From the Zope site:
The issue involves an error in the 'aq_inContextOf' method of objects that
support acquisition. A recent change to the access validation machinery
made this bug begin to affect security restrictions. The bug, with the
change to validation, made it possible to access Zope objects via
acquisition that a user would not otherwise have access to. This issue
could allow users with enough internal knowledge of Zope to perform actions
higher in the object hierarchy than they should be able to.
o change maintainer. The predecessor does not use netscape anymore.
PR: 25602
Submitted by: pat <pat@databits.net> (new maintainer)
o use PKGNAMEPREFIX.
o use subdirectory under distfiles/ to avoid conflict with other version.
o get rid of version number from pkg-*
o remove previous maintainer's signature from pkg-descr.
o remove empty directory properly(%D/ added).
* Removed "access" from pkg-plist, it contains password data that
should be preserved (I forgot this last time!).
* In the "do-install" target, leave the "access" file unchanged if it
already exists.
* Remove the pre-deinstall comment: Data.fs is already preserved by
pkg_delete anyway.
* In the "install" target, use temporary file Data.fs.preserve to avoid
overwriting Data.fs. "make deinstall/install" can now be safely used to
perform upgrades.
* Don't leave .o files around anymore.
Approved by: maintainer
* Changed the python15 dependency to USE_PYTHON=yes
* Replaced PYTHON15 with PYTHON_CMD from bsd.python.mk
* Added SAPACHE_CONFDIR, like the other Sxxx variables, to be used in the
PLIST. APACHE_CONFDIR now depends on SAPACHE_CONFDIR
* Added APACHE_CONFDIR and WEBBASEDIR to PLIST_SUB
* Removed temporary file Zope.cgi.orig
* Removed .cvsignore from var/
* Added/removed some files to the PLIST
* Used @unexec rmdir to remove shared directories from PLIST
* Removed the line with "grep". I didn't understand how it was supposed to
work, I guess it should have been something like "cmp -s ...", but
Data.fs cannot be equal to Data.fs.in anyway, because Zope adds some
things to it the first time it's started (automatically imported
packages from filesystem).
* Removed temporary files from var/ at deinstall time (*.tmp, *.lock, *.soc,
*.pid)
* Sometimes the inituser file did not exist at deinstall time, so I
deleted it with @unexec. It won't be included by "make package".
* Added the Hotfix_2001-02-23 directory (@dirrm)
* Used variables from PLIST_SUB instead of www and etc/apache (@dirrm)
Approved by: maintainer
case. When I tested my porting work, I kept on using ``make package''
and testing the installation of the package, without testing the
"install from the port" case.
Reported by: Mike Harding <mvh@corp.namesafe.com>
