CVE-2013-7061

@@ -8,6 +8,9 @@ Changelog
 4.3.3 (unreleased)
 ------------------
 
+- merge hotfixes from https://pypi.python.org/pypi/Products.PloneHotfix20131210
+  [vangheem]
+
 - handle plone.app.textfield RichTextValue objects in syndication. Should
   fix syndication with plone.app.contenttypes.
   [vangheem]

@@ -394,6 +394,27 @@ def searchResults(self, REQUEST=None, **kw):
 
     __call__ = searchResults
 
+    def search(self, *args, **kw):
+        # Wrap search() the same way that searchResults() is
+        query = {}
+
+        if args:
+            query = args[0]
+        elif 'query_request' in kw:
+            query = kw.get['query_request']
+
+        kw['query_request'] = query.copy()
+
+        user = _getAuthenticatedUser(self)
+        query['allowedRolesAndUsers'] = self._listAllowedRolesAndUsers(user)
+
+        if not _checkPermission(AccessInactivePortalContent, self):
+            query['effectiveRange'] = DateTime()
+
+        kw['query_request'] = query
+
+        return super(CatalogTool, self).search(**kw)
+
     security.declareProtected(ManageZCatalogEntries, 'clearFindAndRebuild')
     def clearFindAndRebuild(self):
         """Empties catalog, then finds all contentish objects (i.e. objects

@@ -272,6 +272,7 @@ class FactoryTool(PloneBaseTool, UniqueObject, SimpleItem):
     f = open(os.path.join(wwwpath, 'portal_factory_docs.stx'), 'r')
     _docs = f.read()
     f.close()
+    del f
     _docs = stx2html(_docs)
 
     security.declarePublic('docs')

@@ -480,10 +480,17 @@ def testSearchIgnoreAccents(self):
         self.assertEqual(len(self.catalog(SearchableText='Économétrie')), 3)
         self.assertEqual(len(self.catalog(SearchableText='Econométrie')), 3)
         self.assertEqual(len(self.catalog(SearchableText='ECONOMETRIE')), 3)
-                
-                
 
-        
+    def testSearchIsProtected(self):
+        self.login()
+        self.folder.invokeFactory("Document", "sekretz")
+        self.logout()
+        catalog = self.portal.portal_catalog
+        bogus = catalog.search({'portal_type': 'Document'})
+        real = catalog.portal_catalog.searchResults(portal_type='Document')
+        self.assertEqual(len(bogus), len(real))
+
+
 class TestCatalogSorting(PloneTestCase.PloneTestCase):
 
     def afterSetUp(self):

@@ -1,4 +1,5 @@
 import urlparse
+import os
 from Products.CMFPlone.tests import PloneTestCase
 
 from Products.CMFCore.permissions import AddPortalContent
@@ -352,3 +353,10 @@ def testBrowserResource(self):
         path = "%s/++resource++plone-logo.png" % self.tmp_obj_path
         data = self.publish(path)
         self.assertEqual(data.getHeader('Content-Type'), 'image/png')
+
+    def testFactoryToolDocsFileNotPublishable(self):
+        import Products.CMFPlone
+        res = self.publish('/plone/portal_factory/f')
+        plone_code = os.path.dirname(Products.CMFPlone.__file__)
+
+        self.assertNotIn(plone_code, res.getBody())