[Zope] Risky Giving Anon User Permission to View Management Panel

[Kevin Dangoor]

----- Original Message -----
From: Jeff Rush <jrush@timecastle.net>
To: <zope@zope.org>
Sent: Friday, November 12, 1999 2:21 PM
Subject: [Zope] Risky Giving Anon User Permission to View Management Panel


> Are there any security risks associated with giving the anonymous
> user under Zope the 'view management panel' permission?  He
> doesn't seem to be able to delete/modify/add things, and I thought
> it might be good on some sites intended for demo to allow people
> to peek under the covers and see how it was all done.
>
> Zope.org seems to give you this permission to some degree, since
> you need it to be allowed to click on the "view DTML source",
> but they (somehow) prevent you from getting to the actual '/manage'
> interface (I'd love to know how).

I don't know if there are any other risks in the view management screens
permission. The "DTML source" link could have been implemented a couple
ways... They could have put "Access Contents Information" on for anonymous
(I think that's the permission used for getting the document src of DTML).
Or, the view_source method could use a Proxy Role to get the permission
necessary to access the source. This second method would allow them to
easily make it so that it only works on DTML Methods and DTML Documents (if
they wanted to). They could do this by checking the meta_type...

Kevin