Ticket #9291 (closed defect: fixed)

Opened 8 years ago

Last modified 8 years ago

Update lens link yields error when not logged in instead of permissions/login page

Reported by: je2 Owned by: jccooper
Priority: critical Milestone: Hot Fixes
Component: Users and Security Version: Live
Severity: major Keywords:
Cc: System Area: Other
Primary Skill: Plone
Site URL:
Suppress email to reporter: no

Description

I received the following message after a module was updated in the CNX Docuemntation lens:

This new version will be included in your lens. To remove the selected collection from your lens,  please visit:
http://cnx.org/lenses/cnxorg/documentation/lens_content_view

Following this link when NOT signed in yields an empty page (with CNX styling - the content of the page is blank) with the following error message in the top-left corner (in the nav bar, not the main body):

Error exceptions.AttributeError on context/workspaces_slot/macros/portlet: 'NoneType' object has no attribute 'getPhysicalPath'

As most lens owners will not be logged in when following this link from email, this can lead to confusion.  In this case the user should get a permissions error with a login option as we do with other pages (such as the workgroups) rather than a failure.

Change History

Changed 8 years ago by jccooper

  • owner changed from ew2 to jccooper
  • status changed from new to working

This does not appear to be a problem as of content actions move branch.

Changed 8 years ago by ew2

  • milestone changed from Ticket Triage to Hot Fixes

Changed 8 years ago by jccooper

  • status changed from working to testing

(In [28723]) don't assume 'home' exists, since it might not if you're anonymous. fix #9291 (on trunk, as hotfix)

Changed 8 years ago by jccooper

CA move branch doesn't have a fix per se for this problem, but it does apparently skip the error path somehow. So this fix is a good idea there anyway.

Changed 8 years ago by ew2

  • priority changed from unprioritized to critical
  • severity changed from minor to major

Changed 8 years ago by jenn

  • skills changed from Unspecified to Plone
  • status changed from testing to assigned

For me, the fix only seems to change the message to:

Error AccessControl?.unauthorized.Unauthorized on context/workspaces_slot/macros/portlet: You are not allowed to access 'getGroupsForPrincipal' in this context

It's currently on depot 8080 if you want to check it out. All I've done so far to test is to visit a lens_content_view anonymously; if the URL in the email changed as part of the fix or something, then let me know. But really, no URL should break like this.

Changed 8 years ago by jccooper

  • status changed from assigned to working

Hm. Indeed. Odd how I didn't see that last time I looked at this.

Changed 8 years ago by jccooper

  • status changed from working to testing

(In [28818]) our logic for checking for authentication in order to display the portlet was faulty when on a lens editing context specifically. works now with proper boolean grouping. fix #9291

Changed 8 years ago by jenn

Now seems to work properly. An anonymous user gets the login page, and the wrong user gets Insufficient Privileges.

Will tag and roll out today; leaving in Testing so we know it's not out yet.

Changed 8 years ago by jenn

  • status changed from testing to closed
  • resolution set to fixed
Note: See TracTickets for help on using tickets.