Require 'List folder contents' permission to use the catalog vocabulary.

[mauritsvanrees]

This is more correct than the View permission.

[mauritsvanrees]

Let's see if Jenkins thinks this is a good idea too.

@jenkins-plone-org please run jobs

[jensens]

Sounds better suited, but it may break something in heavily customized sites. The usual restrictions of the restrictedSearch do apply anyway, so even with View no harm is done IMO.

[ale-rt]

I agree that List folder contents looks like a better fit, but:

1. I am not really sure if we want to change this in a minor release
2. I am not sure if we want to change it at all

I am +0 on merging this one now.
I would feel more confident to merge this for Plone 6.1 only, but I might be too conservative and overcautious.

[thet]

LGTM

But I just wonder if that is a breaking change. OK, for a breaking change the effect is probably too small, but I would mention the different widgets where this change has an effect in the changelog message.

The getVocabulary seems to be used in:

• plone.app.content folder contents
• plone.app.querystring.
• related items widget (plone.app.z3cform.widgets.relateditems)
• link widget (plone.app.z3cform.widgets.link)
• ajax select widget (plone.app.z3cform.widgets.select)
• related items in TinyMCE (Products.CMFPlone.patterns.settings)
• TinyMCE link widget and related items widget

[tisto]

@mauritsvanrees what the status of this? This PR is somehow assigned to the Plone 6.1 project. Is this correct? Do we aim to include this in Plnoe 6.1?

[mauritsvanrees]

Theoretically this is better, and it gives some security hardening, but at the cost potentially breaking stuff. I am not pursuing this currently. I have reverted the PR to draft.