Hi, It is common knowledge that we can restrict access to an object by taking away many of the permissions from the security manager in the ZMI. Especially in the case of some objects like Oracle database connections, you don't want other people to be able to snag your "connect string" which contains username and password information. However, if a user has access to any folder on the system, they can programatically (and in some cases use the ZMI) copy the objects to anohter location. For example, if a user can view the management screens in a folder, they can copy an object, paste it to another location, give his self Manager local roles, and then view the "connect string". This works basically for every object. The problem is the CopySupport._canCopy method, which always returns 1 (true). It looks like this should be overridden for special products, but the base functionality should do some basic permission checking to determine if the object is copyable or should be copied. Below is a diff for OFS/CopySupport which adds a check to _canCopy to look for the "Access contents information" permission. -Chris -- -------------------------------------------------------------------- Christopher N. Deckard | Lead Web Systems Developer cnd@ecn.purdue.edu | Engineering Computer Network http://www.ecn.purdue.edu/ | Purdue University ---- zlib.decompress('x\234K\316Kq((-J)M\325KM)\005\000)"\005w') --- --- CopySupport.py.orig Wed May 1 14:59:46 2002 +++ CopySupport.py Wed May 1 15:02:34 2002 @@ -382,7 +382,9 @@ def _canCopy(self, op=0): """Called to make sure this object is copyable. The op var is 0 for a copy, 1 for a move.""" - return 1 + if self.REQUEST.AUTHENTICATED_USER.has_permission('Access contents information', self): + return 1 + return 0 def _notifyOfCopyTo(self, container, op=0): """Overide this to be pickly about where you go! If you dont