Re: plone, rrdtool, zenoss bugs

[Matthew Wilkes <matthew () matthewwilkes co uk>]

On 2013-04-18 21:08, Kurt Seifried wrote:
> Was this previously exploitable, or is this just a hardening measure?

Hi, Plone checking in here. Sorry, didn't see this until the ping just now.

This is technically a bug in PluggableAuthService, an optional part of 
Zope that we use. In a correctly set up Plone site this won't be 
accessible, but if people are using an account that's set up to access 
the Zope management interface (such as the initial admin user created on 
install) then it would be.

We discourage people from using these users specifically because the 
administration forms that make up the ZMI are not high quality. We're 
looking into longer term solutions to make it safer, but the advice 
right now is to stick with the Site Administrator role we added in Plone 
4.1 or the Editor/Contributor/Reviewer roles that we've always had.

There is no valid reason for anyone to be logged in as a user that could 
access these forms on a production system.

Matt