From 35ea07b06e517452ef8db7cf6fb34a2ed6f5ebd3 Mon Sep 17 00:00:00 2001
From: ale-rt <alessandro.pisa@gmail.com>
Date: Tue, 10 Sep 2024 12:41:32 +0200
Subject: [PATCH 1/2] Do not break if a syndication feed comes from a protected
 resource

---
 news/374.bugfix                               |  2 +
 .../app/layout/links/tests/test_rssviewlet.py | 54 +++++++++++++++++++
 plone/app/layout/links/viewlets.py            |  8 ++-
 3 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 news/374.bugfix

diff --git a/news/374.bugfix b/news/374.bugfix
new file mode 100644
index 00000000..42cdb6cc
--- /dev/null
+++ b/news/374.bugfix
@@ -0,0 +1,2 @@
+Do not break if a syndication feed comes from a protected resource.
+[ale-rt]
diff --git a/plone/app/layout/links/tests/test_rssviewlet.py b/plone/app/layout/links/tests/test_rssviewlet.py
index ae12c856..aaea7e41 100644
--- a/plone/app/layout/links/tests/test_rssviewlet.py
+++ b/plone/app/layout/links/tests/test_rssviewlet.py
@@ -1,11 +1,16 @@
 from plone.app.layout.links.viewlets import RSSViewlet
 from plone.app.layout.viewlets.tests.base import ViewletsTestCase
+from plone.app.testing import login
+from plone.app.testing import logout
 from plone.app.testing import setRoles
 from plone.app.testing import TEST_USER_ID
+from plone.app.testing import TEST_USER_NAME
 from plone.base.interfaces import ISiteSyndicationSettings
 from plone.registry.interfaces import IRegistry
 from zope.component import getUtility
 
+import re
+
 
 class TestRSSViewletView(ViewletsTestCase):
     def test_RSSViewlet(self):
@@ -30,3 +35,52 @@ def test_RSSViewlet(self):
         self.assertFalse("<link" not in result)
         self.assertFalse("http://nohost/plone/atom.xml" not in result)
         self.assertFalse("http://nohost/plone/news/atom.xml" not in result)
+
+    def test_RSSViewlet_with_private_objs(self):
+        setRoles(self.portal, TEST_USER_ID, ["Manager"])
+        self.portal.invokeFactory("Folder", "news")
+        registry = getUtility(IRegistry)
+        settings = registry.forInterface(ISiteSyndicationSettings)
+        self.assertTrue(settings.allowed)
+
+        # Stream a private folder
+        self.portal.news.invokeFactory("Collection", "aggregator")
+        settings.site_rss_items = (self.portal.news.aggregator.UID(),)
+        request = self.layer["request"]
+
+        link_href_pattern = re.compile(r'<link href="(.*?)"')
+
+        # Verify that anonymous users can't see the RSS feed
+        # from the aggregator collection
+        logout()
+        viewlet = RSSViewlet(self.portal, request.clone(), None, None)
+        viewlet.update()
+        result = viewlet.render()
+
+        self.assertSetEqual(
+            {
+                "http://nohost/plone/atom.xml",
+                "http://nohost/plone/rss.xml",
+                "http://nohost/plone/RSS",
+            },
+            {match.group(1) for match in link_href_pattern.finditer(result)},
+        )
+
+        login(self.portal, TEST_USER_NAME)
+        viewlet = RSSViewlet(self.portal, request.clone(), None, None)
+        viewlet.update()
+        result = viewlet.render()
+
+        # Verify that an anonymous users can see the RSS feed
+        # from the aggregator collection
+        self.assertSetEqual(
+            {
+                "http://nohost/plone/atom.xml",
+                "http://nohost/plone/rss.xml",
+                "http://nohost/plone/RSS",
+                "http://nohost/plone/news/aggregator/atom.xml",
+                "http://nohost/plone/news/aggregator/rss.xml",
+                "http://nohost/plone/news/aggregator/RSS",
+            },
+            {match.group(1) for match in link_href_pattern.finditer(result)},
+        )
diff --git a/plone/app/layout/links/viewlets.py b/plone/app/layout/links/viewlets.py
index 4be24c2d..cbcadc42 100644
--- a/plone/app/layout/links/viewlets.py
+++ b/plone/app/layout/links/viewlets.py
@@ -1,3 +1,4 @@
+from AccessControl import Unauthorized
 from Acquisition import aq_inner
 from plone.app.layout.viewlets import ViewletBase
 from plone.app.uuid.utils import uuidToObject
@@ -156,7 +157,12 @@ def update(self):
                     for uid in settings.site_rss_items:
                         if not uid:
                             continue
-                        obj = uuidToObject(uid)
+                        try:
+                            obj = uuidToObject(uid)
+                        except Unauthorized:
+                            # Do not break if we do not have enough permission
+                            # to access the object
+                            obj = None
                         if obj is None and uid[0] == "/":
                             obj = portal.restrictedTraverse(uid.lstrip("/"), None)
                         if obj is not None:

From 1f16d91a81de14eb4ff23722ce2a701ab85a72de Mon Sep 17 00:00:00 2001
From: David Glick <david@glicksoftware.com>
Date: Tue, 10 Sep 2024 09:10:24 -0700
Subject: [PATCH 2/2] Update plone/app/layout/links/tests/test_rssviewlet.py

---
 plone/app/layout/links/tests/test_rssviewlet.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plone/app/layout/links/tests/test_rssviewlet.py b/plone/app/layout/links/tests/test_rssviewlet.py
index aaea7e41..b90b8de7 100644
--- a/plone/app/layout/links/tests/test_rssviewlet.py
+++ b/plone/app/layout/links/tests/test_rssviewlet.py
@@ -71,7 +71,7 @@ def test_RSSViewlet_with_private_objs(self):
         viewlet.update()
         result = viewlet.render()
 
-        # Verify that an anonymous users can see the RSS feed
+        # Verify that an authenticated user can see the RSS feed
         # from the aggregator collection
         self.assertSetEqual(
             {