/@@member-fields browser view unprotected?

1

https://classic.demo.plone.org/@@member-fields

As you can see, you can view this page unauthenticated. But there's a permission:

and in https://classic.demo.plone.org/manage_access plone.app.controlpanel.UsersAndGroups (title: Plone Site Setup: Users and Groups) is correctly set only for Manager and Site Administrator.

The configure uses allowed_interface="OFS.interfaces.IItem" which looks strange to me (removing it change anything).

Another problem is that body class of this page contains viewpermission-view and thus is not considered by backend.xml diazo rules (when you use them).

Any idea how to debug this?

2

The configure uses allowed_interface="OFS.interfaces.IItem" which looks strange to me (removing it change anything).

This might mean that only the attributes included in IItem are protected by the permission (and not __call__, which is usually what we want for views). This should probably be removed.

Fortunately it doesn't appear to be possible to actually save the member-fields from this view while logged out.

Another problem is that body class of this page contains viewpermission-view and thus is not considered by backend.xml diazo rules (when you use them).

This is probably a side effect of the first problem.

3

The problem, from my point of view, is that the permission:
permission="plone.app.controlpanel.UsersAndGroups"
does not protect the view as expected.

The view inherits from:

which has a browserDefault method:

    def browserDefault(self, request):
        """If not traversing through the schema to a field,
        show the SchemaListingPage.
        """
        return self, ("@@edit",)

from https://www.zope.dev/zope_secrets/request.html:

" A browser publisher is described by the interface IBrowserPublisher, which is a sub-interface of IPublishTraverse and is implemented by the DefaultPublishTraverse class. Again, the IBrowserPublisher for the traversed-to object is found in one of three ways: the object may implement it itself; or it may be adaptable, with the request, to this interface; or the fallback DefaultPublishTraverse may be used. The browserDefault() method on the IBrowserPublisher is then called with the request as an argument."

then we have:

  <browser:page
      name="edit"
      for="plone.schemaeditor.interfaces.ISchemaContext"
      class=".listing.SchemaListingPage"
      permission="plone.schemaeditor.ManageSchemata"
      />

but plone.schemaeditor.ManageSchemata is a permission given only to Manager.

But this is beyond my knowledge...

4

@yurj Ah, thanks for reminding me about the additional traversal to the edit view of the schema context.

There is a more specific edit view registered for IMemberSchemaContext. This is where the permission needs to be fixed:

1 Like