You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
"description": "How to set up add permissions, view permissions, and field view/edit permissions for Plone content types"
5
+
"property=og:description": "How to set up add permissions, view permissions, and field view/edit permissions for Plone content types"
6
+
"property=og:title": "How to set up add permissions, view permissions, and field view/edit permissions for Plone content types"
7
+
"keywords": "Plone, Permissions, content types"
8
8
---
9
9
10
10
# Permissions
11
11
12
-
**Setting up add permissions, view permissions and field view/edit permissions**
13
-
14
-
Plone’s security system is based on the concept of
15
-
*permissions* protecting *operations*
16
-
(like accessing a view,
17
-
viewing a field,
18
-
modifying a field,
19
-
or adding a type of content)
20
-
that are granted to *roles*,
21
-
which in turn are granted to *users* and/or *groups*.
22
-
In the context of developing content types,
23
-
permissions are typically used in three different ways:
24
-
25
-
- A content type or group of related content types often has a custom
26
-
*add permission* which controls who can add this type of content.
27
-
- Views (including forms) are sometimes protected by custom
28
-
permissions.
29
-
- Individual fields are sometimes protected by permissions,
30
-
so that some users can view and edit fields that others can’t see.
12
+
This chapter describes how to set up add permissions, view permissions, and field view/edit permissions.
13
+
14
+
Plone's security system is based on the concept of *permissions* protecting *operations*.
15
+
These operations include accessing a view, viewing a field, modifying a field, or adding a type of content.
16
+
Permissions are granted to *roles*, which in turn are granted to *users* or *groups*.
17
+
In the context of developing content types, permissions are typically used in three different ways.
18
+
19
+
- A content type or group of related content types often has a custom *add permission* which controls who can add this type of content.
20
+
- Views (including forms) are sometimes protected by custom permissions.
21
+
- Individual fields are sometimes protected by permissions, so that some users can view and edit fields that others can't see.
31
22
32
23
It is easy to create new permissions.
33
24
However, be aware that it is considered good practice to use the standard permissions wherever possible and use *workflow* to control which roles are granted these permissions on a per-instance basis.
34
25
35
-
For more basic information on permissions and how to create custom permissions read the [Security Section] in the Plone documentation.
26
+
For more basic information on permissions and how to create custom permissions read the [Security Section](https://5.docs.plone.org/develop/plone/security/index.html) in the Plone documentation.
27
+
36
28
37
29
## Performing permission checks in code
38
30
39
-
It is sometimes necessary to check permissions explicitly in code, for
40
-
example in a view. A permission check always checks a permission on a
41
-
context object, since permissions can change with workflow.
31
+
It is sometimes necessary to check permissions explicitly in code, for example, in a view.
32
+
A permission check always checks a permission on a context object, since permissions can change with workflow.
42
33
43
-
:::{note}
44
-
Never make security dependent on users’ roles directly.
34
+
```{note}
35
+
Never make security dependent on users' roles directly.
45
36
Always check for a permission, and assign the permission to the appropriate role or roles.
46
-
:::
37
+
```
47
38
48
-
As an example,
49
-
let’s display a message on the view of a `Session` type
50
-
if the user has the `cmf.RequestReview` permission.
51
-
In `session.py`, we update the `View` class with the following:
39
+
As an example, let's display a message on the view of a `Session` type if the user has the `cmf.RequestReview` permission.
40
+
In {file}`session.py`, we update the `View` class with the following.
Access to views and other browser resources (like viewlets or portlets)
90
-
can be protected by permissions, either using the `permission` attribute
91
-
on ZCML statements like:
76
+
Access to views and other browser resources such as viewlets or portlets can be protected by permissions, either using the `permission` attribute on ZCML statements such as the following
92
77
93
-
```
78
+
```xml
94
79
<browser:page
95
-
...
96
80
permission="zope.Public"
97
-
...
98
81
/>
99
82
```
100
83
101
84
We could also use the special `zope.Public` permission name to make the view accessible to anyone.
102
85
86
+
103
87
## Protecting form fields
104
88
105
-
Individual fields in a schema may be associated with a *read* permission
106
-
and a *write* permission.
107
-
The read permission is used to control access to the field’s value via protected code
108
-
(e.g. scripts or templates created through the web)
109
-
and URL traversal,
110
-
and can be used to control the appearance of fields when using display forms
111
-
(if you use custom views that access the attribute directly, you’ll need to perform your own checks).
112
-
Write permissions can be used to control whether or not a given field appears on a type’s add and edit forms.
89
+
Individual fields in a schema may be associated with a *read* permission and a *write* permission.
90
+
The read permission is used to control access to the field's value via protected code, such as scripts or templates created through the web, and URL traversal.
91
+
It can be used to control the appearance of fields when using display forms.
92
+
If you use custom views that access the attribute directly, you'll need to perform your own checks.
93
+
Write permissions can be used to control whether or not a given field appears on a type's add and edit forms.
113
94
114
-
In both cases,
115
-
read and write permissions are annotated onto the schema using directives similar to those we’ve already seen for form widget hints.
116
-
The `read_permission()` and `write_permission()` directives are found in the [plone.autoform] package.
95
+
In both cases, read and write permissions are annotated onto the schema using directives similar to those we've already seen for form widget hints.
96
+
The `read_permission()` and `write_permission()` directives are found in the [`plone.autoform`](https://pypi.org/project/plone.autoform/) package.
117
97
118
-
If XML-schemas are used for defintion see {ref}`Dexterity XML: security attributes <dexterity-xml-security>`.
98
+
If XMLschemas are used for definitions, see [Dexterity XML, supermodel/security attributes](https://5.docs.plone.org/external/plone.app.dexterity/docs/reference/dexterity-xml.html#supermodel-security-attributes).
119
99
120
-
Simple example protecting a field to be readable for Site Administrators only:
100
+
The following example protects a field to be readable for Site Administrators only.
121
101
122
-
```
102
+
```python
123
103
from zope import schema
124
104
from plone.supermodel import model
125
105
from plone.autoform.directives import read_permission, write_permission
@@ -133,13 +113,12 @@ class IExampleProtectedInformation(model):
133
113
)
134
114
```
135
115
136
-
As a complex example, let’s add a field for *Session* reviewers to record the track for a session.
137
-
We’ll store the vocabulary of available tracks on the parent `Program` object in a text field,
138
-
so that the creator of the `Program` can choose the available tracks.
116
+
As a complex example, let's add a field for *Session* reviewers to record the track for a session.
117
+
We'll store the vocabulary of available tracks on the parent `Program` object in a text field, so that the creator of the `Program` can choose the available tracks.
139
118
140
-
First, we add this to the `IProgram` schema in `program.py`:
119
+
First, we add this to the `IProgram` schema in {file}`program.py`.
141
120
142
-
```
121
+
```python
143
122
form.widget(tracks=TextLinesFieldWidget)
144
123
tracks = schema.List(
145
124
title=_("Tracks"),
@@ -149,21 +128,21 @@ tracks = schema.List(
149
128
)
150
129
```
151
130
152
-
The `TextLinesFieldWidget` is used to edit a list of text lines in a
153
-
text area. It is imported as:
131
+
The `TextLinesFieldWidget` is used to edit a list of text lines in a text area.
132
+
It is imported as shown.
154
133
155
-
```
134
+
```python
156
135
from plone.z3cform.textlines.textlines import TextLinesFieldWidget
157
136
```
158
137
159
-
Next, we’ll add a vocabulary for this to `session.py`:
138
+
Next, we'll add a vocabulary for this to {file}`session.py`:
160
139
161
-
```
140
+
```python
162
141
from Acquisition import aq_inner, aq_parent
163
142
from zope.component import provider
164
143
from zope.schema.interfaces import IContextSourceBinder
165
144
from zope.schema.vocabulary import SimpleVocabulary
0 commit comments