Anonymous adding of unpublished content

The most typical example of this is probably registration for an event, but it is applicable for all situations where the anonymous users should be able to submit information that is not supposed to be shared with the rest of the world.

Other examples include a FAQ where anonymous users should be able to post questions, but the questions should remain unpublished until they are answered; or a writing competition where participants should be able to post their essays, but the essays should not be visible for the rest of the world.

This is my first howto, and I'm not in any way a Plone expert, so there are no guarantees that this howto isn't silly or dangerous. All I know is that this works well for me.

To sum up. What happens here is that the workflow state is changed when the user press save. The new state is unavailable for anonymous users, but as the user is redirected, first to the parent folder (which the user of course never sees) and then to some other content, the user won't end up with a login prompt, everything works out as it should, and everybody is happy ever after. Hopefully.

(First of all. If you don't know ArchGenXML and Archetypes, you should take a look at Sean Kellys screencast Getting Your Feet Wet with Plone.)

Step 1

Set up a workflow with at least two states and one transition. For example the state «Created» and «Submitted», and the transition «Submit». You can read more about workflows in Jon Stahls Creating Workflows in Plone.

Step 2

Get the permissions right. First you give anonymous users permission to «Add portal content» in the parent folder. This can be done by manually setting the permissions through the ZMI, or by adding it to the workflow permissions of the parent folder.

Then you set the permissions of the «Created» state so that anonymous users can view and edit content, and the permissions of the «Submitted» state so that anonymous users cannot view or edit content.

If you don't know how to set the permissions, search for «permissions» and «security» in the documentation section of plone.org, and read Dana Cordes howto.

Step 3

Make the workflow change state automatically by customizing the python script in archetypes/content_edit_impl. Add the following to the second last line (remember to replace «Submit» with the name of your transition):

new_context.portal_workflow.doActionFor(new_context, 'Submit')

(The transitions of a workflow has an attribute called «trigger type». This could be set to «automatic», which would seem to do the trick, but doesn't actually work in this case.)

Step 4

Next is to make sure that the user is redirected to content that anonymous users have permission to view. Otherwise, the anonymous user will be asked to login to see the recently added content in its Submitted state, which isn't the best way to say «Thanks for registering»...

For this, change the last line in a customized version of archetypes/content_edit_impl. I've chosen to change new_context to new_context.aq_parent, like this:

return state.set(status='success',
                 context=new_context.aq_parent,
                 portal_status_message=portal_status_message)

This sends the user to the parent folder of the currently added content, instead of the content itself.

Step 5

Sending the user back to the parent folder might confuse the user and make him or her think that something went wrong, so you should also add a redirect to some sort of «Thank you» page. This can be done by adding the following the the end of the metadata of archetypes/content_edit.py:

action.success = redirect_to:string:name_of_my_thank_you_page_template

You still need to do the fourth step, even though I can't explain exactly why. It should have been possible to add a next_action-attribute to the state.set(...) in the fourth step, but I couldn't get this to work.