[Zope] BIG security hole in www.zope.org

[Paul Everitt]

Andy wrote:
> It's way worse than I thought: You can do the same thing with at least
> standard_html_footer! Hope all you Digital Creations guys haven't gone
> home yet...

Nope, we're here and working on it.

Since this has now happened twice, I'm going to try to be more clear.

Everybody, PLEASE don't mail security bugs to the mailing list.  This is
such an impolite thing to do that I'm surprised that I am bringing it up
twice in the same month.

Instead of an email with a subject line of "BIG security hole", whose
contents discuss the details of the problem...doesn't it make a lot more
sense to let us know about it first and have a shot at fixing it?

Let us know in private and give us a shot at promptly fixing it and
notifying people.  If the response isn't swift, then decide whether the
community at large would be best served by a direct announcement.

Because the problem has now been announced, we have to bring the entire
site down again like we did the last time.  We'll make a separate
announcement about this changeover to the old site.

--Paul

Paul Everitt       Digital Creations
paul@digicool.com  540.371.6909
-----------------------------------------
The Open Source Zope application server
http://www.zope.org/