Skip to content

Cannot access object (lack of permission) index_batch()->uuidToObject(uid)  #91

Open
@nazrulworld

Description

@nazrulworld

Hi,
I have a use case where a limited-access user is doing some object creation/modification operation with Manager's role (temporary).

with plone.api.env.adopt_roles("Manager"):
      # some special operations are here

That solution was working fine previously. But now I see https://github.com/collective/collective.elasticsearch/blob/master/src/collective/elasticsearch/hook.py#L66 , I am getting a permission problem. I debug the current user's role (no Manager role found so far).
There uuidToObject(uid) function is used to find object which is using brain.getObject(), meaning that restricted object access.

To avoid this situation, can we use unrestricted object access, fx unrestrictedTraverse(brain.getPath())

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions