collective / collective/rapido.core
context.app.get_record causes write on read.
- Dominant language
- Python
- Stars
- 2
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
if I have the following element
```
def votes(context):
path = context.content.absolute_url_path()
record = context.app.get_record(path)
```
where votes is a BASIC element.
When included in plone this will result in a confirm dialog due to the CSRF protection
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the BASIC element example and trace the context.app.get_record entry point, especially how the read is handled under Plone's CSRF protection. Confirm the behavior around the generated path and identify the existing tests or code path involved; done means reading a record no longer causes a write or CSRF confirmation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100