use tmp registry isntead of seperate serializer class.

src/plone/restapi/serializer/registry.py

@@ -6,51 +6,35 @@
 from zope.component import getMultiAdapter
 from zope.interface import implementer
 from zope.publisher.interfaces import IRequest
-from zope.interface import Interface
-
-
-class SerializeRegistryMixin:
-    def serialize(self):
-        batch = HypermediaBatch(self.request, list(self.records.keys()))
-        results = {
-            "@id": batch.canonical_url,
-            "items_total": batch.items_total,
-            "batching": batch.links if batch.links else {},
-            "items": [self.make_item(key) for key in batch],
-        }
-        return results
-
-    def make_item(self, key):
-        record = self.records[key]
-        schema = getMultiAdapter(
-            (record.field, record, self.request), IJsonSchemaProvider
-        )
-        return {
-            "name": key,
-            "value": self.records[key],
-            "schema": {"properties": schema.get_schema()},
-        }
-
-
-@implementer(ISerializeToJson)
-@adapter(IRegistry, IRequest, Interface)
-class SerializeRegistryToJsonWithFilters(SerializeRegistryMixin):
-    def __init__(self, registry, request, records):
-        self.registry = registry
-        self.request = request
-        self.records = records
-
-    def __call__(self):
-        return self.serialize()
 
 
 @implementer(ISerializeToJson)
 @adapter(IRegistry, IRequest)
-class SerializeRegistryToJson(SerializeRegistryMixin):
+class SerializeRegistryToJson:
     def __init__(self, registry, request):
         self.registry = registry
         self.request = request
-        self.records = registry.records
 
     def __call__(self):
-        return self.serialize()
+        records = self.registry.records
+        # Batch keys, because that is a simple BTree
+        batch = HypermediaBatch(self.request, list(records))
+
+        results = {}
+        results["@id"] = batch.canonical_url
+        results["items_total"] = batch.items_total
+        if batch.links:
+            results["batching"] = batch.links
+
+        def make_item(key):
+            record = records[key]
+            schema = getMultiAdapter(
+                (record.field, record, self.request), IJsonSchemaProvider
+            )
+            data = {"name": key, "value": self.registry[key]}
+            __traceback_info__ = (record, record.field, schema)
+            data["schema"] = {"properties": schema.get_schema()}
+            return data
+
+        results["items"] = [make_item(key) for key in batch]
+        return results

src/plone/restapi/services/registry/get.py

@@ -1,3 +1,4 @@
+from plone.registry import Registry
 from plone.registry.interfaces import IRegistry
 from plone.restapi.interfaces import ISerializeToJson
 from plone.restapi.serializer.converters import json_compatible
@@ -6,6 +7,8 @@
 from zope.component import getUtility
 from zope.interface import implementer
 from zope.publisher.interfaces import IPublishTraverse
+import plone.protect.interfaces
+from zope.interface import alsoProvides
 
 
 @implementer(IPublishTraverse)
@@ -35,15 +38,20 @@ def reply(self):
             value = registry[self._get_record_name]
             return json_compatible(value)
         else:  # batched listing
-            records_dict = dict(**registry.records)
             if q := self.request.form.get("q"):
-                filtered_records = {}
-                for key in records_dict.keys():
+                # Disable CSRF protection
+                if "IDisableCSRFProtection" in dir(plone.protect.interfaces):
+                    alsoProvides(
+                        self.request, plone.protect.interfaces.IDisableCSRFProtection
+                    )
+
+                tmp_registry = Registry()
+                for key in registry.records.keys():
                     if key.startswith(q):
-                        filtered_records[key] = records_dict[key]
-                records_dict = filtered_records
+                        tmp_registry.records[key] = registry.records[key]
+                registry = tmp_registry
             serializer = getMultiAdapter(
-                (registry, self.request, records_dict),
+                (registry, self.request),
                 ISerializeToJson,
             )
             return serializer()