From ec5acf95eb82c8318e842eee956a721caa4c7c4f Mon Sep 17 00:00:00 2001 From: nileshgulia1 Date: Fri, 7 Feb 2025 17:08:32 +0530 Subject: [PATCH 1/5] fix: disable CSRF protection on history --- src/plone/restapi/services/history/get.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/plone/restapi/services/history/get.py b/src/plone/restapi/services/history/get.py index 842785f849..e4c99345ad 100644 --- a/src/plone/restapi/services/history/get.py +++ b/src/plone/restapi/services/history/get.py @@ -1,5 +1,6 @@ from datetime import datetime as dt from datetime import timezone +import plone.protect.interfaces from plone.app.layout.viewlets.content import ContentHistoryViewlet from plone.restapi.bbb import safe_text from plone.restapi.interfaces import ISerializeToJson @@ -7,7 +8,8 @@ from plone.restapi.services import Service from zope.component import queryMultiAdapter from zope.component.hooks import getSite -from zope.interface import implementer +from zope.interface import implementer, alsoProvides + from zope.publisher.interfaces import IPublishTraverse @@ -24,6 +26,11 @@ def publishTraverse(self, request, name): def reply(self): # Traverse to historical version if self.version: + if "IDisableCSRFProtection" in dir(plone.protect.interfaces): + alsoProvides( + self.request, + plone.protect.interfaces.IDisableCSRFProtection, + ) serializer = queryMultiAdapter( (self.context, self.request), ISerializeToJson ) From ef11130d1370ebe6bba9064fbd10604871ea8962 Mon Sep 17 00:00:00 2001 From: nileshgulia1 Date: Fri, 14 Feb 2025 14:14:58 +0530 Subject: [PATCH 2/5] fix(history): provide IPortletAssignment to parent context --- src/plone/restapi/services/history/get.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/plone/restapi/services/history/get.py b/src/plone/restapi/services/history/get.py index e4c99345ad..b9bd778a4d 100644 --- a/src/plone/restapi/services/history/get.py +++ b/src/plone/restapi/services/history/get.py @@ -1,5 +1,7 @@ from datetime import datetime as dt from datetime import timezone +from Acquisition import aq_inner +from Acquisition import aq_parent import plone.protect.interfaces from plone.app.layout.viewlets.content import ContentHistoryViewlet from plone.restapi.bbb import safe_text @@ -9,7 +11,7 @@ from zope.component import queryMultiAdapter from zope.component.hooks import getSite from zope.interface import implementer, alsoProvides - +from plone.portlets.interfaces import IPortletAssignment from zope.publisher.interfaces import IPublishTraverse @@ -26,11 +28,11 @@ def publishTraverse(self, request, name): def reply(self): # Traverse to historical version if self.version: - if "IDisableCSRFProtection" in dir(plone.protect.interfaces): - alsoProvides( - self.request, - plone.protect.interfaces.IDisableCSRFProtection, - ) + parent = aq_parent(aq_inner(self.context)) + if "IPortletAssignment" in dir( + plone.portlets.interfaces + ) and not IPortletAssignment.providedBy(parent): + alsoProvides(parent, IPortletAssignment) serializer = queryMultiAdapter( (self.context, self.request), ISerializeToJson ) From f1ae318900ce2cba363c037e209019ba8d457b70 Mon Sep 17 00:00:00 2001 From: nileshgulia1 Date: Fri, 14 Feb 2025 15:32:27 +0530 Subject: [PATCH 3/5] fix: remove dangling import --- src/plone/restapi/services/history/get.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/plone/restapi/services/history/get.py b/src/plone/restapi/services/history/get.py index b9bd778a4d..2a98bfbca3 100644 --- a/src/plone/restapi/services/history/get.py +++ b/src/plone/restapi/services/history/get.py @@ -2,7 +2,6 @@ from datetime import timezone from Acquisition import aq_inner from Acquisition import aq_parent -import plone.protect.interfaces from plone.app.layout.viewlets.content import ContentHistoryViewlet from plone.restapi.bbb import safe_text from plone.restapi.interfaces import ISerializeToJson From ecc6491da92f5d038ce5caa7c6f57f2144f5b1dd Mon Sep 17 00:00:00 2001 From: nileshgulia1 Date: Fri, 14 Feb 2025 16:07:56 +0530 Subject: [PATCH 4/5] refactor: simplify import --- src/plone/restapi/services/history/get.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/plone/restapi/services/history/get.py b/src/plone/restapi/services/history/get.py index 2a98bfbca3..d0b199e064 100644 --- a/src/plone/restapi/services/history/get.py +++ b/src/plone/restapi/services/history/get.py @@ -28,9 +28,7 @@ def reply(self): # Traverse to historical version if self.version: parent = aq_parent(aq_inner(self.context)) - if "IPortletAssignment" in dir( - plone.portlets.interfaces - ) and not IPortletAssignment.providedBy(parent): + if not IPortletAssignment.providedBy(parent): alsoProvides(parent, IPortletAssignment) serializer = queryMultiAdapter( (self.context, self.request), ISerializeToJson From 9453d2713badf17be325da5e0f79e610feb58e44 Mon Sep 17 00:00:00 2001 From: nileshgulia1 Date: Fri, 14 Feb 2025 17:58:22 +0530 Subject: [PATCH 5/5] refactor: do not hard import IPortletAssignment --- src/plone/restapi/services/history/get.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/plone/restapi/services/history/get.py b/src/plone/restapi/services/history/get.py index d0b199e064..ece8626f79 100644 --- a/src/plone/restapi/services/history/get.py +++ b/src/plone/restapi/services/history/get.py @@ -10,9 +10,13 @@ from zope.component import queryMultiAdapter from zope.component.hooks import getSite from zope.interface import implementer, alsoProvides -from plone.portlets.interfaces import IPortletAssignment from zope.publisher.interfaces import IPublishTraverse +try: + from plone.portlets.interfaces import IPortletAssignment +except ImportError: + IPortletAssignment = None + @implementer(IPublishTraverse) class HistoryGet(Service): @@ -28,7 +32,10 @@ def reply(self): # Traverse to historical version if self.version: parent = aq_parent(aq_inner(self.context)) - if not IPortletAssignment.providedBy(parent): + if ( + IPortletAssignment is not None + and not IPortletAssignment.providedBy(parent) + ): alsoProvides(parent, IPortletAssignment) serializer = queryMultiAdapter( (self.context, self.request), ISerializeToJson