[ZCM] [ZC] 2294/ 5 Comment "Hotfix 2007-03-20"

Issue #2294 Update (Comment) "Hotfix 2007-03-20"
 ** Security Related ** (Public)
 Status Accepted, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2294

==============================================================
= Comment - Entry #5 by tseaver on Mar 21, 2007 11:08 am

> I volunteer to fix the ControlPanel methods for the upcoming
> 2.8.x, 2.9.x, and 2.10.x releases.

Done on the 2.8 branch:

  http://svn.zope.org/Zope/branches/Zope-2_8-branch/?rev=73410&view=rev
  http://svn.zope.org/Zope/branches/Zope-2_8-branch/?rev=73420&view=rev

the 2.9 branch:

 http://svn.zope.org/Zope/branches/2.9/?rev=73422&view=rev

the 2.10 branch:

 http://svn.zope.org/Zope/branches/2.10/?rev=73423&view=rev

and the trunk:

 http://svn.zope.org/Zope/trunk/?rev=73424&view=rev
________________________________________
= Accept - Entry #4 by tseaver on Mar 21, 2007 10:10 am

 Status: Wontfix => Accepted

 Supporters added: tseaver

I volunteer to fix the ControlPanel methods for the upcoming
2.8.x, 2.9.x, and 2.10.x releases.
________________________________________
= Wontfix - Entry #3 by mj on Mar 21, 2007 8:22 am

 Status: Pending => Wontfix

Correctly mark as Wontfix.
________________________________________
= Assign_confidential - Entry #2 by mj on Mar 21, 2007 8:20 am

The Hotfix was aimed at security modifiers only.

Note that Zope trunk and branches now have an easy method of marking something as limited to POST only, so we can move forward from here, and marking other issues as we find them and can fix them. Take into account that for some methods, existing Zope products count on them being callable through GET.

Marking as wontfix as the original issue.
________________________________________
= Request - Entry #1 by d2m on Mar 21, 2007 7:26 am

issues discussed in http://zope.org/Collectors/CMF/225 are not included with the hotfix

<img src="Control_Panel/manage_shutdown"> works with and without the hotfix installed, as well as manage_delObjects etc.

i suppose that publishing the incomplete hotfix and broadly announcing it in zope and plone lists now will make a few more script kiddies try to shutdown plone / zope services


==============================================================