You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2002-03-01 » Hotfix 2002-03-01 (Ownership Roles Enforcement) » View NewsItem
Log in
Name

Password

 
Link icon Forgot your password?
Print

Hotfix 2002-03-01 (Ownership Roles Enforcement)

This hotfix addresses an important security issue that may affect some users of Zope versions 2.2.0 through 2.5.x

The issue involves the checking of security for objects with proxy roles. The context of the owner user that created the object with proxy roles was not being taken into account when determining access to the object with proxy roles. This flaw could allow users defined in subfolders of a site with sufficient privileges to access objects at higher levels in the site that they would not normally be able to access.

We highly recommend that any Zope site running Zope 2.2.0 through Zope 2.5.x have this hotfix product installed to mitigate the issue. Zope 2.5.1 and 2.4.4 will contain a fix for the issue, at which time the hotfix can be removed.

README

http://www.zope.org/Products/Zope/Hotfix_2002-03-01/Hotfix_2002-03-01.tgz
Copyright (c) 2011 Zope Foundation. All rights reserved. Legal | Contact
If you can read this text, it means you are not experiencing the Plone design at its best. Plone makes heavy use of CSS, which means it is accessible to any internet browser, but the design needs a standards-compliant browser to look like we intended it. Just so you know ;)