fix: disable CSRF protection on @history endpoint

src/plone/restapi/services/history/get.py

@@ -1,13 +1,15 @@
 from datetime import datetime as dt
 from datetime import timezone
+import plone.protect.interfaces
 from plone.app.layout.viewlets.content import ContentHistoryViewlet
 from plone.restapi.bbb import safe_text
 from plone.restapi.interfaces import ISerializeToJson
 from plone.restapi.serializer.converters import json_compatible
 from plone.restapi.services import Service
 from zope.component import queryMultiAdapter
 from zope.component.hooks import getSite
-from zope.interface import implementer
+from zope.interface import implementer, alsoProvides
+
 from zope.publisher.interfaces import IPublishTraverse
 
 
@@ -24,6 +26,11 @@ def publishTraverse(self, request, name):
     def reply(self):
         # Traverse to historical version
         if self.version:
+            if "IDisableCSRFProtection" in dir(plone.protect.interfaces):
+                alsoProvides(
+                    self.request,
+                    plone.protect.interfaces.IDisableCSRFProtection,
+                )
             serializer = queryMultiAdapter(
                 (self.context, self.request), ISerializeToJson
             )