Commit 984569a5 authored by Rafael Monnerat's avatar Rafael Monnerat

slapos_rss_style: Do not workaround security

   Revert inclusion Base_getNodeTitleAndDate and use checked_permission to only get title if the user is allowed to see the document.

   Author is optional so keep empty isn't a problem.
parent c52b70dd
...@@ -48,19 +48,19 @@ for brain in portal.portal_simulation.getMovementHistoryList( ...@@ -48,19 +48,19 @@ for brain in portal.portal_simulation.getMovementHistoryList(
('uid', 'desc')), ('uid', 'desc')),
**context_kw): **context_kw):
event = brain.getObject() event = brain.getObject()
(ticket_title, (ticket_title,
ticket_category, ticket_category,
ticket_link) = getTicketInfo(event) ticket_link) = getTicketInfo(event)
author, date = event.Base_getNodeTitleAndDate(brain)
data_list.append( data_list.append(
Object(**{ Object(**{
'title': ticket_title, 'title': ticket_title,
'category': ticket_category, 'category': ticket_category,
'author': author, 'author': event.getSourceTitle(checked_permission="View"),
'link': ticket_link, 'link': ticket_link,
'description': event.getTextContent(), 'description': event.getTextContent(),
'pubDate': date, 'pubDate': event.getStartDate(),
'guid': '{}-{}'.format( 'guid': '{}-{}'.format(
event.getFollowUp(), event.getFollowUp(),
event.getRelativeUrl()), event.getRelativeUrl()),
......
""" Workarround security to extract the sender information,
w/o raise security.
"""
return brain.node_title, brain.date
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>Script_magic</string> </key>
<value> <int>3</int> </value>
</item>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary>
<item>
<key> <string>name_container</string> </key>
<value> <string>container</string> </value>
</item>
<item>
<key> <string>name_context</string> </key>
<value> <string>context</string> </value>
</item>
<item>
<key> <string>name_m_self</string> </key>
<value> <string>script</string> </value>
</item>
<item>
<key> <string>name_subpath</string> </key>
<value> <string>traverse_subpath</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>_params</string> </key>
<value> <string>brain</string> </value>
</item>
<item>
<key> <string>_proxy_roles</string> </key>
<value>
<tuple>
<string>Manager</string>
</tuple>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>Base_getNodeTitleAndDate</string> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment