[Zope-dev] Why does restrictedTraverse() in Zope 2 not respect IPublishTraverse adapters?

[Tres Seaver]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin Aspeli wrote:

> There's currently a funny inconsistency in Zope's Traversable class. If 
> you have a URL like http://localhost:8080/path/to/@@aview/foo, and 
> @@aview implements IPublishTraverse (and, I presume, if there's a custom 
> IPublishTraverse adapter for any other path component), URL traversal 
> will work fine, but calling to.restrictedTraverse('@@aview/foo') or some 
> variant thereof will fail, because (un)restrictedTraverse() does not 
> respect custom IPublishTraverse adapters.

'restrictedTraverse' is not (and never has been) the same as URL
traversal.  For instance:

- - URL traversal does no security checking until it finds the published
  object.

- - URL traveresal manages the '__before_publishing_traverse__' hooks.


If you want your adapter to be respected by *both*, it needs to
implement the appropriate interfaces for both.

> I can kind of see why it's done like this since it's called 
> I*Publish*Traverse, but it is a pain.
> 
> Note that namespace traversal (like ++skin++) works fine with 
> restrictedTraverse().
> 
> I don't think it'd be hard to implement this, but:
> 
>   - is this a bug?

No.

>   - is there a reason not to do this?

- -1 to adding any more majyk to the over-complicated Z3-style traversal
dance inside Zope2, especially as it would involve a bunch of subtle
behavior changes which would be hard to explain.

For maximum portability across Z2 / Z3 / BFG, you could just do the same
thing and implement __getitem__ on any object you want to be traversable
by either the publisher or APIs like (un)restrictedTraverse, and forego
the over-complicated  component-laden traversal dance. ;)


Tres.
- --
===================================================================
Tres Seaver          +1 540-429-0999          tseaver at palladion.com
Palladion Software   "Excellence by Design"    http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFKDEz/+gerLs4ltQ4RAlYAAJ436Gtk2+ibpVAX/8H+Q6BOJ3+AWQCfT7HC
kDTUth7NAOCOt6yrAWR20jY=
=NvUz
-----END PGP SIGNATURE-----