portal_registry.get fails for anonymous user in skin templates

[mauritsvanrees]

Several browser view templates use context.portal_registry.get and this works fine, for example Products/CMFPlone/browser/templates/contact-info-email.pt.

But in old style skin templates it fails for anonymous users. In core Plone 5 this is for these templates:

ATContentTypes/skins/ATContentTypes/atct_topic_pdf.pt
ATContentTypes/skins/ATContentTypes/atct_topic_subtopics.pt
CMFPlone/skins/plone_content/folder_full_view_item.pt

@topiaruss This is the problem you reported in irc, caused by the second template. The offending code looks like this:

<tal:topiccontents define="
  topicContents python:here.queryCatalog(batch=True);
  use_view_action python:context.portal_registry.get('plone.types_use_view_action_in_listings', []);
  batch topicContents;"
  on-error="python:request.RESPONSE.redirect(context.absolute_url())">...</tal:topiccontents>

Workaround: change this to context.portal_registry['plone.types_use_view_action_in_listings'] and it works. You don't get the benefit of the more gracious fallback when this registry setting does not exist, but so be it. I think I will commit this.

Question I have is: should we allow access to portal_registry.get in these kinds of templates? But for now it seems easier to fix these three templates.

For reference a way to reproduce the error:

• Create a Plone 4.1 site.
• Create an old-style Topic (ATContentTypes).
• Update the buildout to Plone 5.0.
• Run the standard plone-upgrade, but not the content types upgrade.
• As admin visit the old style Topic. No problem, except that I saw a csrf confirmation dialog first.
• As anonymous user visit the old style topic. Due to the on-error in the template you get redirected, but the url is the same page, so you get redirected again. And again. Etcetera.

Another way to reproduce a similar error, due to the use of .get in folder_full_view_item.pt:

• Create a Plone 5.0 site.
• As anonymous user, visit folder_full_view in the Plone Site root. You get an Unauthorized exception because of the disallowed use of portal_registry.get.

[mauritsvanrees]

I have released Products.ATContentTypes 2.2.10 with fixes.

[jensens]

i think we can close this one