- Fix missing access control on ZODB Role Manager enumerateRoles

zopefoundation · Feb 23, 2021 · 2dad811 · 2dad811
1 parent 7eead06
commit 2dad811
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -4,6 +4,8 @@ Change Log
 2.6.0 (unreleased)
 ------------------
 
+- Fix missing access control on ZODB Role Manager ``enumerateRoles``
+
 - Fix open redirect issue in `Cookie Auth Helper` redirect handling
 
 - Add support for Python 3.9.

diff --git a/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py b/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
@@ -112,6 +112,7 @@ def getRolesForPrincipal(self, principal, request=None):
     #
     #   IRoleEnumerationPlugin implementation
     #
+    @security.private
     def enumerateRoles(self, id=None, exact_match=False, sort_by=None,
                        max_results=None, **kw):
         """ See IRoleEnumerationPlugin.