[Zope-dev] Why does restrictedTraverse() in Zope 2 not respect IPublishTraverse adapters?

Tres Seaver tseaver at palladion.com
Thu May 14 12:55:27 EDT 2009

Hash: SHA1

Martin Aspeli wrote:

> There's currently a funny inconsistency in Zope's Traversable class. If 
> you have a URL like http://localhost:8080/path/to/@@aview/foo, and 
> @@aview implements IPublishTraverse (and, I presume, if there's a custom 
> IPublishTraverse adapter for any other path component), URL traversal 
> will work fine, but calling to.restrictedTraverse('@@aview/foo') or some 
> variant thereof will fail, because (un)restrictedTraverse() does not 
> respect custom IPublishTraverse adapters.

'restrictedTraverse' is not (and never has been) the same as URL
traversal.  For instance:

- - URL traversal does no security checking until it finds the published

- - URL traveresal manages the '__before_publishing_traverse__' hooks.

If you want your adapter to be respected by *both*, it needs to
implement the appropriate interfaces for both.

> I can kind of see why it's done like this since it's called 
> I*Publish*Traverse, but it is a pain.
> Note that namespace traversal (like ++skin++) works fine with 
> restrictedTraverse().
> I don't think it'd be hard to implement this, but:
>   - is this a bug?


>   - is there a reason not to do this?

- -1 to adding any more majyk to the over-complicated Z3-style traversal
dance inside Zope2, especially as it would involve a bunch of subtle
behavior changes which would be hard to explain.

For maximum portability across Z2 / Z3 / BFG, you could just do the same
thing and implement __getitem__ on any object you want to be traversable
by either the publisher or APIs like (un)restrictedTraverse, and forego
the over-complicated  component-laden traversal dance. ;)

- --
Tres Seaver          +1 540-429-0999          tseaver at palladion.com
Palladion Software   "Excellence by Design"    http://palladion.com
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


More information about the Zope-Dev mailing list