From 335e2c586bcd8841b14c9c0c281ef6b6b20b4ec4 Mon Sep 17 00:00:00 2001
From: Luca Fabbri <luca@keul.it>
Date: Fri, 12 Apr 2013 18:17:19 +0200
Subject: [PATCH] fixed workflows

---
 CHANGES.rst                                   |  5 ++
 Products/Poi/profiles.zcml                    |  8 ++
 Products/Poi/profiles/default/metadata.xml    |  2 +-
 .../poi_issue_workflow/definition.xml         | 31 ++++++--
 .../poi_tracker_workflow/definition.xml       | 76 ++++++++++++++-----
 5 files changed, 98 insertions(+), 24 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index f1dbdaa0..bb9c05fc 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,6 +7,11 @@ Changelog for Poi
 
 - Updated italian translation
   [keul]
+- Now supporting the "Site Administrator" role
+  [keul]
+- Fix tracker security; issues inside private folder
+  must not be visible to anonymous users
+  [keul]
 
 2.2.2 (2013-04-04)
 ------------------
diff --git a/Products/Poi/profiles.zcml b/Products/Poi/profiles.zcml
index 3f7ad5ba..3eb0c910 100644
--- a/Products/Poi/profiles.zcml
+++ b/Products/Poi/profiles.zcml
@@ -111,4 +111,12 @@
       handler="Products.Poi.migration.migrate_tracker_watchers"
       profile="Products.Poi:default" />
 
+  <gs:upgradeStep
+      title="Run workflow import step"
+      description="Updating workflow to reflect changes"
+      source="2005"
+      destination="2006"
+      handler="Products.Poi.migration.run_workflow_step"
+      profile="Products.Poi:default" />
+
 </configure>
diff --git a/Products/Poi/profiles/default/metadata.xml b/Products/Poi/profiles/default/metadata.xml
index 72e347ec..d7b3dd42 100644
--- a/Products/Poi/profiles/default/metadata.xml
+++ b/Products/Poi/profiles/default/metadata.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <metadata>
-  <version>2005</version>
+  <version>2006</version>
   <dependencies>
     <dependency>profile-Products.AddRemoveWidget:default</dependency>
     <dependency>profile-Products.DataGridField:default</dependency>
diff --git a/Products/Poi/profiles/default/workflows/poi_issue_workflow/definition.xml b/Products/Poi/profiles/default/workflows/poi_issue_workflow/definition.xml
index e667c695..7dc432a2 100644
--- a/Products/Poi/profiles/default/workflows/poi_issue_workflow/definition.xml
+++ b/Products/Poi/profiles/default/workflows/poi_issue_workflow/definition.xml
@@ -7,18 +7,21 @@
   <exit-transition transition_id="open-closed"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -28,17 +31,20 @@
   <exit-transition transition_id="postpone"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -74,17 +80,20 @@
   <exit-transition transition_id="reject-open"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -94,17 +103,20 @@
   <exit-transition transition_id="open-postponed"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -113,17 +125,20 @@
   <exit-transition transition_id="open-rejected"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -133,18 +148,21 @@
   <exit-transition transition_id="confirm-resolved"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -156,17 +174,20 @@
   <exit-transition transition_id="resolve-unconfirmed"/>
   <permission-map name="Delete objects" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="True">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Modify issue state" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -276,7 +297,7 @@
  <variable variable_id="action" for_catalog="False" for_status="True" update_always="True">
   <description>The last transition</description>
   <default>
-
+   
    <expression>transition/getId|nothing</expression>
   </default>
   <guard>
@@ -285,7 +306,7 @@
  <variable variable_id="actor" for_catalog="False" for_status="True" update_always="True">
   <description>The ID of the user who performed the last transition</description>
   <default>
-
+   
    <expression>user/getId</expression>
   </default>
   <guard>
@@ -294,7 +315,7 @@
  <variable variable_id="comments" for_catalog="False" for_status="True" update_always="True">
   <description>Comments about the last transition</description>
   <default>
-
+   
    <expression>python:state_change.kwargs.get('comment', '')</expression>
   </default>
   <guard>
@@ -303,7 +324,7 @@
  <variable variable_id="review_history" for_catalog="False" for_status="False" update_always="False">
   <description>Provides access to workflow history</description>
   <default>
-
+   
    <expression>state_change/getHistory</expression>
   </default>
   <guard>
@@ -314,7 +335,7 @@
  <variable variable_id="time" for_catalog="False" for_status="True" update_always="True">
   <description>Time of the last transition</description>
   <default>
-
+   
    <expression>state_change/getDateTime</expression>
   </default>
   <guard>
diff --git a/Products/Poi/profiles/default/workflows/poi_tracker_workflow/definition.xml b/Products/Poi/profiles/default/workflows/poi_tracker_workflow/definition.xml
index c8833190..a10fa529 100644
--- a/Products/Poi/profiles/default/workflows/poi_tracker_workflow/definition.xml
+++ b/Products/Poi/profiles/default/workflows/poi_tracker_workflow/definition.xml
@@ -11,43 +11,54 @@
   <exit-transition transition_id="open"/>
   <exit-transition transition_id="protect"/>
   <exit-transition transition_id="restrict"/>
-  <permission-map name="Access contents information" acquired="False">
-   <permission-role>Anonymous</permission-role>
+  <permission-map name="Access contents information" acquired="True">
+   <permission-role>Contributor</permission-role>
+   <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Add portal content" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Add Issue" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Add Response" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Edit response" acquired="False">
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
-  <permission-map name="View" acquired="False">
-   <permission-role>Anonymous</permission-role>
+  <permission-map name="View" acquired="True">
+   <permission-role>Contributor</permission-role>
+   <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -56,11 +67,14 @@
   <exit-transition transition_id="close"/>
   <exit-transition transition_id="protect"/>
   <exit-transition transition_id="restrict"/>
-  <permission-map name="Access contents information" acquired="False">
-   <permission-role>Anonymous</permission-role>
+  <permission-map name="Access contents information" acquired="True">
+   <permission-role>Contributor</permission-role>
+   <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -69,12 +83,14 @@
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Add Issue" acquired="False">
@@ -82,6 +98,7 @@
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -90,20 +107,25 @@
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Edit response" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
-  <permission-map name="View" acquired="False">
-   <permission-role>Anonymous</permission-role>
+  <permission-map name="View" acquired="True">
+   <permission-role>Contributor</permission-role>
+   <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -119,6 +141,7 @@
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
    <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -126,6 +149,7 @@
    <permission-role>Contributor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -133,12 +157,14 @@
    <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Add Issue" acquired="False">
    <permission-role>Contributor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -146,12 +172,14 @@
    <permission-role>Contributor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Edit response" acquired="False">
    <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -161,20 +189,24 @@
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
    <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
  </state>
  <state state_id="restricted" title="Only members can submit">
-  <description>Anonymous can view issues and responses.  Only members can add them.</description>
+  <description>Issues are free for access. Only members can add them.</description>
   <exit-transition transition_id="close"/>
   <exit-transition transition_id="open"/>
   <exit-transition transition_id="protect"/>
-  <permission-map name="Access contents information" acquired="False">
-   <permission-role>Anonymous</permission-role>
+  <permission-map name="Access contents information" acquired="True">
+   <permission-role>Contributor</permission-role>
+   <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -182,18 +214,21 @@
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Modify portal content" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Add Issue" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -201,20 +236,25 @@
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
   <permission-map name="Poi: Edit response" acquired="False">
    <permission-role>Manager</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
-  <permission-map name="View" acquired="False">
-   <permission-role>Anonymous</permission-role>
+  <permission-map name="View" acquired="True">
+   <permission-role>Contributor</permission-role>
+   <permission-role>Editor</permission-role>
    <permission-role>Manager</permission-role>
    <permission-role>Member</permission-role>
    <permission-role>Owner</permission-role>
+   <permission-role>Reader</permission-role>
+   <permission-role>Site Administrator</permission-role>
    <permission-role>Technician</permission-role>
    <permission-role>TrackerManager</permission-role>
   </permission-map>
@@ -254,7 +294,7 @@
  <variable variable_id="action" for_catalog="False" for_status="True" update_always="True">
   <description>The last transition</description>
   <default>
-
+   
    <expression>transition/getId|nothing</expression>
   </default>
   <guard>
@@ -263,7 +303,7 @@
  <variable variable_id="actor" for_catalog="False" for_status="True" update_always="True">
   <description>The ID of the user who performed the last transition</description>
   <default>
-
+   
    <expression>user/getId</expression>
   </default>
   <guard>
@@ -272,7 +312,7 @@
  <variable variable_id="comments" for_catalog="False" for_status="True" update_always="True">
   <description>Comments about the last transition</description>
   <default>
-
+   
    <expression>python:state_change.kwargs.get('comment', '')</expression>
   </default>
   <guard>
@@ -281,7 +321,7 @@
  <variable variable_id="review_history" for_catalog="False" for_status="False" update_always="False">
   <description>Provides access to workflow history</description>
   <default>
-
+   
    <expression>state_change/getHistory</expression>
   </default>
   <guard>
@@ -292,7 +332,7 @@
  <variable variable_id="time" for_catalog="False" for_status="True" update_always="True">
   <description>Time of the last transition</description>
   <default>
-
+   
    <expression>state_change/getDateTime</expression>
   </default>
   <guard>