Merged 2.10 branch r77227:77228 into 2.9 branch.

The REQUEST should not accept holds after it has been closed.

doc/CHANGES.txt

@@ -10,6 +10,8 @@ Zope Changes
 
       - Collector #1306: Missing acquisition context on local roles screen.
 
+      - The REQUEST no longer accepts holds after it has been closed.
+
       - Collector #2153: Supporting unquoted cookies with spaces.
 
       - Collector #2295: Comments in PythonScripts could lead to syntax

lib/python/ZPublisher/BaseRequest.py

@@ -506,7 +506,8 @@ class BaseRequest:
     def _hold(self, object):
         """Hold a reference to an object to delay it's destruction until mine
         """
-        self._held=self._held+(object,)
+        if self._held is not None:
+            self._held=self._held+(object,)
 
 def exec_callables(callables):
     result = None

lib/python/ZPublisher/tests/testBaseRequest.py

@@ -247,6 +247,17 @@ class TestBaseRequest(TestCase):
         self.assertRaises(NotFound, r.traverse, 'folder/simpleSet')
         self.assertRaises(NotFound, r.traverse, 'folder/simpleFrozenSet')
 
+    def test_hold_after_close(self):
+        # Request should no longer accept holds after it has been closed
+        r = self.makeBaseRequest()
+        r._hold(lambda x: None)
+        self.assertEqual(len(r._held), 1)
+        r.close()
+        # No more holding from now on
+        self.assertEqual(r._held, None)
+        r._hold(lambda x: None)
+        self.assertEqual(r._held, None)
+
 
 import zope.interface
 import zope.component