Skip to content

Five ZCML permissions are missing for endpoints security #221

Open
@sneridagh

Description

I've found some permissions that should be added to Zope in order to give the appropriate permissions in the endpoint's ZCML. The permission exists as an old style permissions but it lacks the new style Zope dotted names. For example:

@groups endpoint:
View Groups
Add Groups
Delete Groups
Manage Groups

It's curious, but there are no users counterparts to be used in the @users endpoint. But maybe they should exist. However, this is a more tricky question because we have to change PAS for this.

@users endpoint:

View users (should exist, in order to browse the existing users on a site)

@Principals endpoint:

View users/groups (should exist, in order to browse the existing users and groups on a site, for the sharing tab search)

There might be others, we can discuss it at the sprint.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions