api.content.get no longer returns content that is inside a inaccessible container

[pbauer]

Given a private container /Plone/cannot-view and a published item /Plone/cannot-view/can-view I cannot traverse to the item any more since Plone 5.2:

with api.env.adopt_roles(["Member"]):
    api.content.get(path="/Plone/cannot-view/can-view")

with api.env.adopt_roles(["Member"]):
    portal.restrictedTraverse("/Plone/cannot-view/can-view")

I think that breaks user-expectations of the api and should be changed.

In Plone 5.1 it still works, since Plone 5.2 it raises Unauthorized. The reason may be that a different guarded_getattr seems to be used in restrictedTraverse but I'm not sure - the import is the same but the executed code is different.

In a project I instead used unrestricedTraverse and then checked the View-permission for the object:

obj = portal.unrestrictedTraverse(path)
if obj and api.user.has_permission("View", obj=obj):
    ...

[ale-rt]

I am happy if this is fixed.

In a project I instead used unrestricedTraverse and then checked the View-permission for the object:

Which is something similar to what the catalog does:

• https://github.com/zopefoundation/Products.ZCatalog/blob/master/src/Products/ZCatalog/CatalogBrains.py#L88-L91

Fixing this issue should improve consistency.

[pbauer]

The pull-request fixes it but I'd really like to know which change is the underlying cause and if we can and should address that.