summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 3a3579a)
raw | patch | inline | side by side (parent: 3a3579a)
author | richard <richard@57a73879-2fb5-44c3-a270-3262357dd7e2> | |
Wed, 23 Dec 2009 00:34:39 +0000 (00:34 +0000) | ||
committer | richard <richard@57a73879-2fb5-44c3-a270-3262357dd7e2> | |
Wed, 23 Dec 2009 00:34:39 +0000 (00:34 +0000) |
git-svn-id: http://svn.roundup-tracker.org/svnroot/roundup/roundup/trunk@4416 57a73879-2fb5-44c3-a270-3262357dd7e2
doc/upgrading.txt | patch | blob | history |
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 84a703a0aa39be4a42cb0e5713a1b827d47f7ea6..3b69fbfaa55dd78b15c8e518a3fb8444b70b7b81 100644 (file)
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
Migrating from 1.4.x to 1.4.11
==============================
-Close poential security hole
-----------------------------
+Close potential security hole
+-----------------------------
If your tracker has untrusted users you should examine its ``schema.py``
file and look for the section granting the "Edit" permission to your users.
anonymous users to register. This means you will need to add the
following to your tracker's ``schema.py`` to add the permission and
assign it to the Anonymous role (replacing any previously assigned
-"Create user" permission for the Anonymous role):
+"Create user" permission for the Anonymous role)::
+db.security.addPermission(name='Register', klass='user',
- + description='User is allowed to register new user')
+ + description='User is allowed to register new user')
# Assign the appropriate permissions to the anonymous user's Anonymous
# Role. Choices here are: