Commit graph

23 commits

Author SHA1 Message Date
Neil Blakey-Milner
f213143e00 Upgrade to Zope 2.4.1. 2001-09-10 08:52:19 +00:00
Neil Blakey-Milner
434868fb60 Acqusition context checking hotfix
``The issue involves an error in the '_check_context' method of the
AccessControl.User.BasicUser class. The bug made it possible to access
Zope objects via acquisition that a user would not otherwise have access
to. This issue could allow users with enough internal knowledge of Zope
to perform actions higher in the object hierarchy than they should be
able to.''
2001-08-04 17:29:00 +00:00
Vanilla I. Shu
6b0274afa1 Upgrade to 2.4.0.
Approved by:	nbm
2001-07-25 23:32:57 +00:00
Jimmy Olgeni
45bd8c5f79 Update port to version 2.3.3.
Approved by:	nbm
2001-07-04 20:52:41 +00:00
Jimmy Olgeni
6b2aa0a1a9 Add missing @dirrm for Hotfix_2001_05_01. 2001-05-27 21:59:33 +00:00
Neil Blakey-Milner
c4f736719a Actually install the 2001-05-01 Hotfix. 2001-05-03 10:23:54 +00:00
Neil Blakey-Milner
061280635c Update to Zope 2.3.2 + Hotfix 2001-05-01 2001-05-03 10:14:53 +00:00
Neil Blakey-Milner
73744dc786 Upgrade to Zope 2.3.1! 2001-03-31 12:12:26 +00:00
Jimmy Olgeni
32bd499f1c Apply Zope hotfix: Hotfix_2001-03-08
From the Zope site:

The issue involves an error in the 'aq_inContextOf' method of objects that
support acquisition. A recent change to the access validation machinery
made this bug begin to affect security restrictions. The bug, with the
change to validation, made it possible to access Zope objects via
acquisition that a user would not otherwise have access to. This issue
could allow users with enough internal knowledge of Zope to perform actions
higher in the object hierarchy than they should be able to.
2001-03-10 12:22:15 +00:00
Jimmy Olgeni
68fda8686d More plist and Makefile fixes.
* Removed "access" from pkg-plist, it contains password data that
  should be preserved (I forgot this last time!).

* In the "do-install" target, leave the "access" file unchanged if it
  already exists.

* Remove the pre-deinstall comment: Data.fs is already preserved by
  pkg_delete anyway.

* In the "install" target, use temporary file Data.fs.preserve to avoid
  overwriting Data.fs. "make deinstall/install" can now be safely used to
  perform upgrades.

* Don't leave .o files around anymore.

Approved by:	maintainer
2001-03-08 11:55:18 +00:00
Jimmy Olgeni
8c85eb2734 Miscellaneous fixes.
* Changed the python15 dependency to USE_PYTHON=yes
* Replaced PYTHON15 with PYTHON_CMD from bsd.python.mk
* Added SAPACHE_CONFDIR, like the other Sxxx variables, to be used in the
  PLIST. APACHE_CONFDIR now depends on SAPACHE_CONFDIR
* Added APACHE_CONFDIR and WEBBASEDIR to PLIST_SUB
* Removed temporary file Zope.cgi.orig
* Removed .cvsignore from var/
* Added/removed some files to the PLIST
* Used @unexec rmdir to remove shared directories from PLIST
* Removed the line with "grep". I didn't understand how it was supposed to
  work, I guess it should have been something like "cmp -s ...", but
  Data.fs cannot be equal to Data.fs.in anyway, because Zope adds some
  things to it the first time it's started (automatically imported
  packages from filesystem).
* Removed temporary files from var/ at deinstall time (*.tmp, *.lock, *.soc,
  *.pid)
* Sometimes the inituser file did not exist at deinstall time, so I
  deleted it with @unexec. It won't be included by "make package".
* Added the Hotfix_2001-02-23 directory (@dirrm)
* Used variables from PLIST_SUB instead of www and etc/apache (@dirrm)

Approved by:		maintainer
2001-03-06 22:30:21 +00:00
Neil Blakey-Milner
5aaf8bc98b Apply a Zope hotfix, fixing a potential security problem.
From the Zope hotfix:

	This hotfix addresses and important security issue that affects Zope
	versions up to and including Zope 2.3.1 b1.

	The issue is related to ZClasses in that a user with through-the-web
	scripting capabilities on a Zope site can view and assign class
	attributes to ZClasses, possibly allowing them to make inappropriate
	changes to ZClass instances.

	This patch also fixes problems in the ObjectManager, PropertyManager,
	and PropertySheet classes related to mutability of method return values
	which could be perceived as a security problem.

	We *highly* recommend that any Zope site running versions of Zope up to
	and including 2.3.1 b1 have this hotfix product installed to mitigate
	these issues if the site is accessible by untrusted users who have
	through-the-web scripting privileges.
2001-03-04 10:32:18 +00:00
Neil Blakey-Milner
b67c9642d5 Upgrade to Zope 2.3.0. It requires the recent change to python15 for
the 'new' module.
2001-01-29 14:52:23 +00:00
Neil Blakey-Milner
f582bfebfa Update to Zope 2.2.5 2001-01-18 13:35:17 +00:00
Neil Blakey-Milner
586286997d Upgrade to Zope 2.2.4, with 2000-12-08, 2000-12-15a, and 2000-12-18
security hotfixes.

All Zope users are encouraged to upgrade, or apply the hotfixes
themselves.
2000-12-20 11:54:42 +00:00
Neil Blakey-Milner
0b7a8bcbda Add __init__.pyc's for the Hotfixes, since they seem to be created.
Since this doesn't affect any functionality for port or packages users,
I'll try avoid the PORTREVISION bump.

Noticed by:	bento
2000-11-03 23:56:16 +00:00
Neil Blakey-Milner
f5150f6ce0 Add two security hotfixes for Zope - more complex Zope internals stuff
which allows people who may edit DTML to gain higher privilege, and
those who have higher privilege in some areas of the Zope tree to gain
it in other areas.
2000-10-14 23:33:12 +00:00
Neil Blakey-Milner
fe4ae0109d Upgrade to Zope 2.2.2
Also allow zope to be installed by non-root.
2000-09-19 14:25:24 +00:00
Neil Blakey-Milner
b4f42b6692 Remove the zope data file if it is the same as installed. 2000-09-07 11:48:56 +00:00
Neil Blakey-Milner
0389061469 Update to Zope 2.2.1.
Zope shutdown bug fixed.
Reported by:	Marc Rassbach <marc@milestonerdl.com>
Reported by:	Jimmy Olgeni <olgeni@uli.it>

Zope startup bug fixed (I think).
2000-09-06 22:12:35 +00:00
Neil Blakey-Milner
8070fd61c9 Update to 2.2.1b1, since there is a minor security problem in anything
beforehand.
2000-08-15 14:09:41 +00:00
Steve Price
795f0af920 Update to version 2.1.6.
PR:		18444
Submitted by:	Thomas Hentschel <thomas@hentschel.net>
2000-05-29 02:49:55 +00:00
Steve Price
f73c0fc047 Initial import of zope version 2.0.0b5.
An object-based web application platform with database access.

PR:		13324
Submitted by:	Peter Cornelius <pcc@gmx.net>
1999-11-01 02:40:07 +00:00