File contents
Hotfix_2000-08-17
This is a "hotfix" product. Hotfix products can be installed to
incorporate modifications to Zope at runtime without requiring
an immediate installation upgrade. Hotfix products are installed
just as you would install any other Zope product.
This hotfix addresses an important security issue that affects all
released Zope versions up to and including Zope 2.2 final.
The issue involves the fact that the getRoles method of user objects
contained in the default UserFolder implementation returns a mutable
Python type. Because the mutable object is still associated with the
persistent User object, users with the ability to edit DTML could
arrange to give themselves extra roles for the duration of a single
request by mutating the roles list as a part of the request processing.
It also fixes a problem that allowed access to the roles list through
the instance. This hotfix is a superset of Hotfix_08_09_2000.
While we know of no instances of this issue being used to exploit a
site, we *highly* recommend that any Zope site running versions of
Zope prior to 2.2.1 have this hotfix product installed to mitigate
the issue if the site is accessible by untrusted users who have DTML
editing privileges.
Log in
Forgot your password?
