Merged Zope 2.9 branch r41704:41705 into the trunk.

Prevent publishing of Python 2.4's 'set' and 'frozenset' types.

lib/python/ZPublisher/BaseRequest.py

@@ -579,6 +579,10 @@ for name in ('NoneType', 'IntType', 'LongType', 'FloatType', 'StringType',
     if hasattr(types, name):
         itypes[getattr(types, name)] = 0
 
+# Python 2.4 no longer maintains the types module.
+itypes[set] = 0
+itypes[frozenset] = 0
+
 def typeCheck(obj, deny=itypes):
     # Return true if its ok to publish the type, false otherwise.
     return deny.get(type(obj), 1)

lib/python/ZPublisher/tests/testBaseRequest.py

@@ -102,6 +102,8 @@ class TestBaseRequest(TestCase):
         self.f1.simpleList = []
         self.f1.simpleBoolean = True
         self.f1.simpleComplex = complex(1)
+        self.f1.simpleSet = set([])
+        self.f1.simpleFrozenSet = frozenset([])
 
     def makeBaseRequest(self):
         response = HTTPResponse()
@@ -239,6 +241,12 @@ class TestBaseRequest(TestCase):
         self.assertRaises(NotFound, r.traverse, 'folder/simpleBoolean')
         self.assertRaises(NotFound, r.traverse, 'folder/simpleComplex')
 
+    def test_traverse_set_type(self):
+        from ZPublisher import NotFound
+        r = self.makeBaseRequest()
+        self.assertRaises(NotFound, r.traverse, 'folder/simpleSet')
+        self.assertRaises(NotFound, r.traverse, 'folder/simpleFrozenSet')
+
 
 def test_suite():
     return TestSuite( ( makeSuite(TestBaseRequest), ) )