plone.restapi/unify-expired-and-excluded-items-handling: Disable CSFR protection for locking/unlocking

Repository: plone.restapi
Branch: refs/heads/unify-expired-and-excluded-items-handling
Date: 2017-07-27T10:03:13+02:00
Author: Thomas Buchberger (buchi) <t.buchberger-/8aE7x569Db/[email protected]>
Commit: https://github.com/plone/plone.restapi/commit/f949ce529e9593d6e8d5d983c287d5d4514e5a72

Disable CSFR protection for locking/unlocking

Files changed:
M src/plone/restapi/services/locking/locking.py

diff --git a/src/plone/restapi/services/locking/locking.py b/src/plone/restapi/services/locking/locking.py
index 37366093..1417d45f 100644
--- a/src/plone/restapi/services/locking/locking.py
+++ b/src/plone/restapi/services/locking/locking.py
@@ -7,6 +7,8 @@
 from zope.interface import alsoProvides
 from zope.interface import noLongerProvides
 
+import plone.protect.interfaces
+
 
 class Lock(Service):
     """Lock an object"""
@@ -14,17 +16,22 @@ class Lock(Service):
     def reply(self):
         data = json_body(self.request)
 
-        if 'stealable' in data and not data['stealable']:
-            alsoProvides(self.context, INonStealableLock)
-
         lockable = IRefreshableLockable(self.context, None)
         if lockable is not None:
             lockable.lock()
 
+            if 'stealable' in data and not data['stealable']:
+                alsoProvides(self.context, INonStealableLock)
+
             if 'timeout' in data:
                 lock_item = webdav_lock(self.context)
                 lock_item.setTimeout("Second-%s" % data['timeout'])
 
+            # Disable CSRF protection
+            if 'IDisableCSRFProtection' in dir(plone.protect.interfaces):
+                alsoProvides(self.request,
+                             plone.protect.interfaces.IDisableCSRFProtection)
+
         return lock_info(self.context)
 
 
@@ -39,6 +46,11 @@ def reply(self):
             if INonStealableLock.providedBy(self.context):
                 noLongerProvides(self.context, INonStealableLock)
 
+            # Disable CSRF protection
+            if 'IDisableCSRFProtection' in dir(plone.protect.interfaces):
+                alsoProvides(self.request,
+                             plone.protect.interfaces.IDisableCSRFProtection)
+
         return lock_info(self.context)
 
 
@@ -50,6 +62,11 @@ def reply(self):
         if lockable is not None:
             lockable.refresh_lock()
 
+            # Disable CSRF protection
+            if 'IDisableCSRFProtection' in dir(plone.protect.interfaces):
+                alsoProvides(self.request,
+                             plone.protect.interfaces.IDisableCSRFProtection)
+
         return lock_info(self.context)
 
 



------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot