<p>il problema nasce solo se un fileField ha un read_permission pių restrittivo di quello che vale sul contesto. ad esempio un contenuto pubblico, con un fileField disponibile solo ai reviewer. </p>
<p>bye</p>
<div class="gmail_quote">Il giorno 07/nov/2012 11:32, "Yuri" <<a href="mailto:yurj@alfa.it">yurj@alfa.it</a>> ha scritto:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Il 07/11/2012 11:29, Vito Falco ha scritto:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Per chiarimenti sulla questione del BLOB basta chiedere al Sauzher che l'ha "sgamato" :)<br>
</blockquote>
<br>
C'č un pattern con cui fare grep nei log? Cosė vedo se qualcuno ha tentato di farlo :-P<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Information for security researchers<br>
Impact Subscore: 4.9<br>
Exploitability Subscore: 10<br>
Overall CVSS Score: 5<br>
Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P/E:<u></u>P/RL:O/RC:C)<br>
CWE: CWE-306<br>
Credit: Alessandro SauZheR<br>
<br>
<br>
Vito<br>
<br>
2012/11/7 Yuri <<a href="mailto:yurj@alfa.it" target="_blank">yurj@alfa.it</a> <mailto:<a href="mailto:yurj@alfa.it" target="_blank">yurj@alfa.it</a>>><br>
<br>
<a href="http://plone.org/products/plone/security/advisories/20121106" target="_blank">http://plone.org/products/<u></u>plone/security/advisories/<u></u>20121106</a><br>
<br>
qui ci sono tutti i problemi fissati dall'hotfix. Alcuni sono<br>
paranoici nei casi normali (quanti utenti reali non sicuri abbiamo<br>
che scrivono python script?), l'unico degno di nota, mi pare, č<br>
questo:<br>
<br>
<a href="http://plone.org/products/plone/security/advisories/20121106/17" target="_blank">http://plone.org/products/<u></u>plone/security/advisories/<u></u>20121106/17</a><br>
<br>
BLOBs stored on custom content types can be accessed through a<br>
non-standard URL, bypassing the declared permission check<br>
<br>
Anonymous users can use a crafted URL to illegitimately download<br>
Files and Images. Thanks to Karl Johan Kleist who found that this<br>
had been incorrectly reported, and let the security team know.<br>
<br>
===============<br>
<br>
Penso quindi che l'unico problema "vero" sia questo. Dal fix mi<br>
pare che il field sia accessibile tramite il suo metodo<br>
index_html. Quindi da url web in qualche modo si arriva al field e<br>
da lė il metodo permette di scaricare il file, indipendentemente<br>
dai permessi.<br>
<br>
Concordate?<br>
<br>
______________________________<u></u>_________________<br>
Plone-IT mailing list<br>
<a href="mailto:Plone-IT@lists.plone.org" target="_blank">Plone-IT@lists.plone.org</a> <mailto:<a href="mailto:Plone-IT@lists.plone.org" target="_blank">Plone-IT@lists.plone.<u></u>org</a>><br>
<a href="https://lists.plone.org/mailman/listinfo/plone-plone-it" target="_blank">https://lists.plone.org/<u></u>mailman/listinfo/plone-plone-<u></u>it</a><br>
<a href="http://plone-regional-forums.221720.n2.nabble.com/Plone-Italy-f221721.html" target="_blank">http://plone-regional-forums.<u></u>221720.n2.nabble.com/Plone-<u></u>Italy-f221721.html</a><br>
<br>
<br>
<br>
<br>
-- <br>
*Vito Falco*<br>
Webdeveloper & designer freelance, Plone enthusiast<br>
Bari, IT<br>
tel <a href="tel:%2B39%203346330137" value="+393346330137" target="_blank">+39 3346330137</a> | skype vito80ba | twitter vito80ba<br>
Blog <a href="http://appuntiplone.wordpress.com" target="_blank">http://appuntiplone.wordpress.<u></u>com</a> <<a href="http://appuntiplone.wordpress.com/" target="_blank">http://appuntiplone.<u></u>wordpress.com/</a>><br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
Plone-IT mailing list<br>
<a href="mailto:Plone-IT@lists.plone.org" target="_blank">Plone-IT@lists.plone.org</a><br>
<a href="https://lists.plone.org/mailman/listinfo/plone-plone-it" target="_blank">https://lists.plone.org/<u></u>mailman/listinfo/plone-plone-<u></u>it</a><br>
<a href="http://plone-regional-forums.221720.n2.nabble.com/Plone-Italy-f221721.html" target="_blank">http://plone-regional-forums.<u></u>221720.n2.nabble.com/Plone-<u></u>Italy-f221721.html</a><br>
</blockquote>
<br>
______________________________<u></u>_________________<br>
Plone-IT mailing list<br>
<a href="mailto:Plone-IT@lists.plone.org" target="_blank">Plone-IT@lists.plone.org</a><br>
<a href="https://lists.plone.org/mailman/listinfo/plone-plone-it" target="_blank">https://lists.plone.org/<u></u>mailman/listinfo/plone-plone-<u></u>it</a><br>
<a href="http://plone-regional-forums.221720.n2.nabble.com/Plone-Italy-f221721.html" target="_blank">http://plone-regional-forums.<u></u>221720.n2.nabble.com/Plone-<u></u>Italy-f221721.html</a><br>
</blockquote></div>