[Zope] ANNOUNCE: Zope security alert and hotfix release

2000-12-18 Thread Brian Lloyd
Hi all - Peter Kelly has brought another potential security issue to our attention that is important enough to make a Hotfix available for those who allow untrusted users to edit DTML on their sites. The issue involves incorrect protection of a data updating method on Image and F

[Zope] ANNOUNCE: Zope security alert and hotfix release

2000-12-15 Thread Brian Lloyd
Hi all - A security issue has recently come to our attention (thanks to Erik Enge for identifying this) that affects Zope versions up to and including Zope 2.2.4. The issue involves the computation of local roles. In some situations the computation was not climbing the correct hierarc