[Zope-dev] Re: information disclosure vulnerability

Jerome Alet wrote:

probably the HelpSys object shouldn't be available by default to non-authenticated users, because it gives too much information on the currently installed products.

access any Zope site this way :

http://your.zope.site/HelpSys

and you'll learn what products are available on the server.

Another way to gather this data would be: http://YourServer/Control_Panel/Products/ExternalEditor gives Anoynmous the ZopeStartPage if ExternalEditor is installed and a SiteError if not. -mj