collective / collective/rapido.core

context.app.get_record causes write on read.

Open
#7 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2
Forks
2
PR merge metrics
No merged PRs in 30d

Description

if I have the following element

```
def votes(context):
path = context.content.absolute_url_path()

record = context.app.get_record(path)
```

where votes is a BASIC element.
When included in plone this will result in a confirm dialog due to the CSRF protection

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the BASIC element example and trace the context.app.get_record entry point, especially how the read is handled under Plone's CSRF protection. Confirm the behavior around the generated path and identify the existing tests or code path involved; done means reading a record no longer causes a write or CSRF confirmation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.