At the moment there can be the case that we register a tile which gets called, but raises a 401Unauthorized. @@plone.app.standardtiles.lockinfo is such an example.
IMO it is
- overall fine if a tiles defines a view permission.
- if the permission is not sufficient it wont get rendered,
- otherwise it is in
This is similar to existing viewlet logic. But thats not what happens.
At the moment the tile is rendered, fails, raises a 401, 401 is catched and a 302 to the login page is produced, whole login page is delivered with a 200.
What I did to achieve the behavior above is in pull #34. But its not the best way to fix it. Here why:
First we have an explicit permission set in configuration. This could be checked before the tile is rendered at all. The current code makes it difficult to do this.
Second we may have Unauthorized errors we want to raise! This is true if the tile itself has the permission to render, but the executed code to render the tile itself raises a 401 (my PR above does not make a difference so far - so its not perfect, but better than the current situation).
Changes we need:
- check before any rendering is tried if permission applies (ESI is in here too!) . If not render empty.
- if the tile code is executed and an Unauthorized is raised, handle it, but
- do not render a login form as a tile result! Propagate the redirect to the login form to the main request.
At the moment there can be the case that we register a tile which gets called, but raises a 401Unauthorized.
@@plone.app.standardtiles.lockinfois such an example.IMO it is
This is similar to existing viewlet logic. But thats not what happens.
At the moment the tile is rendered, fails, raises a 401, 401 is catched and a 302 to the login page is produced, whole login page is delivered with a 200.
What I did to achieve the behavior above is in pull #34. But its not the best way to fix it. Here why:
First we have an explicit permission set in configuration. This could be checked before the tile is rendered at all. The current code makes it difficult to do this.
Second we may have Unauthorized errors we want to raise! This is true if the tile itself has the permission to render, but the executed code to render the tile itself raises a 401 (my PR above does not make a difference so far - so its not perfect, but better than the current situation).
Changes we need: