As a member I can add attachments to my replies/comments. about collective.ploneboard HOT 3 CLOSED

class IAttachment(model.Schema):
    attachment = NamedBlobFile(
        title=_('Attachment'),
        required=False
    )


class ICommentWithAttachmentLayer(IDiscussionLayer):
    """Marker interface that defines a browser layer."""


@configure.adapter.factory()
@adapter(Interface, ICommentWithAttachmentLayer, CommentForm)
@implementer(IFormExtender)
class CommentWithAttachmentExtender(extensible.FormExtender):
    fields = Fields(IAttachment)

    def update(self):
        self.add(IAttachment, prefix='')


@configure.monkey.patch.replacement(
    description='Patch comment to render additional fields',
    class_='plone.app.discussion.comment.Comment',
    original='getText',
    preserveOriginal=True)
def getText(self, targetMimetype=None):
    if targetMimetype is not None:
        return self._old_getText(targetMimetype)

    output = self._old_getText(targetMimetype)

    # Get attachment file
    try:
        has_attachment = bool(aq_base(self).attachment)
    except AttributeError:
        return output
    if not has_attachment:
        return output

    if not isinstance(output, unicode):
        output = output.decode('utf-8', 'ignore')

    if output:
        output += u"""
<a 
       src="{0:s}/@@download/attachment/{1:s}">Attachment</a>
""".format(self.absolute_url(), self.audio.filename)
    else:
        output += u"""
<a 
       src="{0:s}/@@download/attachment/{1:s}">Attachment</a>
""".format(self.absolute_url(), self.attachment.filename)

    return output


# Patch Comment security to allow access for audio attachment
###

# a) The first option is to allow access or all sub objects, which means that
#    anyone, who can see the comment object, can see all its (non protected)
#    attributes
Comment.__allow_access_to_unprotected_subobjects__ = 1

# b) Would be to either provide __allow_access_to_unprotected_subobjects__
#    function with check for all possible fields or configure permission
#    for the audio field. Unfortunately, the permission on the field would
#    work only if the field value is acquisition aware, which NamedBlob
#    is not, and therefore the following would not work (and would also
#    prevent option a) from working by making the subobject protected.


class EditCommentWithAttachmentForm(EditCommentForm):
    def updateWidgets(self):
        super(EditCommentWithAttachmentForm, self).updateWidgets()
        self.widgets['attachment'].value = self.context.attachment

    def _redirect(self, target=''):
        super(EditAudioCommentForm, self)._redirect(target)

        can_edit = getSecurityManager().checkPermission(
            'Edit comments', self.context)
        mtool = getToolByName(self.context, 'portal_membership')
        if mtool.isAnonymousUser() or not can_edit:
            return

        data, errors = self.extractData()
        if errors:
            return

        # Update audio
        self.context.attachment = data['attachment']


@configure.browser.page.class_(
    for_=IComment,
    name='edit-comment',
    layer=ICommentWithAttachmentLayer,
    permission='plone.app.discussion.EditComments')
class EditCommentWithAttachmentFormView(FormWrapper):
    form = EditCommentWithAttachmentForm