You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-02-23 » README.txt

Log in
Name

Password

 

README.txt

File details
Size
1 K
File type
text/plain

File contents

Hotfix_2001-02-23

  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses and important security issue that affects Zope 
  versions up to and including Zope 2.3.1 b1.

  The issue is related to ZClasses in that a user with through-the-web 
  scripting capabilities on a Zope site can view and assign class attributes 
  to ZClasses, possibly allowing them to make inappropriate changes to ZClass
  instances.  
  This patch also fixes problems in the ObjectManager, PropertyManager, and
  PropertySheet classes related to mutability of method return values which
  could be perceived as a security problem.

  We *highly* recommend that any Zope site running versions of 
  Zope up to and including 2.3.1 b1 have this hotfix product installed 
  to mitigate these issues if the site is accessible by untrusted users 
  who have through-the-web scripting privileges.