[Zope] Firefox manage_changePermissions issue?

[Tony Addyman]

I have experienced the following problem on two separate Zope/Plone sites.
It is reasonably repeatable, but sometimes works without problem. I have a
ZODB saved for testing purposes. I have tried fsrecovery.py on the
database. It is not corrupted. Firefox fails on this database every time.

The scenario: I change a permission setting using the ZMI of a Plone Site. I
press the Save Changes button. Firefox sends a
POST .../manage_changePermissions message to make the required change. A
200 response is returned. Firefox then immediately sends a
GET .../manage_changePermissions without any interaction from the user.
This totally destroys the permission settings for the object. Naturally,
two transactions are logged, and undoing the second one fixes the error.
However, it took over a day of digging to work this out, and the error is
quite heart-stopping when it hits, because you are locked out of the object
- in my case the entire Plone site.

I can make this behaviour occur with Firefox repeatedly, but not quite
always. If I continue to work on a site making changes and undoing them,
sometimes the manage_changePermissions is only sent once. If I return to
the "saved" ZODB and restart Zope, the duplicate sending happens in Firefox
without fail. I have tried both Firefox-1.0.1 and Firefox-1.0.3. I have not
managed to make it happen with Mozilla-1.7.2 or Konqueror-3.3.0, but I have
been using Firefox most of the time because of the Live HTTP Headers
extension.

I have the logs, HTTP messages between browser and server, etc. I can't see
anything in the Zope Access Control source which would cause a GET to be
used after the POST. The GET is logged in the Firefox Live HTTP Headers, so
it is not being generated further down the line by a proxy.

I have a solution to apply next time this happens (use undo), but I would
really like to track this one down. Any suggestions as to what to try next?
I don't really want to study the Firefox source. I would rather learn about
Zope and Plone :-)

Thanks
Tony Addyman
-- 
Eur Ing A.M.Addyman, School of Computing, Science and Engineering
University of Salford, Salford, M5 4WT