XML-RPC requests would cause REQUEST_METHOD to be cleared to avoid searching

for 'index_html' default views. This breaks things like Cookie Crumbler. And
yes, when you use a JavaScript XML-RPC library, the browser could include an
authentication cookie for CookieCrumbler.

Instead, do not clear REQUEST_METHOD but check for a xmlrpc.Response object
when initiating the variable that will cause 'index_html' views to be used.

This fixes Zope Collector issue #528.

doc/CHANGES.txt

@@ -129,6 +129,10 @@ Zope Changes
 
       - Collector #465: Allow XML-RPC requests with no <params /> tag.
 
+      - Collector #528: Don't clear REQUEST_METHOD for XML-RPC requests;
+        instead check for an XML-RPC Response objetc in
+        BaseRequest.traverse.
+
     Features Added
     
       - Browser ids can now be encoded in the URL and Zope can be

lib/python/ZPublisher/BaseRequest.py

@@ -10,9 +10,10 @@
 # FOR A PARTICULAR PURPOSE
 #
 ##############################################################################
-__version__='$Revision: 1.49 $'[11:-2]
+__version__='$Revision: 1.50 $'[11:-2]
 
 from urllib import quote
+import xmlrpc
 
 UNSPECIFIED_ROLES=''
 
@@ -196,7 +197,8 @@ class BaseRequest:
         # How did this request come in? (HTTP GET, PUT, POST, etc.)
         method=req_method=request_get('REQUEST_METHOD', 'GET').upper()
 
-        if method=='GET' or method=='POST':
+        if method=='GET' or method=='POST' and not isinstance(response,
+                                                              xmlrpc.Response):
             # Probably a browser
             no_acquire_flag=0
             # index_html is still the default method, only any object can

lib/python/ZPublisher/HTTPRequest.py

@@ -11,7 +11,7 @@
 #
 ##############################################################################
 
-__version__='$Revision: 1.80 $'[11:-2]
+__version__='$Revision: 1.81 $'[11:-2]
 
 import re, sys, os,  urllib, time, random, cgi, codecs
 from BaseRequest import BaseRequest
@@ -373,7 +373,6 @@ class HTTPRequest(BaseRequest):
                 meth, self.args = xmlrpc.parse_input(fs.value)
                 response=xmlrpc.response(response)
                 other['RESPONSE']=self.response=response
-                other['REQUEST_METHOD']='' # We don't want index_html!
                 self.maybe_webdav_client = 0
             else:
                 self._file=fs.file