Saveddata action permission

[eikichi18]

Changed the permissions of the saveddata action.
Now the permissions of the action correspond to the permissions of the corresponding view.

[coveralls]

Coverage remained the same at 93.269% when pulling dbb0e4b on eikichi18:saveddata_action_permission into 01893c7 on collective:master.

[coveralls]

Coverage increased (+0.1%) to 93.393% when pulling d395f13 on eikichi18:saveddata_action_permission into 01893c7 on collective:master.

[tkimnguyen]

Thanks @eikichi18 – do you think an upgrade step is needed, or are you ok if only new sites get the correct permission for the action? I'm also wondering if this will be more permissive than people have grown to expect, so maybe you could alter the change log entry to say more specifically what you changed.

[eikichi18]

Hi @tkimnguyen , thanks for the answer.
Probably add an upgrade step it's a good choise, I'll do it as soon as.
About of changelog, I have changed the permission of saveddata action because otherwise editor user, or someone that hasn't “Manage portal” permission, can access to saveddata view but can't reach it.

[tkimnguyen]

Thanks @eikichi18 ! I was curious how PloneFormGen does this. According to https://github.com/smcmahon/Products.PloneFormGen/blob/master/Products/PloneFormGen/profiles/default/types/FormSaveDataAdapter.xml it also uses the usual permissions for access to the save data adapter, but https://github.com/smcmahon/Products.PloneFormGen/blob/master/Products/PloneFormGen/content/saveDataAdapter.py#L156 uses a DOWNLOAD_SAVED_PERMISSION from https://github.com/smcmahon/Products.PloneFormGen/blob/c463a8276f6ff062d50a8e1aae192ed193c66e09/Products/PloneFormGen/config.py#L215 I was thinking it would be nice to have a separate permission for accessing/downloading the saved data, but that's probably for another PR :)