Release page content is not visible for public users

[rioksane]

Release page content is not visible for public users:
https://beta.plone.org/download/releases/6.0.0rc2

Only title is visible if you are not logged in.

[ericof]

Additional information

There is a 401 call to https://beta.plone.org/++api++/download/releases/6.0.0rc2/@types/plonerelease

[mauritsvanrees]

For me it only seems to be working. It seems like I am anonymous, there is nothing that indicates otherwise, but apparently I am logged in, which is why I can see the text.
When I open the page in the same browser in a private tab, I only see the title.

[mauritsvanrees]

Ah, that may be because at some point I was also logged in at the ClassicUI level. That may trip up some authentication logic.

[mauritsvanrees]

BTW, the anonymous contents of https://beta.plone.org/++api++/download/releases/5.2.10 look fine: they contain all the necessary information to show on this page. But the 401 for some other urls might trip this up after all.

[davisagli]

Part of what is happening here is that the default schema-based view in volto depends on the /@types REST API endpoint, and it appears that that is not public.

I think it should be, based on the zope2.View permission in the ZCML: https://github.com/plone/plone.restapi/blob/master/src/plone/restapi/services/types/configure.zcml#L11

Ah, but the view code itself does an explicit check that the user is logged in: https://github.com/plone/plone.restapi/blob/master/src/plone/restapi/services/types/get.py#L23

It's a pity this is not checking a permission, which would make it easier to change the policy.

Possible short-term workarounds I can think of:

1. Monkey patch plone.restapi.services.types.get.check_security to be a function that does nothing (after verifying that the types info doesn't have any confidential information)
2. Override this service on a browser layer with a version that doesn't do the check.
3. Write a custom view for this type that doesn't need to fetch the schema

[davisagli]

Related to plone/plone.restapi#1409

[davisagli]

Fixed in #56, works now.

@mauritsvanrees do you want to create a separate issue about the Files field?

[mauritsvanrees]

@davisagli Thanks!
Let's close this issue once the fix is live.

I have split off the look of Files in a separate issue: #57
[Edit: I have hidden my comment about it here as off-topic.]

[davisagli]

@mauritsvanrees I think this was already deployed as soon as #56 was merged.

[mauritsvanrees]

I was just about to type something like that, as it seems to be working now. :-)