Beware to HotFix Legacy
Hi All, I was having some weird permissions problem, really WEIRD!! After trying everything, really everything, I started to became paranoid and suddenly my mind/clicks went into Control_Panel/Products and my eyes went trough the Product's list stoping on a part of this list where the word "HotFix" appeared several times :-). Since we are long time zope users, and we have a zope production site running long before the first hotfix come out, I asked my self: "Do I really need all this hotfixes installed?". I think it was never said one was forced to uninstall zope hotfixes, i.e, it is safe to leave them installed. Well, I uninstalled the old hotfixes and left only the ones related with my version of zope and voila the weird security problem disappeared. I cant describe the problem I had, because it was really weird but this post is to alert everybody to this possibility, i.e: try to run the latest zope with ALL the hotfixes ever released. Then try to do some programatic stuff like create a simple product with a class and then go and do some methods with manage_changeProducts, manage_addProduct, dtml-with "propertysheets.info", etc, and see if your programming security paradigm is breaked with weird security restrictions you never saw before. Maybe some zope guru :-) could say something about the risk or not of leaving the HotFixes installed. One thing cool would be to on zope.org associate to each release of zope the HotFixes released for it. For instance when we choose a version of zope to download, besides the install information, release information, History information, etc, we could see a list of hotfixes one should apply to that version. Maybe create a class Hotfix on zope.org and then relate it somehow with the /Products/Zope/xxx/ folders. Then when a Hotfix class instance is created the person creating it associate that hotfix with some versions of zope, and when we visit a zope version download page we can see a list of hotfixes released for that version. Best Regards, JS _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
participants (1)
-
J�lio Dinis Silva