Plone 4: image scale keeps getting regenerated

[mauritsvanrees]

• Plone 4 (coredev) plus plone.protect 3 (master)
• Create a Plone Site
• Add an Image (normal Archetypes type)
• Edit the front-page
• Click the TinyMCE icon to browse images
• The image that you already uploaded shows fine.
• But the instance log show an error: aborting transaction due to no CSRF protection on url http://localhost:8080/Ploneprotect/kitten-978-440.jpg/@@images/image/index_html
• Visit this url manually (with or without index_html, which is a Zope detail) and you see the scale just fine, but every time get that same abort transaction message in the log.
• No blobs get added in the blobstorage.
• When I change plone.protect to not abort the transaction, the message is gone and one blob gets added.
• When I undo that change, the message is not shown anymore for this image, because the scale has been generated and committed in the blobstorage.

I will create a pull request, which is basically a port of some logic in plone4.csrffixes.

[mauritsvanrees]

Pull request added. Alternatively, if we think this is not needed on Plone 5, we could make it clear in documentation that on Plone 4 you really still should use the plone4.csrffixes package (plus plone.protect 3, but that is handled in setup.py), although most of its patches have been merged to the relevant packages. Note that this issue and pull request do nothing with the protect.js from issue #42.