Fix the security check when a wrong permission is specified - #2042
Merged
Conversation
|
@ale-rt thanks for creating this Pull Request and helping to improve Plone! TL;DR: Finish pushing changes, pass all other checks, then paste a comment: To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically. Happy hacking! |
Member
Author
|
@jenkins-plone-org please run jobs |
mauritsvanrees
requested changes
Aug 26, 2026
mauritsvanrees
left a comment
mauritsvanrees
left a comment
Member
There was a problem hiding this comment.
LGTM, but some tests fail.
When I try it locally, tox -e py313-plone62 -- -m test_services_inherit passes on the main branch, but not on this one. It is likely just something that needs an update in the tests.
avoinea
approved these changes
Aug 26, 2026
Member
Author
LOL, look at this: Before this fix the security check in this line was always passing... |
Member
Author
|
@jenkins-plone-org please run jobs |
Also add a warning to support developers in fixing the permission checks. Fixes #2041
mauritsvanrees
force-pushed
the
ale/2041/fix-permission-check
branch
from
August 27, 2026 11:52
be17fa6 to
d73500b
Compare
mauritsvanrees
approved these changes
Aug 27, 2026
Member
|
The uncommitted doc changes test failed, but that was on main as well. I have fixed it in PR #2043. I have rebased and force-pushed the current PR branch for good measure. And I have improved the most interesting test of this part to be more life-like, with a published child and a private parent. See last commit. Can be merged when green. |
Member
|
@jenkins-plone-org please run jobs |
davisagli
approved these changes
Aug 28, 2026
mauritsvanrees
added a commit
that referenced
this pull request
Aug 31, 2026
…2044) * Fix the security check when a wrong permission is specified Also add a warning to support developers in fixing the permission checks. And in the `@inherit` endpoint check the permission using the permission id. Fixes #2041 Backport of #2042 to Plone 6.1/6.0/5.2. * Test no uncommitted doc changes: test on Plone 6.1. The script and workflow were using Plone 6.2, but the 9.x.x branch should be used on Plone 6.1 as latest. * Update the http-examples to be correct for Plone 6.1. --------- Co-authored-by: Alessandro Pisa <alessandro.pisa@gmail.com>
mister-roboto
pushed a commit
to plone/buildout.coredev
that referenced
this pull request
Aug 31, 2026
Branch: refs/heads/9.x.x Date: 2026-08-31T16:06:12+02:00 Author: Maurits van Rees (mauritsvanrees) <maurits@vanrees.org> Commit: plone/plone.restapi@bf963e9 Fix the security check when a wrong permission is specified [9.x.x] (#2044) * Fix the security check when a wrong permission is specified Also add a warning to support developers in fixing the permission checks. And in the `@inherit` endpoint check the permission using the permission id. Fixes #2041 Backport of plone/plone.restapi#2042 to Plone 6.1/6.0/5.2. * Test no uncommitted doc changes: test on Plone 6.1. The script and workflow were using Plone 6.2, but the 9.x.x branch should be used on Plone 6.1 as latest. * Update the http-examples to be correct for Plone 6.1. --------- Co-authored-by: Alessandro Pisa <alessandro.pisa@gmail.com> Files changed: A news/2041.bugfix.md M .github/workflows/tests.yml M src/plone/restapi/serializer/schema.py M src/plone/restapi/services/inherit/get.py M src/plone/restapi/tests/http-examples/querystring_get.resp M src/plone/restapi/tests/http-examples/querystring_get_contextual.resp M src/plone/restapi/tests/http-examples/translated_messages_addons.resp M src/plone/restapi/tests/http-examples/translated_messages_types_folder.resp M src/plone/restapi/tests/http-examples/types_document.resp M src/plone/restapi/tests/http-examples/types_document_put.req M src/plone/restapi/tests/test_services_inherit.py M test-no-uncommitted-doc-changes
mister-roboto
pushed a commit
to plone/buildout.coredev
that referenced
this pull request
Aug 31, 2026
Branch: refs/heads/9.x.x Date: 2026-08-31T16:06:12+02:00 Author: Maurits van Rees (mauritsvanrees) <maurits@vanrees.org> Commit: plone/plone.restapi@bf963e9 Fix the security check when a wrong permission is specified [9.x.x] (#2044) * Fix the security check when a wrong permission is specified Also add a warning to support developers in fixing the permission checks. And in the `@inherit` endpoint check the permission using the permission id. Fixes #2041 Backport of plone/plone.restapi#2042 to Plone 6.1/6.0/5.2. * Test no uncommitted doc changes: test on Plone 6.1. The script and workflow were using Plone 6.2, but the 9.x.x branch should be used on Plone 6.1 as latest. * Update the http-examples to be correct for Plone 6.1. --------- Co-authored-by: Alessandro Pisa <alessandro.pisa@gmail.com> Files changed: A news/2041.bugfix.md M .github/workflows/tests.yml M src/plone/restapi/serializer/schema.py M src/plone/restapi/services/inherit/get.py M src/plone/restapi/tests/http-examples/querystring_get.resp M src/plone/restapi/tests/http-examples/querystring_get_contextual.resp M src/plone/restapi/tests/http-examples/translated_messages_addons.resp M src/plone/restapi/tests/http-examples/translated_messages_types_folder.resp M src/plone/restapi/tests/http-examples/types_document.resp M src/plone/restapi/tests/http-examples/types_document_put.req M src/plone/restapi/tests/test_services_inherit.py M test-no-uncommitted-doc-changes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Also add a warning to support developers in fixing the permission checks.
Fixes #2041