cco/loops
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

no security check on accessing the nodeType attribute during traversal

Browse source 
git-svn-id: svn://svn.cy55.de/Zope3/src/loops/trunk@3439 fd906abe-77d9-0310-91a1-e0d9ade77398
This commit is contained in:
helmutm 2009-07-01 13:20:57 +00:00
parent 5fd90c421d
commit 41a623145f
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
browser/node.py
View file

@ -788,8 +788,9 @@ class NodeTraverser(ItemTraverser):
def publishTraverse(self, request, name):
viewAnnotations = request.annotations.setdefault('loops.view', {})
viewAnnotations['node'] = self.context
if removeSecurityProxy(self.context).nodeType == 'menu':
setViewConfiguration(self.context, request)
context = removeSecurityProxy(self.context)
if context.nodeType == 'menu':
setViewConfiguration(context, request)
if name == '.loops':
return self.context.getLoopsRoot()
if name.startswith('.target'):