vocabularies.  redid Lexicon interface.

Changed 'password' and 'confirm' default values to use new User protocol for leaving password alone while changing roles/domains.

Modified _doChangeUser to leave password unchanged if the 'password' parameter is None.  _changeUser now always accepts "password == confirm == None", and sets 'password' to None if "password == 'password' and confirm == 'confirm'".

This gives Users an unambiguous protocol for both DTML and Python code to change roles/domains without touching the password.  editUser.dtml has a somewhat magical protocol, which users need not worry about.

createInObjectManager. There is probably a better solution.

Anthony's collector submission:

Title:  current cvs zcatalog lexicon/vocab support is broken

At: http://classic.zope.org:8080/Collector/Collector/1071/sview

Submitter:  Anthony Baxter

Description:  The current CVS version of ZCatalog has a couple of
              nasty bugs in it.

First off, the standard Lexicon uses a variable 'self.counter',
without ever initialising it. Oops.

Secondly, Catalog handles the default Lexicon inconsistently. In the
case of a lexicon being provided, it stores the name as self.lexicon,
otherwise it stores a Lexicon _object_ as self.lexicon. Later on, it
tries to do a getattr with the lexicon object as the second arg.

The first bug utterly breaks non-globbing Lexicons. The second bug
breaks textindexes that don't provide a lexicon at creation time.

A patch for both follows.  [Rather, this checkin commits both.]  Note
that the patch tries to handle gracefully existing Catalogs and
Lexicons that might be broken.

a mapping that is not a web request is passed in.

Added optional 'multipart' argument to dtml-mime, to allow specifying 'alternative' or whatever instead of 'mixed'.

Added check for streaming responses when determing whether to add a content-length header and setting a 204 response. This should fix the problem of streaming response having content-length 0 respone headers. Thanks to Toby Dickenson.

Added a lock to tempfile producers. Thanks to Toby Dickenson. This should avoid possible corruption of responses from FCGI and large HTTP responses.

Major restructuring to fix a number of bugs:

  - Methods (retrieved as attributes) were sometimes not
    bound to objects in the right context. This could cause
    acquisition to fail within the methods.

  - An optimization skipped calling the __of__ method, assuming that
    it was skipping the standard acquistion __of__ method. This could
    cause application __of__ methods to get skipped. Now the __of__
    method is never skipped. The return value is inspected to
    see if it can be simplified. In the future we might be willing
    to skip calling __of__ if we *know* that we are skipping a known
    __of__.

  - The special value, Acquired, used to force acquisition
    was not handled correctly when it was acquired from a container.

  - Some error handling was not done quite correctly. I don't know
    if this caused any problems.

  - Nested explicit acquisition wrappers may not have been handled
    correctly when accessed through attribute access of a containing
    implicit wrapper.

Reduced code by sending all searches through the same routine,
Wrapper_findattr.

Added two new features:

  - You can now assign the aq_parent attribute of a wrapper.
    This is deemed to be useful in certain applications, including
    XML/DOM.

  - The method aq_acquire hysterically has two usages:

    o To explicitly acquire from an Explicit acquirer wrapper.

    o To apply a filter to guide the search process (e.g. for security).

    Sometimes, someone might want to apply a filter without forcing
    explict acquisition. An additional optional argument was added
    to allow use of a filter without forcing explicit acquisition.