Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tighten down security on several login string transformation methods #89

Merged
merged 1 commit into from Mar 12, 2021

Conversation

dataflake
Copy link
Member

Fixes #88

None of the involved methods need to be public, they are all only used internally from what I can tell.

@dataflake dataflake self-assigned this Mar 11, 2021
Copy link
Member

@mauritsvanrees mauritsvanrees left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this helps.

@mauritsvanrees
Copy link
Member

I wonder if there is code in the wild that calls these methods from a restricted Python skin script. To support this, the code would have to remain public, but the docstring can be removed to avoid making it available via url.
But I originally added these methods to help support login via email, and I don't see any of that code using this from a skin script, also not in older Plone versions.
So the PR should be fine.

@dataflake dataflake merged commit 00631f0 into master Mar 12, 2021
@dataflake dataflake deleted the dataflake/issue_88 branch March 12, 2021 06:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Tighten down some published methods that don't need to be public
2 participants