You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_08_09_2000 » README.txt » View File

Log in
Name

Password

 

README.txt

File details
Size
1 K
File type
text/plain

File contents

Hotfix_08_09_2000

  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.


  This hotfix addresses an important security issue that affects all 
  released Zope versions up to and including Zope 2.2 final.

  The issue involves the fact that the getRoles method of user objects 
  contained in the default UserFolder implementation returns a mutable 
  Python type. Because the mutable object is still associated with the 
  persistent User object, users with the ability to edit DTML could 
  arrange to give themselves extra roles for the duration of a single 
  request by mutating the roles list as a part of the request processing. 

  While we know of no instances of this issue being used to exploit a 
  site, we *highly* recommend that any Zope site running versions of 
  Zope prior to 2.2.1 have this hotfix product installed to mitigate 
  the issue if the site is accessible by untrusted users who have DTML 
  editing privileges.