Products.cmfplone: Creating an object with leading "_" fails

[tomgross]

Creating an object with leading "_" fails with the following traceback:

2015-09-28 13:19:59 ERROR Zope.SiteErrorLog 1443439199.080.174202502535 http://localhost:8008/Plone/de/++add++Folder
Traceback (innermost last):
  Module ZPublisher.Publish, line 138, in publish
  Module ZPublisher.mapply, line 77, in mapply
  Module ZPublisher.Publish, line 48, in call_object
  Module plone.z3cform.layout, line 66, in __call__
  Module plone.z3cform.layout, line 50, in update
  Module plone.dexterity.browser.add, line 130, in update
  Module plone.z3cform.fieldsets.extensible, line 59, in update
  Module plone.z3cform.patch, line 30, in GroupForm_update
  Module z3c.form.group, line 145, in update
  Module plone.app.z3cform.csrf, line 21, in execute
  Module z3c.form.action, line 98, in execute
  Module z3c.form.button, line 315, in __call__
  Module z3c.form.button, line 170, in __call__
  Module plone.dexterity.browser.add, line 105, in handleAdd
  Module z3c.form.form, line 250, in createAndAdd
  Module plone.dexterity.browser.add, line 80, in add
  Module plone.dexterity.utils, line 179, in addContentToContainer
  Module plone.app.multilingual.content.lrf, line 25, in chooseName
  Module plone.app.content.namechooser, line 53, in chooseName
  Module plone.app.content.namechooser, line 86, in _findUniqueName
ValueError: Cannot find a unique name based on _admin after 100 attemps.

Plone 5.0rc3

[hvelarde]

I think this is voided by ZPublisher

[mauritsvanrees]

A name starting with an underscore is indeed not allowed. But I guess the name chooser could compensate for this by stripping of the underscore before trying to choose a name.

[jensens]

indeed, enhancing namechooser (id from title) and a validator for the short-id field should do it.

[khanstark]

@jensens If I give name of a folder as '_abc.bc' then above errors flourish and the ValueError field comes to be like this: ValueError: Cannot find a unique name based on _abc after 100 attemps.
The things after '.' in folder name are droped after FILENAME_REGEX match in namechooser.py file and also there seems to be a trivial typo in 'attemps'.
Wouldn't it be better if traceback comes like this..?
ValueError: Cannot find a unique name based on _abc.bc after 100 attempts.
`

[idgserpro]

A name starting with an underscore is indeed not allowed.

@mauritsvanrees why an id starting with underscore is not allowed? Is it because of the url?

[mauritsvanrees]

For security reasons Zope refuses to publish any object or item that starts with an underscore, because this would give access to methods of classes that are meant to be private. So if we allow an id starting with an underscore, you would not be able to view it.

[idgserpro]

Is it possible to at least show a message to the final user when this happens? Something in the line of "You can't have an object that starts with an underscore for security reasons."

If it's not possible, IMHO this issue should be closed then.

[tomgross]

Please don't close this issue without solving it. Showing a message in the browser is not sufficient because there are other ways to create content: api, rest-api, ... which should be covered too.

[jlfy738]

I'm experiencing this issue too. "Stripping of the underscore before trying to choose a name" is the solution that was found for a similar issue #74

[jensens]

So, I tested this at demo.plone.de.

• creating a page with title _goobar works and creates an ID goobar
• renaming this page to _foobar works and creates an ID foobar.
  So I think we can close this issue. The name-chooser works as expected.