[zope2-tracker] [Bug 740831] [NEW] Response.write + ConflictError = desaster

[dmaurer]

Public bug reported:

"OFS.Image.File" uses "Response.write" to deliver the file content (to
avoid an additional in memory copy of the file content).

"Response.write" has a vital precondition: no error is allowed after the
first call to "Response.write" as error conditions are reflected in the
response header, sent by the first "Response.write". This vital
precondition is violated for requests which suffer from a
"ConflictError" during the transaction commit. In such a case, the
response is already delivered to "ZServer" when the "ConflictError" is
recognized. "ZPublisher" will retry the request and we get two responses
for a single request. The additional response piles up in the
communication channel and later requests will get wrong responses (until
the channel is closed) -- a desaster...

Many Plone users have been affected by this problem: see "plone-users"
"Does Zope/Plone deliver wrong content" in the first quarter of 2011.

I will publish a partial workaround on PyPI: "dm.zopepatches.fix_responsewrite_conflict". The workaround will prevent Zope to retry a request that previously has used "Response.write". The workaround is not complete: it hides the "ConflictError"
and the resulting transaction rollback from the user; thus giving him the wrong impression everything had worked correctly. The only complete fix is to get rid of "Response.write" (or "ConflictError") altogether.

The attached tgz archive contains a product to reproduce the problem. It
registers a view "responsewrite_conflict". Every second call of this
view will result in a "ConflictError" together with the use of
"Response.write". To reproduce the problem, visit the view, then visit
the top page. The top page will get the result of the retried view
visit.

** Affects: zope2
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Zope 2
Developers, which is subscribed to Zope 2.
https://bugs.launchpad.net/bugs/740831

Title:
  Response.write + ConflictError = desaster