You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-02-23 » Zope hotfix: Class attribute access » View NewsItem
Log in
Name

Password

 
Link icon Forgot your password?
Print

Zope hotfix: Class attribute access

This hotfix addresses and important security issue that affects Zope versions up to and including Zope 2.3.1 b1.

The issue is related to ZClasses in that a user with through-the-web scripting capabilities on a Zope site can view and assign class attributes to ZClasses, possibly allowing them to make inappropriate changes to ZClass instances.

This patch also fixes problems in the ObjectManager, PropertyManager, and PropertySheet classes related to mutability of method return values which could be perceived as a security problem.

We highly recommend that any Zope site running versions of Zope up to and including 2.3.1 b1 have this hotfix product installed to mitigate these issues if the site is accessible by untrusted users who have through-the-web scripting privileges.

README

http://www.zope.org/Products/Zope/Hotfix_2001-02-23/Hotfix_2001-02-23.tgz

Copyright (c) 2011 Zope Foundation. All rights reserved. Legal | Contact
If you can read this text, it means you are not experiencing the Plone design at its best. Plone makes heavy use of CSS, which means it is accessible to any internet browser, but the design needs a standards-compliant browser to look like we intended it. Just so you know ;)