[Zope-Coders] FastCGI leaking Authorization header

[R. David Murray]

On Mon, 19 Aug 2002, Shane Hathaway wrote:
> I see that.  Maybe we need to scrutinize bug fixes a lot more than we
> have.  Zope 2.5.2, for example, should break *no* sites currently running
> 2.5.1 except in the case of real security issues.  If we adhere to this
> rule, we can reserve "hotfixes" for showstopper security issues that must
> be patched on all Zope sites within the next 10 minutes. ;-)  This would
> bring us more in line with the expectations of people outside the
> community.

+1.  I was very surprised, during this past bug day (my first), to
find out that we were backporting "most" fixes to 2.5.

As an addition, if someone is willing to do the work, one could also
release "patches" that fix the security issue without requiring
even the third dot upgrade.

This is the model followed by FreeBSD, for example: if you stay
current with the CVS X.X branch, you will get only security fixes
and will automatically end up upgrading to the third dot releases
as they are made (and they are made when "enough" or "bad enough"
security patches accumulate that it seems worth it).  Or you can
install just the provided patches for those security issues you
believe will affect you.

Dropping the panic-inducing term "hotfix" and making the wording
more specific ("this patch modifies Zope's FastCGI support to work
around a security hole introduced by FastCGI 2.2, and is only
required by sites using both FastCGI 2.2 *and* allowing untrusted
users to write DTML code.  All other Zope installations should be
unaffected.") would probably go a long way toward mitigating the
"bad press" Shane is worried about.

wondering-how-php-survives-its-bad-press'ly yours,

--RDM