[ZCM] [ZC] 425/ 2 Reject "DAV collections don't HEAD w/o vanilla index_html"

[Collector: Zope Bugs, Features, and Patches ...]

Issue #425 Update (Reject) "DAV collections don't HEAD w/o vanilla index_html"
 Status Rejected, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/425

==============================================================
= Reject - Entry #2 by tseaver on Apr 11, 2005 1:53 pm

 Status: Pending => Rejected

> = Request - Entry #1 by Anonymous User on Jun 6, 2002 10:24 pm
> 
> Objects that inherit from Folder (and therefore from Collection) and
> also have an index_html that's a Python method (or othewise
> nonvanilla, presumably) return a 405 (Method Not Allowed) for HTTP
> HEAD requests.
> 
> Zope 2.5.1 raises on line 57 of Collection.py.  The object raises if
> its index_html member doesn't have a HEAD attribute.
> 
> Surely it's a bug to only give HEAD for objects that return an
> index_html via hasattr/getattr.

The "published object" is already found at this point -- it is
the collection itself.  If the collection cannot acquire an
'index_html', then it can't be rendered via GET, either.

Custom folderish objects which provide their own '__call__'
and set 'index_html' to None could equally well provide their
own HEAD method.  In that case, one might argue that the current
code is wrong, as it doesn't look to see if the collection
has this behvaror.

>  What about getitem, __bobo_traverse__, and __call__?

None of those are relevant;  we have the published item in hand,
and it can't be rendered without an 'index_html' (which the
publisher *won't* find using any of those methods).

>  Shouldn't we find the object to HEAD
> via ZPublisher?  And aren't we bypassing the access control checks,
> anyway?

No.

> Would it be a good idea to try and make up a HEAD response for
> arbitrary attributes that don't support it

No.  Explicit is better than implicit.  We can't make HEAD
have the semantics that the spec requires for arbitrary objects,
because it would be as expensive to compute as doing GET.

________________________________________
= Request - Entry #1 by Anonymous User on Jun 6, 2002 10:24 pm

Objects that inherit from Folder (and therefore from Collection) and
also have an index_html that's a Python method (or othewise
nonvanilla, presumably) return a 405 (Method Not Allowed) for HTTP
HEAD requests.

Zope 2.5.1 raises on line 57 of Collection.py.  The object raises if
its index_html member doesn't have a HEAD attribute.

Surely it's a bug to only give HEAD for objects that return an
index_html via hasattr/getattr.  What about getitem,
__bobo_traverse__, and __call__?  Shouldn't we find the object to HEAD
via ZPublisher?  And aren't we bypassing the access control checks,
anyway?

Would it be a good idea to try and make up a HEAD response for
arbitrary attributes that don't support it (such as Python methods)?
Perhaps by publishing them internally, and picking whatever we can
from RESPONSE, computing Content-Length from the returned stream if
necessary?  It's inefficient, but at least it's cache-friendly... and
better for tools (er, linbot) that assume that if it can't be found
via HEAD, it isn't there.

Excerpt from Collection.HEAD():

        # Note that we are willing to acquire the default document
        # here because what we really care about is whether doing
        # a GET on this collection / would yield a 200 response.
        if hasattr(self, 'index_html'):
            if hasattr(self.index_html, 'HEAD'):
                return self.index_html.HEAD(REQUEST, RESPONSE)
            raise 'Method Not Allowed', (
                  'Method not supported for this resource.'
                  )
        raise 'Not Found', 'The requested resource does not exist.'





persephone ~/tmp= telnet viii.dclxvi.org 80
Trying 206.163.69.253...
Connected to viii.dclxvi.org.
Escape character is '^]'.
HEAD /blog HTTP/1.0
HEAD /blog HTTP/1.0


HTTP/1.1 405 Method Not Allowed
Date: Thu, 06 Jun 2002 02:22:40 GMT
Server: Apache/1.3.12 (Unix) mod_ssl/2.6.6 OpenSSL/0.9.5a
Bobo-Exception-File: /usr/local/zope/2-5-1/lib/python/webdav/Collection.py
Bobo-Exception-Line: 57
Bobo-Exception-Type: Method Not Allowed
Bobo-Exception-Value: bobo exception
Connection: close
Content-Location: http://viii.dclxvi.org/blog/
Ms-Author-Via: DAV
X-Powered-By: Zope (www.zope.org), Python (www.python.org)
Content-Length: 2106
Content-Type: text/html

==============================================================