search

zopefoundation / Products.PluggableAuthService

Pluggable Zope authentication / authorization framework
Other
9 stars 18 forks source link

Tighten down security on several login string transformation methods #89

Closed dataflake closed 3 years ago

dataflake commented 3 years ago

Fixes #88

None of the involved methods need to be public, they are all only used internally from what I can tell.

mauritsvanrees commented 3 years ago

I wonder if there is code in the wild that calls these methods from a restricted Python skin script. To support this, the code would have to remain public, but the docstring can be removed to avoid making it available via url. But I originally added these methods to help support login via email, and I don't see any of that code using this from a skin script, also not in older Plone versions. So the PR should be fine.