diff --git a/src/plone/api/content.py b/src/plone/api/content.py index 8bb2de8e..33fcfa7f 100644 --- a/src/plone/api/content.py +++ b/src/plone/api/content.py @@ -1,5 +1,6 @@ """Module that provides functionality for content manipulation.""" +from AccessControl import Unauthorized from copy import copy as _copy from plone.api import portal from plone.api.exc import InvalidParameterError @@ -76,7 +77,7 @@ def create( # For dexterity objects we want to not use the invokeFactory # method because we want to have the id generated by the name chooser if not fti.isConstructionAllowed(container): - raise ValueError(f"Cannot create {type}") + raise Unauthorized(f"Cannot create {type}") container_fti = container.getTypeInfo() if container_fti is not None and not container_fti.allowType(type): diff --git a/src/plone/api/tests/test_content.py b/src/plone/api/tests/test_content.py index 6de2e5e1..222092bd 100644 --- a/src/plone/api/tests/test_content.py +++ b/src/plone/api/tests/test_content.py @@ -387,6 +387,18 @@ def test_create_with_not_lowercase_id(self): ) self.assertEqual(obj.id, "Doc1") + def test_create_anonymous_unauthorized(self): + from AccessControl import Unauthorized + from plone.app.testing import logout + + logout() + with self.assertRaises(Unauthorized): + api.content.create( + container=self.portal, + type="Dexterity Item", + id="foo", + ) + def test_create_raises_unicodedecodeerror(self): """Test that the create method raises UnicodeDecodeErrors correctly.""" site = getGlobalSiteManager()