[Zope-dev] SECURITY alert and hotfix release

2001-05-01 Thread Chris McDonough

Hello All,

  Dieter Maurer uncovered a potential security issue yesterday that
  necessitated a hotfix release.

  This hotfix addresses an important security issue that affects Zope
  versions up to and including Zope 2.3.2.

  The issue is related to ZClasses in that any user can visit a ZClass
  declaration and change the ZClass permission mappings for methods
  and other objects defined within the ZClass, possibly allowing
  for unauthorized access within the Zope instance.

  We *highly* recommend that any Zope site running versions of
  Zope up to and including 2.3.2 have this hotfix product installed
  to mitigate this issue.

- http://www.zope.org/Products/Zope/Hotfix_2001-05-01/README.txt

-
http://www.zope.org/Products/Zope/Hotfix_2001-05-01/Hotfix_2001-05-01.tgz


___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )



Re: [Zope-dev] zunit 0.2 comments

2001-05-01 Thread Lalo Martins

On Mon, Apr 30, 2001 at 09:34:53PM -0700, Simon Michael wrote:
 
 Zope or the codeit setup didn't seem to see things in
 INSTANCE_HOME/Shared and I don't have access to SOFTWARE_HOME/Shared.

Hmm. Rolled newspaper for them. :-)


 What's the reason for this new level of indirection, the
 ExternalTestCase object ? And do you think this name is appropriate ?
 (I am confused about tests vs test cases vs test suites)

It's a refactoring to prepare for 0.3, where we'll have the
actual TestCase object. This object will allow you to write
tests TTW.

Yes, we know a lot of you don't want to do that. Don't worry,
ExternalTestCase will always be there ;-) But you have to
realize that there are also a lot of people who just won't
touch Python code in the filesystem whenever possible. If
you're testing a ZClass-based Product, it would be completely
cumbersome to use PyUnit.

 Also, any ideas about the following which I get when running either my
 own tests or the samples:
(...)
 AttributeError: id

Mumble mumble. Probably API incompatibility between Zope
versions? We'll look further into it.

(Recent versions are deprecating direct access to the 'id'
attribute, specially because you don't know when it's a string
and when it's a method... we should have used getId())

We now have a SourceForge project, feel free to report bugs and
browse our open tasks to see where we're going :-)

[]s,
   |alo
   +
--
   I say a prayer now our love's departed
That you'll come back to stay
  Bring back the perfect day

http://www.laranja.org/mailto:[EMAIL PROTECTED]
 pgp key: http://www.laranja.org/pessoal/pgp

Brazil of Darkness (RPG)  ---   http://www.BroDar.org/

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://lists.zope.org/mailman/listinfo/zope-announce
 http://lists.zope.org/mailman/listinfo/zope )