[Zope-dev] Re: information disclosure vulnerability

[Maik Jablonski]

Jerome Alet wrote:

probably the HelpSys object shouldn't be available by default
to non-authenticated users, because it gives too much information on the currently installed products.

access any Zope site this way :

http://your.zope.site/HelpSys
and you'll learn what products are available on the server.

Another way to gather this data would be:

http://YourServer/Control_Panel/Products/ExternalEditor

gives Anoynmous the ZopeStartPage if ExternalEditor is installed and a SiteError if not.

-mj





_______________________________________________
Zope-Dev maillist - [EMAIL PROTECTED]
http://lists.zope.org/mailman/listinfo/zope-dev
** No cross posts or HTML encoding! **
(Related lists - http://lists.zope.org/mailman/listinfo/zope-announce
http://lists.zope.org/mailman/listinfo/zope )