Skip to content

Fix the security check when a wrong permission is specified [9.x.x] - #2044

Merged
mauritsvanrees merged 3 commits into
9.x.xfrom
maurits-fix-permission-check-9xx
Aug 31, 2026
Merged

Fix the security check when a wrong permission is specified [9.x.x]#2044
mauritsvanrees merged 3 commits into
9.x.xfrom
maurits-fix-permission-check-9xx

Conversation

@mauritsvanrees

Copy link
Copy Markdown
Member

Backport of PR #2042 for Plone 6.1 and earlier.

And update the http-examples in the documentation to be correct for Plone 6.1.

Note that the lint check may fail because pyupgrade wants to remove these lines from setup.py:

-if sys.version_info.major == 2:
-    raise ValueError(
-        "plone.restapi 10 requires Python 3. "
-        "Please downgrade to plone.restapi 7 for Python 2 and Plone 4.3/5.1."
-    )
-
-

And afterwards flake8 then complains:

setup.py:5:1: F401 'sys' imported but unused

I think we want to keep those lines on this 9.x.x branch.

ale-rt and others added 3 commits August 31, 2026 13:12
Also add a warning to support developers in fixing the permission checks.
And in the `@inherit` endpoint check the permission using the permission id.
Fixes #2041

Backport of #2042 to Plone 6.1/6.0/5.2.
The script and workflow were using Plone 6.2, but the 9.x.x branch should be used on Plone 6.1 as latest.
@mister-roboto

Copy link
Copy Markdown

@mauritsvanrees thanks for creating this Pull Request and helping to improve Plone!

TL;DR: Finish pushing changes, pass all other checks, then paste a comment:

@jenkins-plone-org please run jobs

To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically.

Happy hacking!

@mauritsvanrees

Copy link
Copy Markdown
Member Author

For good measure I am testing this together with the similar plone/plone.autoform#94 on Jenkins.

@read-the-docs-community

Copy link
Copy Markdown

@mauritsvanrees
mauritsvanrees merged commit bf963e9 into 9.x.x Aug 31, 2026
12 checks passed
@mauritsvanrees
mauritsvanrees deleted the maurits-fix-permission-check-9xx branch August 31, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants