• Yoshinori Okuji's avatar
    Correct the handling of checked_permission in · 41556f6d
    Yoshinori Okuji authored
    _getSingleCategoryAcquiredMembershipList. This fixes two issues:
    
    1. checked_permission was not propagated to recursive calls, so
       there were cases that checked_permission was ignored.
    2. this method might try to get membership by acquisitions falsely,
       because _getSingleCategoryMembershipList filtered the result
       by checked_permission, so when the user was prevented from accessing
       a category directly specified by the context, the result was empty.
    
    So the solution is to filter the result only right before returning
    from this method, and stop having other methods to filter the result.
    
    
    git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@30249 20353a03-c40f-0410-a6d1-a30d3c3de9de
    41556f6d
CategoryTool.py 78.1 KB