[Zope] Major security flaw in Zope 2.3.2

[Evan Simpson]

From: "Jerome Alet" <alet@unice.fr>
> so why not make it an option (not reversable) which would default to the
> safe "passwordhash=YES", and which would allow computational intensive
> sites (many authenticated requests a day) to disable it knowingly after
> having properly secured access to Data.fs AND Data.fs.old

Don't tell me, I'll just nod wisely and forget five seconds later ;-)

Tell
http://dev.zope.org/Wikis/DevSite/Proposals/EncryptedUserfolderPasswordsDisc
ussion.

Cheers,

Evan @ digicool & 4-am