Commit bfdcec37 authored by Łukasz Nowak's avatar Łukasz Nowak Committed by Rafael Monnerat

Disallow selecting by uid.

uid is used internally during recursive calls and using uid can lead to
traverse all lines of catalog.
parent af06a551
...@@ -1223,6 +1223,9 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject): ...@@ -1223,6 +1223,9 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject):
security.declarePublic('searchAndActivate') security.declarePublic('searchAndActivate')
def searchAndActivate(self, *args, **kw): def searchAndActivate(self, *args, **kw):
"""Restricted version of _searchAndActivate""" """Restricted version of _searchAndActivate"""
if 'uid' in kw:
raise TypeError("'uid' cannot be used to select documents as it is "
"used internally")
return self._searchAndActivate(restricted=True, *args, **kw) return self._searchAndActivate(restricted=True, *args, **kw)
security.declareProtected(Permissions.ManagePortal, 'upgradeSchema') security.declareProtected(Permissions.ManagePortal, 'upgradeSchema')
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment