portal_actions / object / history wrong permission raises Forbidden in Volto Frontend

[avoinea]

It should be CMFEditions: Access previous versions

Products.CMFPlone/Products/CMFPlone/profiles/default/actions.xml

Lines 157 to 175 in 26c659a

	<object meta_type="CMF Action"
	name="history"
	i18n:domain="plone"
	>
	<property name="title"
	i18n:translate=""
	>History</property>
	<property name="description"
	i18n:translate=""
	/>
	<property name="url_expr">string:${object_url}/@@historyview</property>
	<property name="link_target" />
	<property name="icon_expr">string:toolbar-action/history</property>
	<property name="available_expr" />
	<property name="permissions">
	<element value="Modify portal content" />
	</property>
	<property name="visible">True</property>
	</object>

This is used by Volto Frontend, and while the history menu is visible, when clicking on it by a user that doesn't have Modify portal content on object, the forbidden is raised.

See:

https://github.com/plone/plone.restapi/blob/4f3bb4f1c656295f609a9aaea4540325d1b55b8e/src/plone/restapi/services/history/configure.zcml#L9-L15

And also:

https://github.com/plone/plone.app.layout/blob/1c7334194ec5eb9e57f5306bfd5e227b0b78a294/plone/app/layout/viewlets/content.py#L444-L445

And Volto:

https://github.com/plone/volto/blob/157df05e5da7cc4349f2fefaa6e3566da56a8213/packages/volto/src/components/manage/History/History.jsx#L152-L160

[davisagli]

I agree. Also probably worth fixing in an upgrade step.