You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-09-28 » README.txt

Log in
Name

Password

 

README.txt

File details
Size
1 K
File type
text/plain

File contents

Hotfix_2001-09-28

  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses an important security issue that affects Zope 
  versions 2.2.0 through 2.4.1.

  The issue involves the "fmt" attribute of dtml-var tags.  Without
  this correction, Zope does not check security access to methods
  invoked through "fmt".  This issue could allow partially trusted
  users with enough knowledge of Zope to call, in a limited way,
  methods they would not otherwise be allowed to access.

  We highly recommend that any Zope site running Zope 2.2.0 through Zope
  2.4.1 have this hotfix product installed to mitigate the issue. Zope
  2.4.2 will contain a fix for the issue, at which time the hotfix can
  be removed.