improved implementation of getting title of related object only if the user...

improved implementation of getting title of related object only if the user can access the object (adviced by Romain)

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@11305 20353a03-c40f-0410-a6d1-a30d3c3de9de

bt5/erp5_dms/SkinTemplateItem/portal_skins/erp5_dms/Base_getRelatedObjectTitle.xml

@@ -68,18 +68,12 @@
         </item>
         <item>
             <key> <string>_body</string> </key>
-            <value> <string encoding="cdata"><![CDATA[
-
+            <value> <string># get related object title in a security-aware way (without throwing exception\n
+# if I don\'t have permissions to access the object)\n
 cat_value=context.getProperty(category)\n
-res=context.portal_catalog(relative_url=cat_value)\n
-count=len(res)\n
-if count==0:return \'\'\n
-if count>1:\n
-  context.log(\'detected %d objects for %s relation\' % (count,category),context)\n
-return res[0].getTitle()\n
-
-
-]]></string> </value>
+ob=context.restrictedTraverse(cat_value,None)\n
+return ob is not None and ob.getTitle() or \'\'\n
+</string> </value>
         </item>
         <item>
             <key> <string>_code</string> </key>
@@ -131,10 +125,8 @@ return res[0].getTitle()\n
                             <string>_getattr_</string>
                             <string>context</string>
                             <string>cat_value</string>
-                            <string>res</string>
-                            <string>len</string>
-                            <string>count</string>
-                            <string>_getitem_</string>
+                            <string>None</string>
+                            <string>ob</string>
                           </tuple>
                         </value>
                     </item>

bt5/erp5_dms/SkinTemplateItem/portal_skins/erp5_dms/Base_getRelatedObjectTitleList.xml

@@ -68,10 +68,17 @@
         </item>
         <item>
             <key> <string>_body</string> </key>
-            <value> <string>cat_value=context.getPropertyList(category)\n
-res=context.portal_catalog(relative_url=cat_value)\n
-count=len(res)\n
-return [r.getTitle() for r in res]\n
+            <value> <string># get related object title list in a security-aware way (without throwing exception\n
+# if I don\'t have permissions to access the object)\n
+\n
+cat_value_list=context.getPropertyList(category)\n
+\n
+def getTitleIfAvailable(cat_value):\n
+  ob=context.restrictedTraverse(cat_value,None)\n
+  return ob is not None and ob.getTitle() or \'\'\n
+\n
+title_list=[getTitleIfAvailable(c) for c in cat_value_list]\n
+return [t for t in title_list if t!=\'\']\n
 </string> </value>
         </item>
         <item>
@@ -123,14 +130,14 @@ return [r.getTitle() for r in res]\n
                             <string>category</string>
                             <string>_getattr_</string>
                             <string>context</string>
-                            <string>cat_value</string>
-                            <string>res</string>
-                            <string>len</string>
-                            <string>count</string>
+                            <string>cat_value_list</string>
+                            <string>getTitleIfAvailable</string>
                             <string>append</string>
                             <string>$append0</string>
                             <string>_getiter_</string>
-                            <string>r</string>
+                            <string>c</string>
+                            <string>title_list</string>
+                            <string>t</string>
                           </tuple>
                         </value>
                     </item>

bt5/erp5_dms/bt/revision

-335
\ No newline at end of file
+337
\ No newline at end of file