How to give delete permission to owner

[Jean-Charles Dufour]

Hi,

I'm a newbie with the script python, and a beginner with plone.

I've find the way to authorize member to publish content in a specific
folder.



But now I need to give the right to owner to delete their own object/content
(whatever the state of this content).

I've try many unsuccessful combination with the security tab on a plone
directory.

I've heard that my problem could be resolve with a modification of the
folder_delete script. But I don't know how to do.



May you help me please?



Note : I use plone 2.1.1 under Windows XP





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[René Pijlman-3]

Jean-Charles Dufour:
>But now I need to give the right to owner to delete their own object/content
>(whatever the state of this content).

Starting from a Plone default site, I think all you need to do
is assign the permission 'Delete objects' to a role your users
have, on the Security tab of your Plone site in the ZMI.

--
Rene Pijlman
http://www.applinet.nl/
 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[kstrasser]

Do you have "delete objects" assigned to "owner"? That is the first
thing I would try.

 - Kevin

================================================
Kevin Strasser | Web Developer | 912-280-5414
================================================
Federal Law Enforcement Training Center /
US Department of Homeland Security
================================================
 

-----Original Message-----
From: plone-users-admin@...
[mailto:plone-users-admin@...] On Behalf Of
Jean-Charles Dufour
Sent: Friday, December 09, 2005 10:13 AM
To: plone-users@...
Subject: [Plone-Users] How to give delete permission to owner

Hi,

I'm a newbie with the script python, and a beginner with plone.

I've find the way to authorize member to publish content in a specific
folder.



But now I need to give the right to owner to delete their own
object/content
(whatever the state of this content).

I've try many unsuccessful combination with the security tab on a plone
directory.

I've heard that my problem could be resolve with a modification of the
folder_delete script. But I don't know how to do.



May you help me please?



Note : I use plone 2.1.1 under Windows XP





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log
files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Jean-Charles Dufour]

Yes "delete objects" is check for owner, but unfortunately this is not
sufficient.

Thank for your help


"Rene Pijlman" <rene@...> a ?crit dans
le message de news: 4s9jp1ddr5jlmoj6uug7940br9qc8i1ndr@......
Jean-Charles Dufour:
>But now I need to give the right to owner to delete their own
>object/content
>(whatever the state of this content).

Starting from a Plone default site, I think all you need to do
is assign the permission 'Delete objects' to a role your users
have, on the Security tab of your Plone site in the ZMI.

--
Rene Pijlman
http://www.applinet.nl/



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=ick 





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[René Pijlman-3]

Jean-Charles Dufour:
>Yes "delete objects" is check for owner, but unfortunately this
>is not sufficient.

I read your previous post again and I'm beginning to understand
that you have a folder in which multiple users may add content,
but every user should be allowed to cut or delete only his own
objects in that folder. Correct?

The Definitive Guide to Plone says: "In Plone this check is made
on each object". That sounds promising. But I can imagine the ui
(or rather: the action) decides wether or not to make the cut
and delete actions available based on the permissions on the
folder.

What happens when you give "Delete objects" permission to
everyone on the folder (through a regular role, not owner)? Do
the cut and delete buttons appear? Do they work, if you apply
them to an object you own? And equally important: do they fail
when you apply them to an object another user owns?

If the buttons appear, but give you an authorization error, you
could continue with:
http://plone.org/documentation/how-to/debug-unauthorized

--
Rene Pijlman
http://www.applinet.nl/
 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Jean-Charles Dufour]

I read your previous post again and I'm beginning to understand
that you have a folder in which multiple users may add content,
but every user should be allowed to cut or delete only his own
objects in that folder. Correct?
> Yes, Exactly !

The Definitive Guide to Plone says: "In Plone this check is made
on each object". That sounds promising. But I can imagine the ui
(or rather: the action) decides wether or not to make the cut
and delete actions available based on the permissions on the
folder.

What happens when you give "Delete objects" permission to
everyone on the folder (through a regular role, not owner)?
>For exemple, if I give delete permission to member, then every member can
>delete document of everyone.

Do the cut and delete buttons appear?
> Yes

Do they work, if you apply them to an object you own?
>Yes

And equally important: do they fail when you apply them to an object another
user owns?
>No

If the buttons appear, but give you an authorization error, you could
continue with:
http://plone.org/documentation/how-to/debug-unauthorized
> I've no error message
--
Rene Pijlman
http://www.applinet.nl/

>PLEASE HELP !





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[René Pijlman-3]

Jean-Charles Dufour:
[repaired quote levels]
>>What happens when you give "Delete objects" permission to
>>everyone on the folder (through a regular role, not owner)?
>
>For exemple, if I give delete permission to member, then every
>member can delete document of everyone.

We're getting close. All we need to do is fix this:

>>And equally important: do they fail when you apply them to an
>>object another user owns?
>
>No

Have a look at the "Delete objects" permission on the security
tab of such an object. Does "member" (or any other role of the
user you're testing with) have this permission? Or is "Acquire
permission settings" checked?

If the answer to both questions is no, I think it should work
the way you want.

--
Rene Pijlman
http://www.applinet.nl/
 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Jean-Charles Dufour]

Have a look at the "Delete objects" permission on the security tab of such
an object. Does "member" (or any other role of the user you're testing with)
have this permission?
> On folder : owner, member and manager have this permission. But member
> must have this permission : if not (if uncheck) then a member/owner can
> not see the delete item in the user interface !

Or is "Acquire permission settings" checked?
> Acquire is uncheck (But If acquire is checked it's work the same !)

So this don't work the way I want.

The problem is may be that members are not the owner of the folder in wich
they publish, they just have all the permission to "add document" (because i
check this permission for the folder).
So when they want to delete their own object in this folder, may be there is
something (the script folder_delete may be) which look for owner of the
folder and not for owner of the document itself ?!?
I'm note sure about this affirmation, the problem is that I dont know very
well script or what plone/zope do exactly.

Help is needed again ;-(
Thank you very much


--
Rene Pijlman
http://www.applinet.nl/



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=ick 





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[René Pijlman-3]

Jean-Charles Dufour:
>>Have a look at the "Delete objects" permission on the security tab of such
>>an object. Does "member" (or any other role of the user you're testing with)
>>have this permission?

> On folder : owner, member and manager have this permission. But member
> must have this permission :

No, I said "on the security tab _of such an object_", not "of
the folder containing such an object".

--
Rene Pijlman
http://www.applinet.nl/
 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Vecchio, Peppi]

All,

I have the need to make a folder within our main site its own little instance.  That is, when you add an event, it is shown in this folder's calendar, but not the main calendar.  When you add navigation, it is seen in this folder not elsewhere. When you add news items....etc.  Only members of a certain group have access to this folder.  The only way I can think of achieving this is using (or better yet - reusing) templates and portal_types. I copy portal_types and rename them something folder specific, then in the new templates, call these types. After testing this, I know that it works but seems ungratefully cumbersome.  Does anyone have any suggestions for a better or quicker way? I'd love to do this programmatically, but don't really know where to start.

Peppi Vecchio | Web Developer
TECHNOLOGY SERVICES GROUP



_________________________________________________________

The information contained in this message is privileged, confidential and
intended only for use of the individual or entity addressed above.  If you
have received this communication in error, please immediately notify us
by reply and delete the same.  Thank you.



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Mohsen Moeeni]

On 12/9/05, Rene Pijlman <rene@...> wrote:

> Jean-Charles Dufour:
> >>Have a look at the "Delete objects" permission on the security tab of such
> >>an object. Does "member" (or any other role of the user you're testing with)
> >>have this permission?
>
> > On folder : owner, member and manager have this permission. But member
> > must have this permission :
>
> No, I said "on the security tab _of such an object_", not "of
> the folder containing such an object".
>

Delete permission is checked on the containing folder of
an object and not on the object itself. To find a solution for your
problem search the list archive for "Security: per object deletion"
which I recently saw on the list.

Mohsen,


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Jean-Charles DUFOUR-2]

Oups sorry !
So here is a resume of the permissions
For the FOLDER : Aquire is uncheck and 'delete objects' is check for
Manager, Member and Owner
For each DOCUMENT in the folder : Aquire is check and 'delete objects' is
unchek for everybody

If I go to the ZMI and specifying for DOCUMENT : uncheck Aquire and 'delete
objects' check for Manager and Owner then...It's work !!!!! Only owner (and
manager) of the document can delete it.

We (You) are close to the result...but the problem is now how to do in order
to have this permission set by default. Because at present the default is
for documents added : Aquire is check and 'delete objects' is unchek for
everybody

Need little more help ;-)





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Jean-Charles DUFOUR-2]

Thank you for you help. I've found the thread you mentioned but because I'm
newbie I don't know exactly what to do.
In this thread the answer was :
"
If you need deletion control for objects you can proceed as follows:

  *  have a very restrictive DEP (e.g. grant is only for "Manager")

  *  perform "deletion" via a Python Script with "Manager" proxy role
     that checks whatever policy you may have before it performs the delete.
"
For my poor brain "python script with manager proxy role" is unreachable.

I hope we are near the solution with Rene Pijlman (the other contributor of
my thread in the newgroup / mailling list) but any suggestion concerning the
implementation of this "python script with manager proxy role" is welcome.





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[René Pijlman-3]

Mohsen Moeeni:
>Delete permission is checked on the containing folder of
>an object and not on the object itself.

Is The Definitive Guide to Plone wrong in this respect?

--
Rene Pijlman
http://www.applinet.nl/
 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[René Pijlman-3]

Jean-Charles DUFOUR:
>We (You) are close to the result...but the problem is now how to do in order
>to have this permission set by default. Because at present the default is
>for documents added : Aquire is check and 'delete objects' is unchek for
>everybody

What determines the default settings for the permissions of new
objects? Good question. I don't know. My guess would be: the
containing folder. What else? So that would not help you in this
case.

If there's no better solution, you could make this permission
managed by separate workflows for folderish and non-folderish
objects. Basically assign the permissions you now have figured
out in all states. Then hit the 'Update security settings'
button once.

Now the remaining question is: what determines the default
settings of permissions that are managed by a workflow on new
objects? The containing folder or the workflow? I assume it's
the workflow, and that would be your solution, but I'm not sure.

--
Rene Pijlman
http://www.applinet.nl/
 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[George Lee]

> Oups sorry !
> So here is a resume of the permissions
> For the FOLDER : Aquire is uncheck and 'delete objects' is check for
> Manager, Member and Owner


In my opinion, it is dangerous to allow any member the "delete objects" for the
folder. Why exactly do you need to allow people to delete the objects? One
possibility is to move an item into a central folder when a user publishes it,
then move it back into the user's home folder when the user retracts it. Then
when it's back in the user's home folder, he/she can delete it.


> We (You) are close to the result...but the problem is now how to do in order
> to have this permission set by default. Because at present the default is
> for documents added : Aquire is check and 'delete objects' is unchek for
> everybody

If you want to keep using this method, you can go into portal_workflow and
change the security settings for the different states. But this is not an easy
solution because it will not only affect Documents, but every portal type which
will mess up your security in strange ways. You could create a new workflow to
put Document in but that's kind of insane.


Again, why exactly do you need to allow people to delete the objects? There is
likely a better way to do this then the complicated security hacking that you're
taking ...


Peace,
George



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Jean-Charles DUFOUR-2]

Hi,

According to my tests, you was rigth: the default settingd for the
permissions of new objects can be determine by the workflow of these new
objects.
In my case (wich is particular) I have used this solution: I have added the
permission 'delete objects' to the 2 workflows who manage new folder and new
non-folder objects in my site. For all the state of these workflows I've
check only "Acquire", "manager" and "owner" for the 'delete objects'
permission.
Then each object added by a user (a member) in my site can be deleted only
by the manager(s) or the owner(s) of this object.
It's exactly what I want.
It's a shame that I don't know a nice method to obtain this behavior only
for designated folder and not for all the site. But it's OK like that for my
site.

Thank for your help



"Rene Pijlman" <rene@...> a ?crit dans
le message de news: ga1kp11drcqvvr8f2ep1oe6i2srvf84ej8@......
Jean-Charles DUFOUR:
>We (You) are close to the result...but the problem is now how to do in
>order
>to have this permission set by default. Because at present the default is
>for documents added : Aquire is check and 'delete objects' is unchek for
>everybody

What determines the default settings for the permissions of new
objects? Good question. I don't know. My guess would be: the
containing folder. What else? So that would not help you in this
case.

If there's no better solution, you could make this permission
managed by separate workflows for folderish and non-folderish
objects. Basically assign the permissions you now have figured
out in all states. Then hit the 'Update security settings'
button once.

Now the remaining question is: what determines the default
settings of permissions that are managed by a workflow on new
objects? The containing folder or the workflow? I assume it's
the workflow, and that would be your solution, but I'm not sure.

--
Rene Pijlman
http://www.applinet.nl/



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=ick 





-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Mohsen Moeeni]

On 12/10/05, Jean-Charles DUFOUR <jcdufour.lertim@...> wrote:

>
>
>
> Thank for you help. I've found the thread you mentioned but because I'm
> newbie I don't know exactly what to do.
> In this thread the answer was :
> "
> If you need deletion control for objects you can proceed as follows:
>
>  *  have a very restrictive DEP (e.g. grant is only for "Manager")
>
>  *  perform "deletion" via a Python Script with "Manager" proxy role
>     that checks whatever policy you may have before it performs the delete.
> "
> For my poor brain "python script with manager proxy role" is unreachable.
>

I think using an External Method would be simpler. Please
refer to Zope Book to know more about External Methods.
Just to give you some idea, I'll write something from my mind
which might not work at first try but hopefully is a good start:

def myDeleteObject(self)

     obj = self
     parent = obj.aq_inner.aq_parent # getting parent

     from Products.CMFCore.utils import getToolByName
     memtool = getToolByName(self, 'portal_membership')
     if memtool.checkPermission(obj, 'Delete Permission'):
           parent.delObject(obj.getId()) # Not sure about the API name
and signature

    self.REQUEST.RESPONSE.redirct(somewhere)

if you save this function in an external method e.g. mydel, you
call it like this: http://site/plone/folder/doc1/mydel and it will
remove doc1.

HTH
Mohsen,


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users

[Mohsen Moeeni]

On 12/10/05, Rene Pijlman <rene@...> wrote:
> Mohsen Moeeni:
> >Delete permission is checked on the containing folder of
> >an object and not on the object itself.
>
> Is The Definitive Guide to Plone wrong in this respect?
>

Haven't read that. But you can have a look at OFS/objectManager.py
and the API method 'manage_delObject'.

Mohsen,


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Plone-Users mailing list
Plone-Users@...
https://lists.sourceforge.net/lists/listinfo/plone-users