You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-03-08 » README.txt

Log in




File details
1 K
File type

File contents


  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses an important security issue that affects Zope 
  version 2.3.0 and the current 2.3.1 beta 1 release.

  The issue involves an error in the 'aq_inContextOf' method of objects 
  that support acquisition. A recent change to the access validation 
  machinery made this bug begin to affect security restrictions. The bug, 
  with the change to validation, made it possible to access Zope objects 
  via acquisition that a user would not otherwise have access to. This 
  issue could allow users with enough internal knowledge of Zope to 
  perform actions higher in the object hierarchy than they should be able

  We *highly* recommend that any Zope site running Zope 2.3.0 final or any 
  alpha or beta version of 2.3.0 or 2.3.1 beta 1 have this hotfix product 
  installed to mitigate the issue. Zope 2.3.1 beta 2 will contain a fix for 
  the issue, at which time the hotfix can be removed. Zope versions prior 
  to 2.3.0 are not affected by this issue.