Would it be sufficient to disallow the PROPFIND for non-authenticated users ? - aj ----- Original Message ----- From: "Barry Pederson" <barryp@medicine.nodak.edu> To: <zope-dev@zope.org> Sent: Wednesday, March 06, 2002 11:39 Subject: Re: [Zope-dev] WebDAV quibble -- fix in 2.6?
Casey Duncan wrote:
This maybe more 2.6 (or even 2.5.1 final) fodder:
I notice that in a vanilla Zope install, Anonymous users are allowed access through WebDAV. This is bad for two reasons:
1. From a security perspective this discloses way too much information about your site to the outside world.
2. Due to vagarities of WebDAV authentication, it makes it impossible to edit anything, because I guess the WebDAV implementation is too stupid to force a login when you try to lock something as anonymous (instead is returns a 500 server error). To get around this you have to create or copy an object to force a login. This problem disappears if everyone must login to access WebDAV at all.
So the question is: Is there a good reason why WebDAV access is granted to anonymous by default? If not I vote we change it.
Agreed, the way it is now is just wrong, and I was shocked to see it wide-open like that.
Barry
_______________________________________________ Zope-Dev maillist - Zope-Dev@zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )