Commit 6f09c5e6 authored by Łukasz Nowak's avatar Łukasz Nowak Committed by Rafael Monnerat

Disallow selecting by uid.

uid is used internally during recursive calls and using uid can lead to
traverse all lines of catalog.
parent dd9e2d0c
...@@ -1081,6 +1081,9 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject): ...@@ -1081,6 +1081,9 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject):
security.declarePublic('searchAndActivate') security.declarePublic('searchAndActivate')
def searchAndActivate(self, *args, **kw): def searchAndActivate(self, *args, **kw):
"""Restricted version of _searchAndActivate""" """Restricted version of _searchAndActivate"""
if 'uid' in kw:
raise TypeError("'uid' cannot be used to select documents as it is "
"used internally")
return self._searchAndActivate(restricted=True, *args, **kw) return self._searchAndActivate(restricted=True, *args, **kw)
security.declareProtected(Permissions.ManagePortal, 'upgradeSchema') security.declareProtected(Permissions.ManagePortal, 'upgradeSchema')
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment