README.txt

File contents

Hotfix_2000-12-18

  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses a potential security issue that affects all 
  released Zope versions up to and including Zope 2.2.4 final.

  The issue involves incorrect protection of a data updating method 
  on Image and File objects. Because the method was not correctly 
  protected, it was possible for users with DTML editing priveleges 
  to update the raw data of a File or Image object via DTML though 
  they did not have editing priveleges on the objects themselves.

  We *highly* recommend that any Zope site running versions of 
  Zope up to and including 2.2.4 have this hotfix product installed 
  to mitigate the issue if the site is accessible by untrusted users 
  who have DTML editing privileges.