You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-08-04 » Zope hotfix: Acqusition context checking
Log in
Name

Password

 
Link icon Forgot your password?
Print

Zope hotfix: Acqusition context checking

This hotfix addresses an important security issue that affects Zope version 2.3.3, all Zope 2.4.0 alpha and beta releases, as well as the final release of Zope 2.4.0.

The issue involves an error in the _check_context method of the AccessControl.User.BasicUser class. The bug made it possible to access Zope objects via acquisition that a user would not

otherwise have access to. This issue could allow users with enough internal knowledge of Zope to perform actions higher in the object

hierarchy than they should be able to.

We highly recommend that any Zope site running Zope 2.3.3, Zope 2.4.0 final or any alpha or beta version of 2.4.0 have this hotfix product installed to mitigate the issue. Zope 2.4.1 will contain a

fix for the issue, at which time the hotfix can be removed. Zope

versions prior to 2.3.3 are not affected by this issue.

Thanks to Ron Bickers for providing a reproducible test case

README

http://www.zope.org/Products/Zope/Hotfix_2001-08-04/Hotfix_2001_08_04.tgz

Copyright (c) 2011 Zope Foundation. All rights reserved. Legal | Contact
If you can read this text, it means you are not experiencing the Plone design at its best. Plone makes heavy use of CSS, which means it is accessible to any internet browser, but the design needs a standards-compliant browser to look like we intended it. Just so you know ;)