Security bugs are reported here via bugzilla

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

OK, here's the diff. There are some code changes (in Python), and 
there's a forgotten EMACS backup file (.#blah). I don't know how their 
releases are organized, but the changes don't look suspicios. I went 
into their CVS, the new code is there. For example, 
CMFPlone/WorkflowTool.py had been changed like this (two commits!):
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/plone/CMFPlone/WorkflowTool.py.diff?r1=1.7.2.3&r2=1.7.2.5
So they've just fixed some bugs I guess. The sneaky way.
Take care!

Sergey.

Seth Woolley wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Sergey,
>
> Guess what ... They did it again!
>
> http://smgl.positivism.org/CMFPlone1.0.3.tar.gz
>
> ls -l from the tarball:
> drwxrwxr-x   10 503      503          1448 Jun 15 22:13 CMFPlone
> drwxrwxr-x    7 503      503           712 Jun 15 22:13 DCWorkflow
> drwxr-xr-x    6 503      503           952 Jun 15 22:13 Formulator
> drwxrwxr-x    2 503      503          1000 Jun 15 22:13 i18n
>
> They changed the source _right_ after you submitted the change this time.
>
> The new md5 is 9323283f0800ee982d8ddd6402d3fb40 for me from a download
> date of Jun 20 07:50 PDT.
>
> I'm not going to update this md5 in perforce until I see a diff of the
> two tarballs -- they could be rooted or something and every release gets
> modified, at this rate.
>
> Can you send me the file? or you can download it again and diff the
> different ones.  I'll cede to your judgement on this.  It's just starting
> to make me paranoid. ;)
>
> Seth
>
> On Sun, 15 Jun 2003, sergey_lipnevich wrote:
>
>  
>
> > Change 13065 by sergey_lipnevich@office-dev on 2003/06/15 05:59:03
> >
> >         Upgrade to 1.0.3 and fixes
> >
> > Affected files ...
> >
> > ... //sgl/devel/grimoire/collab/Plone/BUILD#2 edit
> > ... //sgl/devel/grimoire/collab/Plone/DEPENDS#2 edit
> > ... //sgl/devel/grimoire/collab/Plone/DETAILS#3 edit
> > ... //sgl/devel/grimoire/collab/Plone/HISTORY#3 edit
> >
> > Differences ...
> >
> > ==== //sgl/devel/grimoire/collab/Plone/BUILD#2 (xtext) ====
> >
> > 3c3,4
> > <   prepare_install
> > ---
> >    
> >
> > >  prepare_install &&
> > >  cp -r * /usr/lib/zope/Products/
> > >      
> > ==== //sgl/devel/grimoire/collab/Plone/DEPENDS#2 (xtext) ====
> >
> > 1a2
> >    
> >
> > > depends CMF &&
> > >      
> > ==== //sgl/devel/grimoire/collab/Plone/DETAILS#3 (xtext) ====
> >
> > 2c2
> > <          VERSION=1.0.2
> > ---
> >    
> >
> > >         VERSION=1.0.3
> > >      
> > 4c4
> > <           MD5[0]='2f612afb7c2fe56c38658863279f1c23'
> > ---
> >    
> >
> > >          MD5[0]='a2bce3367b84d4ae3b12aba0eb6f5db2'
> > >      
> > ==== //sgl/devel/grimoire/collab/Plone/HISTORY#3 (text) ====
> >
> > 0a1,4
> >    
> >
> > > 2003-06-13  Sergey Lipnevich  <sergey AT sourcemage.org>
> > >         Complete the BUILD file -- install Plone into /usr/lib/zope/Products.
> > >         Add dependency on CMF.
> > >
> > >      
> > 2,3c6,7
> > <
> > <            Modified DETAILS to fix md5 for SOURCE.
> > ---
> >    
> >
> > >         Modified DETAILS to fix md5 for SOURCE.
> > >         [SL] My file has a different checksum, interesting...
> > >      
>
> - --
> Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.0 (FreeBSD)
>
> iD8DBQE+9NZh7fQ833vqzH0RAo2GAJ0feM8vqAlaMqwgFghZMcC8W37VygCcCNbw
> TyFwxzj4SOTYa649LCXrK2U=
> =2P3T
> -----END PGP SIGNATURE-----
>
>  
Only in CMFPlone-1.0.3/CMFPlone: .#WorkflowTool.py.1.7.2.3
diff -pur CMFPlone-1.0.3-prev/CMFPlone/WorkflowTool.py 
CMFPlone-1.0.3/CMFPlone/WorkflowTool.py
--- CMFPlone-1.0.3-prev/CMFPlone/WorkflowTool.py        2003-06-14 
17:22:03.000000000 -0400
+++ CMFPlone-1.0.3/CMFPlone/WorkflowTool.py     2003-06-16 01:13:41.000000000 
-0400
@@ -8,12 +8,28 @@ from Products.CMFCore.WorkflowCore impor
 from Globals import InitializeClass, DTMLFile
 from AccessControl import ClassSecurityInfo
 from Products.CMFCore import CMFCorePermissions
-
+from Products.DCWorkflow.Transitions import TRIGGER_USER_ACTION
 from PloneUtilities import log
+
+try:
+    from Products.CMFEventService.Events import ContentAddEvent as AddEvent
+except:
+    AddEvent=None
+
 class WorkflowTool( BaseTool ):
     security = ClassSecurityInfo()
     plone_tool = 1
 
+    security.declarePrivate('notifyCreated')
+    def notifyCreated(self, ob):
+        """ after the object has been created lets send an event if possible 
"""
+        BaseTool.notifyCreated(self, ob)
+
+        portal_events=getToolByName(self, 'portal_events', None)
+        if portal_events is not None and AddEvent:
+            event=AddEvent(ob, context=ob.aq_parent)
+            portal_events.publish(event)
+            
     security.declarePublic('doActionFor')
     def doActionFor(self, ob, action, wf_id=None, *args, **kw):
         """ it appears that objects are reindexed after they
@@ -48,38 +64,32 @@ class WorkflowTool( BaseTool ):
                       t_names.append(t['name'])
 
         return tuple(transitions[:])
-    
+
     security.declarePublic('getTransitionsFor')
-    def getTransitionsFor(self, obj=None, container=None, REQUEST=None):     
  
-        if type(obj)==type([]):
+    def getTransitionsFor(self, obj=None, container=None, REQUEST=None):
+        if type(obj) is type([]):
             return self.flattenTransitions(objs=obj, container=container)
-        else:
-            obj=obj
-
-        wfs=()
-        avail_trans=[]
-        objstate=None
-
-        try:
-            objstate=self.getInfoFor(obj, 'review_state')
-            wfs=self.getWorkflowsFor(obj)
-        except WorkflowException, e:
-            return avail_trans
-
-        for wf in wfs:
-            stdef=wf.states[objstate]
-            for tid in stdef.transitions:
-                if tid not in wf.transitions.objectIds(): #XXX sometimes 
getting submit
-                    break
-                trans=wf.transitions[tid]
-                if trans.getGuard().check(getSecurityManager(), wf, obj):
-                    t={}
-                    t['title']=trans.title
-                    t['id']=trans.id
-                    t['name']=trans.actbox_name
-                    avail_trans.append(t)
-        return tuple(avail_trans[:])
-
+        result = {}
+        chain = self.getChainFor(obj)
+        for wf_id in chain:
+            wf = self.getWorkflowById(wf_id)
+            if wf is not None:
+                sdef = wf._getWorkflowStateOf(obj)
+                if sdef is not None:
+                    for tid in sdef.transitions:
+                        tdef = wf.transitions.get(tid, None)
+                        if tdef is not None and \
+                           tdef.trigger_type == TRIGGER_USER_ACTION and \
+                           tdef.actbox_name and \
+                           wf._checkTransitionGuard(tdef, obj) and \
+                           not result.has_key(tdef.id):
+                            result[tdef.id] = {
+                                    'id': tdef.id,
+                                    'title': tdef.title,
+                                    'name': tdef.actbox_name
+                                    }
+        return tuple(result.values())
+    
     def workflows_in_use(self):
         """ gathers all the available workflow chains (sequence of workflow 
ids, ).  """
         in_use = []
diff -pur CMFPlone-1.0.3-prev/CMFPlone/skins/plone_scripts/folder_paste.py 
CMFPlone-1.0.3/CMFPlone/skins/plone_scripts/folder_paste.py
--- CMFPlone-1.0.3-prev/CMFPlone/skins/plone_scripts/folder_paste.py    
2003-06-14 17:22:03.000000000 -0400
+++ CMFPlone-1.0.3/CMFPlone/skins/plone_scripts/folder_paste.py 2003-06-16 
01:13:41.000000000 -0400
@@ -8,6 +8,14 @@
 ##title=Paste objects into a folder
 ##
 
+#NOTE
+# A enormous problem in Zope is that if you are using
+# string-based exceptions (like CopySupport) you can not
+# catch the exceptions outside of the module they are
+# defined.  You really have to catch the exception and
+# introspect it to find out if its really the one your
+# trying to catch.  Thats why we just try/except.
+
 REQUEST=context.REQUEST
 msg='Copy or cut one or more items to paste.' 
 
diff -pur CMFPlone-1.0.3-prev/CMFPlone/skins/plone_templates/main_template.pt 
CMFPlone-1.0.3/CMFPlone/skins/plone_templates/main_template.pt
--- CMFPlone-1.0.3-prev/CMFPlone/skins/plone_templates/main_template.pt 
2003-06-14 17:22:03.000000000 -0400
+++ CMFPlone-1.0.3/CMFPlone/skins/plone_templates/main_template.pt      
2003-06-16 01:13:41.000000000 -0400
@@ -27,9 +27,9 @@
   <metal:block metal:fill-slot="base">
     <metal:block metal:define-slot="base">
        <base href=""
-             tal:condition="here/isPrincipiaFolderish|nothing"
+             tal:condition="here/aq_explicit/isPrincipiaFolderish|nothing"
              tal:attributes="href python:here.absolute_url()+'/'" />
-       <metal:block tal:condition="not:here/isPrincipiaFolderish|nothing">
+       <metal:block 
tal:condition="not:here/aq_explicit/isPrincipiaFolderish|nothing">
           <base href=""
                 tal:define="path 
python:'/'.join(here.portal_url.getRelativeContentPath(here)[:-1])"
                 tal:attributes="href 
python:here.portal_url()+'/'+path+test(len(path)>0,'/','')" />
Only in CMFPlone-1.0.3/: i18n