You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-03-08 » Zope hotfix: Acquisition context checking » View NewsItem

Log in
Name

Password

 

Zope hotfix: Acquisition context checking

This hotfix addresses an important security issue that affects Zope version 2.3.0 and the current 2.3.1 beta 1 release.

The issue involves an error in the aq_inContextOf method of objects that support acquisition. A recent change to the access validation machinery made this bug begin to affect security restrictions. The bug, with the change to validation, made it possible to access Zope objects via acquisition that a user would not otherwise have access to. This issue could allow users with enough internal knowledge of Zope to perform actions higher in the object hierarchy than they should be able to.

We highly recommend that any Zope site running Zope 2.3.0 final or any alpha or beta version of 2.3.0 or 2.3.1 beta 1 have this hotfix product installed to mitigate the issue. Zope 2.3.1 beta 2 will contain a fix for the issue, at which time the hotfix can be removed. Zope versions prior to 2.3.0 are not affected by this issue.

README

http://www.zope.org/Products/Zope/Hotfix_2001-03-08/Hotfix_2001-03-08.tgz