[Zope-Checkins] SVN: Products.Five/branches/1.4/ Fix traversal issues with WebDAV/HEAD requests

Alec Mitchell apm13 at columbia.edu
Tue Aug 1 14:02:12 EDT 2006


Log message for revision 69328:
  Fix traversal issues with WebDAV/HEAD requests
  

Changed:
  U   Products.Five/branches/1.4/CHANGES.txt
  U   Products.Five/branches/1.4/browser/tests/test_traversable.py
  U   Products.Five/branches/1.4/traversable.py

-=-
Modified: Products.Five/branches/1.4/CHANGES.txt
===================================================================
--- Products.Five/branches/1.4/CHANGES.txt	2006-08-01 16:57:11 UTC (rev 69327)
+++ Products.Five/branches/1.4/CHANGES.txt	2006-08-01 18:02:11 UTC (rev 69328)
@@ -8,6 +8,8 @@
 Bugfixes
 --------
 
+* Fix problem with WebDAV/HEAD requests due to new traversal order.
+
 * Made the pythonproducts monkey patching more robust by checking to
   ensure patches aren't reapplied and cleaning up after itself.
 

Modified: Products.Five/branches/1.4/browser/tests/test_traversable.py
===================================================================
--- Products.Five/branches/1.4/browser/tests/test_traversable.py	2006-08-01 16:57:11 UTC (rev 69327)
+++ Products.Five/branches/1.4/browser/tests/test_traversable.py	2006-08-01 18:02:11 UTC (rev 69328)
@@ -301,6 +301,19 @@
       ...
       The mouse has been eaten by the eagle
 
+    Head requests have some unusual behavior in Zope 2, in particular, a failed
+    item lookup on an ObjectManager returns a NullResource, rather
+    than raising a KeyError.  We need to make sure that this doesn't
+    result in acquired attributes being shadowed by the NullResource:
+
+      >>> print http(r'''
+      ... HEAD /test_folder_1_/ftf/mouse HTTP/1.1
+      ...
+      ... ''')
+      HTTP/1.1 200 OK
+      ...
+
+
     Clean up:
 
       >>> from zope.app.testing.placelesssetup import tearDown

Modified: Products.Five/branches/1.4/traversable.py
===================================================================
--- Products.Five/branches/1.4/traversable.py	2006-08-01 16:57:11 UTC (rev 69327)
+++ Products.Five/branches/1.4/traversable.py	2006-08-01 18:02:11 UTC (rev 69328)
@@ -27,6 +27,7 @@
 from zope.app.interface import queryType
 
 from Acquisition import aq_base
+from webdav.NullResource import NullResource
 import Products.Five.security
 from zExceptions import NotFound
 from ZPublisher import xmlrpc
@@ -60,7 +61,7 @@
         # 1. If an object has __bobo_traverse__, use it.
         # 2. Otherwise do attribute look-up or, if that doesn't work,
         #    key item lookup.
-
+        result = _marker
         if hasattr(self, '__fallback_traverse__'):
             try:
                 return self.__fallback_traverse__(REQUEST, name)
@@ -81,7 +82,12 @@
                 return getattr(self, name)
             try:
                 # item access should never acquire
-                return self[name]
+                result = self[name]
+                # WebDAV requests will always return something,
+                # sometimes it's a NullResource, which we will ignore
+                # and return later if necessary
+                if not isinstance(result, NullResource):
+                    return result
             except (KeyError, IndexError, TypeError, AttributeError):
                 pass
 
@@ -116,7 +122,12 @@
             pass
 
         # Fallback on acquisition, let it raise an AttributeError if it must
-        return getattr(self, name)
+        try:
+            return getattr(self, name)
+        except AttributeError:
+            if result is not _marker:
+                return result
+            raise
 
     __bobo_traverse__.__five_method__ = True
 



More information about the Zope-Checkins mailing list