. Only jump to related objects if the user can view them.

. Change the translation to be more flexible :
  - first, try to get a full translated message with all portal types
  names in english
  - if not found fallback to a mapping substitution with translated
    portal_types.


git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@6049 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5/bootstrap/erp5_core/SkinTemplateItem/portal_skins/erp5_core/Base_jumpToRelatedObject.xml

@@ -66,40 +66,59 @@
         </item>
         <item>
             <key> <string>_body</string> </key>
-            <value> <string>portal = context.getPortalObject()\n
-N_ = portal.Base_translateString\n
+            <value> <string>from ZTUtils import make_query\n
+from AccessControl import getSecurityManager\n
+N_ = context.Base_translateString\n
 \n
-search_method = getattr(context, \'get%sRelatedValueList\' %\n
+search_method = getattr(context, \'get%sRelatedList\' %\n
           string.join([string.capitalize(x) for x in base_category.split(\'_\')], \'\'))\n
-related_object_list = search_method(portal_type=portal_type)\n
+related_list = search_method(portal_type = portal_type)\n
+    \n
+if same_type(portal_type, \'\'):\n
+  portal_type = [portal_type]\n
 \n
-if len(related_object_list)==0:\n
+if len(related_list) == 0:\n
   url = context.absolute_url()\n
-  modified_translated_portal_type = N_(portal_type).replace(\' \', \'+\')\n
-  message = N_(\'No+%(portal_type)+related.\',\n
-               mapping = {\'portal_type\': modified_translated_portal_type})\n
+  message = N_(\'No ${portal_type} Related.\',\n
+      mapping = { \'portal_type\': N_(portal_type[0])})\n
 \n
-elif len(related_object_list)==1:\n
-  url = related_object_list[0].absolute_url()\n
-  modified_translated_portal_type = N_(portal_type).replace(\' \', \'+\')\n
-  context_translated_portal_type = N_(context.getPortalType()).replace(\' \', \'+\')\n
-  message = N_("%(portal_type)+related+to+%(context_portal_type):+%(title).",\n
-               mapping = {\n
-                 \'portal_type\': modified_translated_portal_type,\n
-                 \'context_portal_type\': context_translated_portal_type,\n
-                 \'title\': context.getTitleOrId()\n
-               })\n
-\n
-else:\n
+elif len(related_list) == 1:\n
+  related_object = context.restrictedTraverse(related_list[0], None)\n
+  if related_object is not None :\n
+    url = related_list[0]\n
+    message = N_(\n
+      # first, try to get a full translated message with portal types\n
+      "%s related to %s." % (related_object.getPortalType(), context.getPortalType()),\n
+       # if not found, fallback to generic translation\n
+      default = unicode(N_(\'${this_portal_type} related to ${that_portal_type} : ${that_title}.\',\n
+        mapping={"this_portal_type" : related_object.getTranslatedPortalType(),\n
+                 "that_portal_type" : context.getTranslatedPortalType(),\n
+                 "that_title" : context.getTitleOrId() }), \'utf8\'))\n
+  else :\n
+    url = context.absolute_url()\n
+    message = N_("You are not authorized to view the related document.")\n
+else :\n
+  # compute the list of objects we are actually authorized to view\n
+  related_object_list = []\n
+  for path in search_method(portal_type=portal_type) :\n
+    obj = context.restrictedTraverse(path, None)\n
+    if obj is not None and getSecurityManager().validate("View", obj):\n
+      related_object_list.append(obj)\n
+  if len(related_object_list) == 0 :\n
+    url = context.absolute_url()\n
+    message = N_("You are not authorized to view any related document.")\n
+  else :\n
     request=context.REQUEST\n
     selection_uid_list = [x.getUid() for x in related_object_list]\n
     kw = {\'uid\': selection_uid_list}\n
-  context.portal_selections.setSelectionParamsFor(\'Base_jumpToRelatedObjectList\', kw)\n
+    context.portal_selections.setSelectionParamsFor(\n
+                          \'Base_jumpToRelatedObjectList\', kw)\n
     request.set(\'object_uid\', context.getUid())\n
     request.set(\'uids\', selection_uid_list)\n
-  return context.Base_jumpToRelatedObjectList(uids=selection_uid_list, REQUEST=request)\n
+    return context.Base_jumpToRelatedObjectList(\n
+                      uids=selection_uid_list, REQUEST=request)\n
 \n
-redirect_url = \'%s/%s?%s\' % (url, \'view\', \'portal_status_message=%s\' % message)\n
+redirect_url = \'%s/%s?%s\' % (url, \'view\', make_query({\'portal_status_message\': message}))\n
 context.REQUEST[ \'RESPONSE\' ].redirect(redirect_url)\n
 </string> </value>
         </item>
@@ -121,7 +140,7 @@ context.REQUEST[ \'RESPONSE\' ].redirect(redirect_url)\n
         </item>
         <item>
             <key> <string>_params</string> </key>
-            <value> <string>base_category, portal_type=None</string> </value>
+            <value> <string>base_category, portal_type=()</string> </value>
         </item>
         <item>
             <key> <string>errors</string> </key>
@@ -149,9 +168,12 @@ context.REQUEST[ \'RESPONSE\' ].redirect(redirect_url)\n
                           <tuple>
                             <string>base_category</string>
                             <string>portal_type</string>
+                            <string>ZTUtils</string>
+                            <string>make_query</string>
+                            <string>AccessControl</string>
+                            <string>getSecurityManager</string>
                             <string>_getattr_</string>
                             <string>context</string>
-                            <string>portal</string>
                             <string>N_</string>
                             <string>getattr</string>
                             <string>string</string>
@@ -160,13 +182,18 @@ context.REQUEST[ \'RESPONSE\' ].redirect(redirect_url)\n
                             <string>_getiter_</string>
                             <string>x</string>
                             <string>search_method</string>
-                            <string>related_object_list</string>
+                            <string>related_list</string>
+                            <string>same_type</string>
                             <string>len</string>
                             <string>url</string>
-                            <string>modified_translated_portal_type</string>
-                            <string>message</string>
                             <string>_getitem_</string>
-                            <string>context_translated_portal_type</string>
+                            <string>message</string>
+                            <string>None</string>
+                            <string>related_object</string>
+                            <string>unicode</string>
+                            <string>related_object_list</string>
+                            <string>path</string>
+                            <string>obj</string>
                             <string>request</string>
                             <string>selection_uid_list</string>
                             <string>kw</string>
@@ -183,7 +210,7 @@ context.REQUEST[ \'RESPONSE\' ].redirect(redirect_url)\n
             <key> <string>func_defaults</string> </key>
             <value>
               <tuple>
-                <none/>
+                <tuple/>
               </tuple>
             </value>
         </item>