- Fix missing access control on ZODB Role Manager enumerateRoles

dataflake · dataflake · commit 2dad81128250 · 2021-02-23T12:25:04.000+01:00
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -4,6 +4,8 @@ Change Log
 2.6.0 (unreleased)
 ------------------
 
+- Fix missing access control on ZODB Role Manager ``enumerateRoles``
+
 - Fix open redirect issue in `Cookie Auth Helper` redirect handling
 
 - Add support for Python 3.9.
diff --git a/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py b/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
@@ -112,6 +112,7 @@ def getRolesForPrincipal(self, principal, request=None):
     #
     #   IRoleEnumerationPlugin implementation
     #
+    @security.private
     def enumerateRoles(self, id=None, exact_match=False, sort_by=None,
                        max_results=None, **kw):
         """ See IRoleEnumerationPlugin.

Original file line number	Diff line number	Diff line change
`@@ -112,6 +112,7 @@ def getRolesForPrincipal(self, principal, request=None):`
`112`	`112`	`#`
`113`	`113`	`# IRoleEnumerationPlugin implementation`
`114`	`114`	`#`
	`115`	`+ @security.private`
`115`	`116`	`def enumerateRoles(self, id=None, exact_match=False, sort_by=None,`
`116`	`117`	`max_results=None, **kw):`
`117`	`118`	`""" See IRoleEnumerationPlugin.`