Open
Description
Hi,
I have a use case where a limited-access user is doing some object creation/modification operation with Manager's role (temporary).
with plone.api.env.adopt_roles("Manager"):
# some special operations are here
That solution was working fine previously. But now I see https://github.com/collective/collective.elasticsearch/blob/master/src/collective/elasticsearch/hook.py#L66 , I am getting a permission problem. I debug the current user's role (no Manager role found so far).
There uuidToObject(uid)
function is used to find object which is using brain.getObject()
, meaning that restricted object access.
To avoid this situation, can we use unrestricted object access, fx unrestrictedTraverse(brain.getPath())
Metadata
Metadata
Assignees
Labels
No labels