I played with them and only the "Modify portal content" permission allow access to the folder contents using /folder_contents view.
Is it the expected behavior? Even if "List folder contents", "Access contents information", and "View" are granted?
If so, how can allow the contributor to see the contents of the folder (most of them has a default item and not the folder_listing as the default page) and deny the edit permission at the same time?
Thank you