- fixed a traversal regression

doc/CHANGES.rst

@@ -8,7 +8,7 @@ http://docs.zope.org/zope2/releases/.
 2.13.14 (unreleased)
 --------------------
 
-
+- ZPublisher: Fixed a traversal regression introduced in 2.13.12.
 
 2.13.13 (2012-02-20)
 --------------------

src/ZPublisher/BaseRequest.py

@@ -540,7 +540,7 @@ class BaseRequest:
         if (no_acquire_flag and
             hasattr(parents[1], 'aq_base') and
             not hasattr(parents[1],'__bobo_traverse__')):
-            base = parents[-1].aq_base
+            base = parents[1].aq_base
             if not (hasattr(base, entry_name) or entry_name in base):
                 raise AttributeError(entry_name)
 

src/ZPublisher/tests/testBaseRequest.py

@@ -73,6 +73,9 @@ class BaseRequest_factory:
                 # Attribute without docstring.
                 return 'unpublishable'
 
+            def __contains__(self, name):
+                return False
+
         return DummyObjectBasic
 
     def _makeBasicObject(self):
@@ -194,6 +197,15 @@ class TestBaseRequest(unittest.TestCase, BaseRequest_factory):
         self.assertEqual(r.URL, '/folder/objBasic')
         self.assertEqual(r.response.base, '')
 
+    def test_traverse_basic_no_acquire_flag(self):
+        root, folder = self._makeRootAndFolder()
+        folder._setObject('objBasic', self._makeBasicObject())
+        r = self._makeOne(root)
+        r['REQUEST_METHOD'] = 'HEAD'
+        r.traverse('folder/objBasic')
+        self.assertEqual(r.URL, '/folder/objBasic')
+        self.assertEqual(r.response.base, '')
+
     def test_traverse_withDefault(self):
         root, folder = self._makeRootAndFolder()
         folder._setObject('objWithDefault', self._makeObjectWithDefault())