File contents
Hotfix_2001-02-23
This is a "hotfix" product. Hotfix products can be installed to
incorporate modifications to Zope at runtime without requiring
an immediate installation upgrade. Hotfix products are installed
just as you would install any other Zope product.
This hotfix addresses and important security issue that affects Zope
versions up to and including Zope 2.3.1 b1.
The issue is related to ZClasses in that a user with through-the-web
scripting capabilities on a Zope site can view and assign class attributes
to ZClasses, possibly allowing them to make inappropriate changes to ZClass
instances.
This patch also fixes problems in the ObjectManager, PropertyManager, and
PropertySheet classes related to mutability of method return values which
could be perceived as a security problem.
We *highly* recommend that any Zope site running versions of
Zope up to and including 2.3.1 b1 have this hotfix product installed
to mitigate these issues if the site is accessible by untrusted users
who have through-the-web scripting privileges.
Log in
Forgot your password?
