Check add_permission.

plone · Jul 27, 2015 · c64e737 · c64e737
1 parent caf36f4
commit c64e737
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -4,6 +4,9 @@ Changelog
 2.3.3 (unreleased)
 ------------------
 
+- Check add_permission before checking constrains. Refs #37
+  [jaroel]
+
 - Remove obsolete css-class and text from statusmessages.
   [pbauer]
 

diff --git a/plone/dexterity/content.py b/plone/dexterity/content.py
@@ -726,6 +726,12 @@ def invokeFactory(self, type_name, id, RESPONSE=None, *args, **kw):
         constrains = IConstrainTypes(self, None)
 
         if constrains:
+            # Do permission check before constrain checking so we'll get
+            # an Unauthorized over a ValueError.
+            fti = queryUtility(ITypeInformation, name=type_name)
+            if fti is not None and not fti.isConstructionAllowed(self):
+                raise Unauthorized('Cannot create %s' % fti.getId())
+
             allowed_ids = [
                 fti.getId() for fti in constrains.allowedContentTypes()
             ]