Merge commit from fork

* prevent untrusted access to `AccessControl.userfolder.UserFolder.data` * fix: capitalization --------- Co-authored-by: Tres Seaver <tseaver@palladion.com>
zopefoundation · Nov 3, 2024 · 98f6125 · 98f6125
1 parent 5e846cb
commit 98f6125
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -6,6 +6,9 @@ For changes before version 3.0, see ``HISTORY.rst``.
 7.2 (unreleased)
 ----------------
 
+- Prevent untrusted access to ``AccessControl.userfolder.UserFolder.data``
+  (fixes `GHSA-g5vw-3h65-2q3v <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v>`_).
+
 
 7.1 (2024-10-10)
 ----------------

diff --git a/src/AccessControl/userfolder.py b/src/AccessControl/userfolder.py
@@ -376,6 +376,7 @@ class UserFolder(BasicUserFolder):
     zmi_show_add_dialog = False
     id = 'acl_users'
     title = 'User Folder'
+    data__roles__ = ()  # prevent untrusted access to ``data``.
 
     def __init__(self):
         self.data = PersistentMapping()