zope - User edits only its own post.Using Plone permisisons -
i have plone website , create menu item.
in sharing tab add each user can post topic.
how can prevent user1 edits posts owned user2? user1 can edit user2 posts.
previously try creating group, assign each user group , add group using sharing tab, in way 1 user edit posts user.
just subtract (uncheck) 'can edit'-permission of sharing-tab. creator of item default owner, owners have edit-permission, users can edit own items not ones of others.
update (according new comment):
to inhibit add-privilege on subfolders you'll need break inheritage of contributors-role, 'can add'-permission assigned to.
however seems not possible, yet. quoting martin aspeli article "understanding permissions , roles":
"currently (until plone 2.1, likely), local roles can added @ lower level in acqusition tree, not taken away".
so need approach and, martijn suggested, you'll want go custom workflow - assumingly folderish - contenttype , types should allowed add in (fortunately default, images , files inherit state of parent, otherwise have think of multi-chained workflow, that's worth new post even, or - ugly - create copies of contenttypes give them workflow).
in case, follows:
create workflow adviced in http://developer.plone.org/content/workflow.html (i updated lately, please let know, if have suggestions improvements or contribute yourself).
add 'add portal content'-permission workflow (in zmi clickon workflowname andhit permissions-tab, select dropdown).
for each state in workflow (click on state's name), uncheck 'aquire permission settings', way break inheritage of contibutors-role. check 'add portal content'-permission each role want grant it, @ least owner-role in case, , might managers able access everything.
update2:
another, more challenging imho better, approach be:
on contenttype's inititialization (=your ct's class called) trigger script (f.e. contentrule/eventhandler/subscriber or in ct's class-definition, itself), looks inherited sharing-permissions on parent, blocks them (__ac_local_roles_block__ = true) , reassign roles again, contributor's one, new born object (your folderish contenttype). avoid creating whole new workflow solve case.
to this, please read docs (just updated, comments welcome), see how event-handler registrated:
the executed python-script contain s.th. like:
from acquisition import aq_parent def inhibit_parent_inherited_contributor_role(self, event): """ blocks local-roles on freshly created children in our contenttype , re-assigns parent's local-roles 'contributor' child. """ # block inherited local-permissions, of grand-parents: self.__ac_local_roles_block__ = true # local-roles assigned parent , parent: parent_roles = self.aq_parent.get_local_roles() # iterate on each assigned user , group roles: userid, roles in parent_roles: # provide list variable, collect new roles: # of group or user: new_roles = [] # iterate on user's, respectively group's, roles: role in roles: # exclude 'contributor' of new role-list: if role != u'contributor': # add other roles list of new roles: new_roles.append(role) # assign new roles child each found user , group: self.manage_setlocalroles(userid, new_roles) disclaimer:
i have tested iobjecteditedevent, works fine. whereas iobjectaddedevent fired 4 times (why?) , wasn't able tame quickly, plone.app.contentrules.handlers.py, :) have closer @ it, maybe including contentrule in solution can better.
for in-depth code-example roles, see andreas jung's lovely zopyx.plone.cassandra , computerolemap.py .
and haven't looked @ collective.subtractiveworkflow, yet. in case do, please tell :)
Comments
Post a Comment