Merge pull request #550 from plone/fix_getting_content_in_inaccessibl…

…e_containers

Fix api.content.get when a item in the path is not acccessible

news/549.bugfix

@@ -0,0 +1,2 @@
+Fix api.content.get(path=path) when a item in the path is not accessible to the user.
+[pbauer]

src/plone/api/content.py

@@ -133,7 +133,12 @@ def get(path=None, UID=None):
                 relative_path=path,
             )
         try:
-            content = site.restrictedTraverse(path)
+            path = path.split("/")
+            if len(path) > 1:
+                parent = site.unrestrictedTraverse(path[:-1])
+                content = parent.restrictedTraverse(path[-1])
+            else:
+                content = site.restrictedTraverse(path[-1])
         except (KeyError, AttributeError):
             return None  # When no object is found don't raise an error
         else:

src/plone/api/tests/test_content.py

@@ -478,6 +478,16 @@ def test_get(self):
         # title is an attribute
         self.assertIsNone(api.content.get("/about/team/title"))
 
+    def test_get_of_content_in_inaccessible_container(self):
+        """Test getting items in a inaccessible container.
+        Worked in Plone 5.1 but raised Unauthorized since 5.2."""
+        api.content.transition(obj=self.team, transition="publish")
+        with api.env.adopt_roles(["Member"]):
+            team_by_path = api.content.get("/about/team")
+            self.assertEqual(self.team, team_by_path)
+            team_by_uid = api.content.get(UID=self.team.UID())
+            self.assertEqual(self.team, team_by_uid)
+
     def test_move_constraints(self):
         """Test the constraints for moving content."""
         from plone.api.exc import MissingParameterError