- fixed a traversal regression

zopefoundation · Feb 23, 2012 · e728c7b · e728c7b
1 parent 1dd4c83
commit e728c7b
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 2 deletions.
diff --git a/doc/CHANGES.rst b/doc/CHANGES.rst
@@ -8,7 +8,7 @@ http://docs.zope.org/zope2/releases/.
 2.13.14 (unreleased)
 --------------------
 
-
+- ZPublisher: Fixed a traversal regression introduced in 2.13.12.
 
 2.13.13 (2012-02-20)
 --------------------

diff --git a/src/ZPublisher/BaseRequest.py b/src/ZPublisher/BaseRequest.py
@@ -540,7 +540,7 @@ def traverse(self, path, response=None, validated_hook=None):
         if (no_acquire_flag and
             hasattr(parents[1], 'aq_base') and
             not hasattr(parents[1],'__bobo_traverse__')):
-            base = parents[-1].aq_base
+            base = parents[1].aq_base
             if not (hasattr(base, entry_name) or entry_name in base):
                 raise AttributeError(entry_name)
 

diff --git a/src/ZPublisher/tests/testBaseRequest.py b/src/ZPublisher/tests/testBaseRequest.py
@@ -73,6 +73,9 @@ def noview(self):
                 # Attribute without docstring.
                 return 'unpublishable'
 
+            def __contains__(self, name):
+                return False
+
         return DummyObjectBasic
 
     def _makeBasicObject(self):
@@ -194,6 +197,15 @@ def test_traverse_basic(self):
         self.assertEqual(r.URL, '/folder/objBasic')
         self.assertEqual(r.response.base, '')
 
+    def test_traverse_basic_no_acquire_flag(self):
+        root, folder = self._makeRootAndFolder()
+        folder._setObject('objBasic', self._makeBasicObject())
+        r = self._makeOne(root)
+        r['REQUEST_METHOD'] = 'HEAD'
+        r.traverse('folder/objBasic')
+        self.assertEqual(r.URL, '/folder/objBasic')
+        self.assertEqual(r.response.base, '')
+
     def test_traverse_withDefault(self):
         root, folder = self._makeRootAndFolder()
         folder._setObject('objWithDefault', self._makeObjectWithDefault())