I haven't made a status update in a while, so here goes...

Things have moved on fairly well since my last post here.  The traversal security bug is now resolved, albeit not in the way I thought it would be.  I won't provide the gory details here, but suffice it to say I ended up having to write a class named "EvilAATUSHack" ;-).

Remote authoring (aka MetaWeblogAPI) has seen some more refactoring based on improved - well, "revised", at least - interfaces for weblogs and weblog entries.  MetaWeblogAPI should now be completely generic and pluggable, such that it only depends on interfaces defined in quills.core and quills.remoteblogging.  As a consequence, it should be reusable by other projects - be they Archetypes- or pure Zope3-based.  Well, that's the idea, anyway.

These changes leave the maurits-traversal branch in pretty good shape.  One obvious problem is that I've made no effort either to update the old Quills tests, or to include any new ones for the new interfaces/functionality.  To be generous to myself, those interfaces have been in a state of flux.  Anyway, I don't consider that a barrier to merging maurits-traversal to trunk.

The real barrier is a bug I discovered in Five that means security declarations for interfaces miss out method names that are inherited from interface superclasses.  This is a pain, and a trivial fix if anyone with commit rights to svn.zope.org is reading this...