ZCatalog is missing security declarations on methods

[David Glick]

The following methods of Products.ZCatalog.ZCatalog lack security declarations.

This first set also lacks docstrings, so should be protected from being publishable once issue #713253 is resolved:
Products.ZCatalog.ZCatalog.ZCatalog.addColumn
Products.ZCatalog.ZCatalog.ZCatalog.addIndex
Products.ZCatalog.ZCatalog.ZCatalog.clearIndex
Products.ZCatalog.ZCatalog.ZCatalog.delColumn
Products.ZCatalog.ZCatalog.ZCatalog.delIndex
Products.ZCatalog.ZCatalog.ZCatalog.reindexIndex

But this set has docstrings, and may provide access to data that should not be public:
Products.ZCatalog.ZCatalog.ZCatalog.getIndexDataForRID
Products.ZCatalog.ZCatalog.ZCatalog.getIndexDataForUID
Products.ZCatalog.ZCatalog.ZCatalog.getMetadataForRID
Products.ZCatalog.ZCatalog.ZCatalog.getMetadataForUID
Products.ZCatalog.ZCatalog.ZCatalog.getrid
Products.ZCatalog.ZCatalog.ZCatalog.resolve_path

In particular, getIndexDataForUID and getMetadataForUID make it possible to get all catalog data for an item if only its path is known.

[Matthew Wilkes (matthew-matthewwilkes)]

Thanks for reporting this David, I just remembered it from our chat and was about to do it myself. I'm going to build this into rc2 for the Plone hotfix due later today, ftr.

[Hanno Schlichting (hannosch)]

Fix committed in r120265 for Zope 2.12 and released in Products.ZCatalog 2.13.6 for Zope 2.13 / trunk.