[Zope-dev] security problem in an monkey-patch

2007-09-19 Thread Joachim Schmitz
Hi, I have monkey-patched the QueueCatalog to adopt it to our needs, which works fine. I now wanted to introduce a new feature: The QueueCatalog should be bypassed during mass-import of data. So I introduced a new variable _bypass, and new getBypassQueue() and setBypassQueue methods in the

Re: [Zope-dev] security problem in an monkey-patch

2007-09-19 Thread Dieter Maurer
Joachim Schmitz wrote at 2007-9-19 11:54 +0200: and ../portal_catalog/getBypassQueue displays a 1 This looks like a security bug. You should not be able to call something via the ZPublisher what you cannot call in a script. Maybe, you file a bug report? -- Dieter

Re: [Zope-dev] Security-Problem

2003-02-19 Thread Steve Alexander
Shane Hathaway [EMAIL PROTECTED] wrote: Do you not want foo to have the Manager role? Andre Schubert wrote: No, because he is no longer in our company. Shane Hathaway [EMAIL PROTECTED] wrote: I think you're asking for a find + chown utility, right? I don't know of one, but it sure would

[Zope-dev] Security-Problem

2003-02-18 Thread Andre Schubert
Hi all, i have a little Security-Problem which results in the following Error reported by Shane Hathaway's nice VerboseSecurity: Error Type: Unauthorized Error Value: The owner of the executing script does not have the required permission. Access to 'foobar' of (Folder instance at 932b600)

Re: [Zope-dev] Security-Problem

2003-02-18 Thread Shane Hathaway
On 02/18/2003 09:16 AM, Andre Schubert wrote: I try to explain what happens. Lets say i have a user called foo who has Manager-Roles across a Zope-site. foo has added 2 DTMLMethods to a folder called bar and foobar. foobar is called from inside bar (dtml-call foobar). He also created a Role

Re: [Zope-dev] Security-Problem

2003-02-18 Thread Joachim Werner
Andre Schubert schrieb: Hi all, i have a little Security-Problem which results in the following Error reported by Shane Hathaway's nice VerboseSecurity: Error Type: Unauthorized Error Value: The owner of the executing script does not have the required permission. Access to 'foobar' of (Folder

Re: [Zope-dev] Security-Problem

2003-02-18 Thread Andre Schubert
On Tue, 18 Feb 2003 12:01:45 -0500 Shane Hathaway [EMAIL PROTECTED] wrote: On 02/18/2003 09:16 AM, Andre Schubert wrote: I try to explain what happens. Lets say i have a user called foo who has Manager-Roles across a Zope-site. foo has added 2 DTMLMethods to a folder called bar and foobar.