README.txt

File contents

Hotfix_2001-05-01

  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses and important security issue that affects Zope 
  versions up to and including Zope 2.3.2.

  The issue is related to ZClasses in that any user can visit a ZClass
  declaration and change the ZClass permission mappings for methods
  and other objects defined within the ZClass, possibly allowing
  for unauthorized access within the Zope instance.

  We *highly* recommend that any Zope site running versions of 
  Zope up to and including 2.3.2  have this hotfix product installed 
  to mitigate this issue.

  For UNIX/Linux installation:

   'cd' to your Zope "main" product directory, e.g.:

     cd /home/fred/Zope-2.3.2

   un-gzip and un-tar the hotfix product while within this directory:

     gunzip ~/Hotfile-05-01-2001.tar.gz
     tar xvf ~/Hotfix-05-01-2001.tar

   Restart your Zope instance.

  For Windows installation:

   Use WinZip or another tool to untar and ungzip the hotfix into your
   Zope's main directory.

   Restart your Zope instance.