Interaction of plone.api (any version) with plone.app.multilingual -> CSRF issues

[zopyx]

Content created through plone.restapi lacks the _plone.tg attribute that is added by plone.app.multilingual on the fly during GET requests which causes CSRF protection errors.

Complete discussion here:

https://community.plone.org/t/csrf-issues-with-plone-5-1-2-1/6570

The behavior exists with an early 1.1.0 version and 2.0 version of plone.restapi.

Looks as if addAttributeTG() of plone.app.multilingual.itg is never called through plone.restapi invocations.

[zopyx]

The interesting part is the default front-page of Plone is also affected by the issue. The Plone site itself is created using a custom HTTP endpoint and not manually through the ZMI.

[jaroel]

Maybe we are lacking the IObjectCreated events

[buchi]

This seems not to be plone.restapi related. I've verified that IObjectCreated is fired and that addAttributeTG() is called when creating content through plone.restapi.

Seems to be an issue in p.a.multilingual with Plone 5.1 and should be tracked in plone/plone.app.multilingual#315.