[z3-five] Re: traversal bug with OFS.Application.Application

[Philipp von Weitershausen]

Jordan Baker wrote:
> After upgrading to Zope 2.9.2 from 2.9.0 I found that one my applications 
> wasn't working anymore.
> 
> It depended on being able to bind a page template to 
> OFS.Application.Application and through some examination I found a small bug 
> in the traversal fallback changes that were made recently.
> 
> It basically boils down to OFS.Application.Application's __bobo_traverse__ 
> raises NotFound when there is a valid REQUEST.
> 
> I've attached a unit test that demonstrates the problem and also the small 
> patch which fixes it.

I've applied the patch to all current branches of Five. The fix will be
in the next releases which will happen till next Monday, if everything
goes as scheduled.

> PS. There are two questions I had for more experienced testers on this list:
> 
> 1. Why does http() return 404 but then actually return the correct content in 
> the test case I added?

That's due to an implementation detail of
REQUEST.RESPONSE.notFoundError() which is what
OFS.Application.Application's. __bobo_traverse__ uses, instead of just
raising NotFoundError. I fixed this by manually resetting the response
status back to 200.

> 2. Why must I use zope2.View instead of zope2.Public.  If I use zope2.Public I 
> get authentication errors?

zope2.Public needs to be mapped to zope.Public before it has the effect
of 'publicness'.

zope.Public should really be just 'public'. It's not a permission but a
marker. But that's a different story.


Thanks for providing the patch!

Philipp