topic Re: "Can ask for publishing" permission has no effect in Nuxeo Forum

"Can ask for publishing" permission has no effect

arubiom00_ — Fri, 24 Oct 2014 13:02:53 GMT

Steps to reproduce the error using Nuxeo 5.9.5 virtual machine:

Create a new user
Create a new section. Assign to the previous user the read permission and deny "Can ask for publishing" permission.
Log in as the created user, create a document and publish it in the section.

Is there a way to enable users to see a section without being able to publish in it?

Thanks in advance. Regards.

Re: "Can ask for publishing" permission has no effect

Florent_Guillau — Wed, 05 Nov 2014 19:07:02 GMT

This is expected, as Read includes CanAskForPublishing and if you allow Read before denying CanAskForPublishing then the deny won't matter.

Note that this changed for Nuxeo 6.0 (NXP-15563).

Re: "Can ask for publishing" permission has no effect

arubiom00_ — Fri, 07 Nov 2014 13:38:02 GMT

Hi Florent,

Re: "Can ask for publishing" permission has no effect

Florent_Guillau — Fri, 07 Nov 2014 17:11:21 GMT

The order in which you do 2. and 3. in the UI doesn't matter, in both cases from this screen Nuxeo will write the resulting ACL with the grants before the denies, so the granting of Read will come before the denying of CanAskForPublishing. Try with two levels of sections, doing the deny at one level and the grant in a subsection. Or use Java code or Automation to write a more fine-grained ACL on the object than what the UI does.