[Zope-Coders] FastCGI leaking Authorization header

[Shane Hathaway]

On Mon, 19 Aug 2002, Toby Dickenson wrote:

> > Can you think of a way to release a correction that wouldn't be
> > interpreted by people outside this community as "Zope is totally
> > insecure"?
>
> IMO, It would be nice to be able to release 2.3.x, 2.4.x, and 2.5.x,
> containing only critical changes such as this.
>
> Historically Zope's third point releases have included a sufficiently broad
> range of bug fixes that it has been unwise to upgrade without testing them
> first.

I see that.  Maybe we need to scrutinize bug fixes a lot more than we
have.  Zope 2.5.2, for example, should break *no* sites currently running
2.5.1 except in the case of real security issues.  If we adhere to this
rule, we can reserve "hotfixes" for showstopper security issues that must
be patched on all Zope sites within the next 10 minutes. ;-)  This would
bring us more in line with the expectations of people outside the
community.

Shane