[ZCM] [ZC] 2301/ 2 Resolve "Missing @postonly in AccessControl.Owned "

Issue #2301 Update (Resolve) "Missing @postonly in AccessControl.Owned "
 ** Security Related ** (Public)
 Status Resolved, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2301

==============================================================
= Resolve - Entry #2 by mj on Mar 29, 2007 1:24 am

 Status: Pending => Resolved

*Sigh*, how we stumble around this one.

Fixed:
http://svn.zope.org/Zope/branches/2.9/lib/python/AccessControl/?view=rev&rev=73884

Luckily I consider these 2 methods the least of the whole problem.
________________________________________
= Request - Entry #1 by jbobbio on Mar 28, 2007 8:42 pm

While backporting the security fix for CVE-2007-0240 to Zope 2.9.6 (needed for Debian etch), I have actually noticed that some @postonly decorators where missing in AccessControl.Owned.  The hotfix protects manage_takeOwnership and manage_changeOwnershipType which are not protected in Zope 2.9.7.

The commit diff is also pretty explicit:
http://svn.zope.org/Zope/branches/2.9/lib/python/AccessControl/Owned.py?rev=73389&r1=68571&r2=73389
==============================================================