Hotfix_2001-02-23

  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses and important security issue that affects Zope 
  versions up to and including Zope 2.3.1 b1.

  The issue is related to ZClasses in that a user with through-the-web 
  scripting capabilities on a Zope site can view and assign class attributes 
  to ZClasses, possibly allowing them to make inappropriate changes to ZClass
  instances.  
  This patch also fixes problems in the ObjectManager, PropertyManager, and
  PropertySheet classes related to mutability of method return values which
  could be perceived as a security problem.

  We *highly* recommend that any Zope site running versions of 
  Zope up to and including 2.3.1 b1 have this hotfix product installed 
  to mitigate these issues if the site is accessible by untrusted users 
  who have through-the-web scripting privileges.