Added format conversion control system to make sure a document can only be...

Added format conversion control system to make sure a document can only be converted to a given list of formats based on the user profile. Required update of erp5_dms.

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@16743 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5OOo/Document/OOoDocument.py

@@ -32,6 +32,7 @@ from xmlrpclib import Fault
 from xmlrpclib import Transport
 from xmlrpclib import SafeTransport
 from AccessControl import ClassSecurityInfo
+from AccessControl import Unauthorized
 from OFS.Image import Pdata
 from Products.CMFCore.utils import getToolByName, _setCacheHeaders
 from Products.ERP5Type import Permissions, PropertySheet, Constraint, Interface
@@ -153,6 +154,14 @@ class OOoDocument(File, ConversionCacheMixin):
     """
     # Accelerate rendering in Web mode
     _setCacheHeaders(self, {'format' : format})
+
+    # Verify that the format is acceptable (from permission point of view)
+    method = self._getTypeBasedMethod('checkConversionFormatPermission', 
+        fallback_script_id = 'Document_checkConversionFormatPermission')
+    if not method(format=format):
+      raise Unauthorized("OOoDocument: user does not have enough permission to access document"
+                         " in %s format" % format)
+
     # Return the original file by default
     if format is None:
       return File.index_html(self, REQUEST, RESPONSE)