• Shane Hathaway's avatar
    Merge from 2_6 branch. · ab64097b
    Shane Hathaway authored
    Jamie Heilman discovered it was possible for anonymous users to add
    ZClass permission objects.  The newly created permission objects had
    no real effect on security, but anonymous users should not be able to
    do this anyway, so this patch fixes the bug.
    
    The problem was that PermissionManager never got initiatized.  While I
    was here, I took the opportunity to initialize other classes as well,
    update the security declaration style, and apply the 'Define
    permissions' permission.
    ab64097b
Product.py 18.7 KB