Re: [Zope-dev] Zope 4 publisher/traversal, sprint topic

2011-10-28 Thread yuppie
Hi! Leonardo Rochael Almeida wrote: After the last two rather serious security issues that were recently patched in the Zope2 code base, it is increasingly clear to me that, differently than what Hanno reported some time ago, it's not so much the ZMI that represents a huge security liability

Re: [Zope-dev] Zope 4 publisher/traversal, sprint topic

2011-10-28 Thread Chris Withers
On 28/10/2011 08:46, yuppie wrote: Is that the fault of the publisher? AFAICT the biggest security problem of Zope2 is this line in OFS.SimpleItem.Item: # Allow (reluctantly) access to unprotected attributes __allow_access_to_unprotected_subobjects__=1 I'm not familiar with the

[Zope-dev] Zope 4 publisher/traversal, sprint topic

2011-10-27 Thread Leonardo Rochael Almeida
Hi, Sorry for the cross-post, but I'd like to talk about a possible sprint topic for the next DZUG sprint[1], and invite myself to it :-) After the last two rather serious security issues that were recently patched in the Zope2 code base, it is increasingly clear to me that, differently than

Re: [Zope-dev] Zope 4 publisher/traversal, sprint topic

2011-10-27 Thread Lennart Regebro
Do we really have to call it Zope 4? :-) On Thu, Oct 27, 2011 at 15:34, Leonardo Rochael Almeida leona...@nexedi.com wrote: Hi, Sorry for the cross-post, but I'd like to talk about a possible sprint topic for the next DZUG sprint[1], and invite myself to it :-) After the last two rather

Re: [Zope-dev] Zope 4 publisher/traversal, sprint topic

2011-10-27 Thread Jens Vagelpohl
On Oct 27, 2011, at 16:07 , Lennart Regebro wrote: Do we really have to call it Zope 4? :-) Yes. jens ___ Zope-Dev maillist - Zope-Dev@zope.org https://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related