Hi Zope list,

I have a (zope 2.8.8-final) folder that gives users with the role "Authenticated"
the following Permissions:

  . access contents
  . view
  - note: no webDav or FTP access is allowed

Playing around with wget and curl I find I can (with proper authentication) download the "published" but not raw source of zpt and python files available in the folder.

So, for example, the script "\folder\pyDate" returns '2007/05/23' not its source, e.g.

# module: pyDate
from DateTime import DateTime
return DateTime().Date()

This is the behavior I want - as we have a requirement to keep source secure. I realize that source in Zope-Instance/Extensions is the most secure but I'm interested in local script security.



Zope maillist  -  Zope@zope.org
**   No cross posts or HTML encoding!  **
(Related lists - http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope-dev )

Reply via email to