October 2000 - Zope-Dev

RE: Zope url
by James Johnson 03 Oct '00

03 Oct '00

1 0

Zope URL
by Suzette Ramsden 03 Oct '00

03 Oct '00

I am hoping someone can help me. I am at the end of my line. I have tried everything and nothing else works. I am trying to install Zope on my web server on which I have a small intranet. I am using Windows NT 4.0 and IIS 4.0. Ideally I was trying to use Squishdot with Zope to create a small discussion forum that can be accessed via the INTRANET. My Web server name is SRNT and is installed on my F:\ partition drive I installed Zope in the root cgi-bin directory and called my website ZopeSite. I selected the "Run as a win32 service" F:\InetPub\wwwroot\cgi-bin\ZopeSite\ I went to my browser (MS Internet Explorer 5.0) and accessed the Zope Site using the URL: http://srnt:8080/manage I successfully accessed my Zope site manager and everything was working just fine. Now comes the problem: I do not want to connect to the Intranet using the server port (8080) in the URL to access the Zope pages . I installed both Squishdot and TinyTables products on Zope and started building a Squishdot site, which I named ChatClub. However, the URL to access the Squishdot site looks like: http://srnt:8080/Control_Panel/Products/Squishdot/ChatClub/index_html I WANT IT TO AT LEAST SAY: http://srnt/Control_Panel/Products/Squishdot/ChatClub/index_html OR http://srnt/ChatClub/index_html I don't want any reference to the server port 8080. I have read several help documents on IIS and PCGI AND THEY ALL SAY DIFFERENT THINGS. One document said to copy the Zope.pcgi to the IIS cgi-bin folder and another said to copy it to the IIS scripts folder. One document showed the Zope.pcgi file path configuration completely different from mine. The document showed : PCGI_MODULE_PATH=X:\WebSite\lib\python\Main.py And mine showed PCGI_MODULE_PATH=F:\InetPub\wwwroot\cgi-bin\ZopeSite\lib\python\Zope The document even had files I didn't have anywhere in my directory like pcgi.soc and some in completely different folders like: Help document: PCGI_MODULE_PATH=X:\WebSite\pcgi\pcgi.pid My file: PCGI_MODULE_PATH=F:\InetPub\wwwroot\cgi-bin\ZopeSite\var\pcgi.pid I know there must be a a simple way to accomplish this. I just need someone to tell me how to do it STEP BY STEP. I am a Programmer/Analyst, but I am only a novice when it comes to servers and all the details. PLEASE HELP Regards, Suzette E. Ramsden

1 0

Re: [Zope-dev] Re: CoreSessionTracking proposal
by Anthony Baxter 03 Oct '00

03 Oct '00

>>> KevinL wrote > > Please, please, please, do _not_ use IP numbers to verify it's the same > connection. You guys don't have the problem in .us, but out here at the > fringes (.au, and presumably .uk and similar), proxy server use is rampant - > and leaning on IP breaks, because proxy's share the connection around. worse yet, the customer may not even be aware of the proxy, if the network provider is using some sort of device like those cruddy cisco transparent proxies (hi Kev!) having spent a fair chunk of the last week dealing with issues of caching and general mangling caused by dodgy and strange proxies, I can only add that if it's possible for a proxy to do something wierd and wrong (like, lie about the original IP address) assume that it will. Anthony

1 0

RE: [Zope-dev] Re: CoreSessionTracking proposal
by Toby Dickenson 03 Oct '00

03 Oct '00

> Are you suggesting that the session token should actually > store session > data? As an alternative SessionManager, it appears to have some advatanges that others do not. It is the only option (AFAIK) that avoids the session hijacking problem without relying on security-through-obscurity (the problem you mentioned, but its not one that gets me excited). Its also the only sensible option that lets you bookmark your place in a session, and return to it much later (which interests me more). > Or are you just pointing out the difference between the > implementation an implementation that meets the requirements > of sessions > and an implementation adequate for things like the tree tag? Isnt the tree tag an example of one Session use case? It smells alot like a session to me.

3 6

RE: [Zope-dev] Re: CoreSessionTracking proposal
by Toby Dickenson 03 Oct '00

03 Oct '00

> > i.e. it is secure if the key *is* the data, rather than a key to the > > data. > > Can you explain? I do not see what you're getting at. Consider how the tree-tag stores its 'session' data. Its impossible to hijack a tree-tag session because the 'session' state is stored by the client (in the URL) in full. There are other differences between this type of session and the CoreSessionTrackingProposal; but the advantages are not all one way.

2 1

Re: Thanks a lot, but...
by Danny William Adair 03 Oct '00

03 Oct '00

Thank you Itamar, _but_ I need the Unix .so, not the Windows .dll. Sorry if I didn't put that clear. Danny -----Ursprungliche Nachricht----- Von: itamar(a)maxnm.com [mailto:itamar@maxnm.com] Gesendet: Dienstag, 3. Oktober 2000 15:20 An: Danny(a)Adair.net Betreff: Re: [Zope-dev] DynPersist.so from ZPatterns 0-4-2a3 Danny William Adair wrote: > I'm desperately looking for the DynPersist shared library (new for ZPatterns > 0-4-2a3) in compiled form. > Can someone help me (send it to me)? I'm running a Zope instance at NIP > (www.nipltd.net) that's 2.2.1 on Unix platform. Here ya go. Rename it to DynPersist.dll before use. -- Itamar S.T. itamar(a)maxnm.com Fingerprint = D365 7BE8 B81E 2B18 6534 025E D0E7 92DB E441 411C

1 0

rpc-xml: Pachyderm memories needed !
by Nigel Head 03 Oct '00

03 Oct '00

Context: Getting xml-rpc working with the Macromedia Flash 5 XML handling tools. Problem: Flash sends the XML as application/x-www-form-urlencoded instead of as text/xml (which I shall report as a bug to Macromedia, but I'm not holding my breath for a correction/patch). Now I've used the source and I can see that this won't work as it stands but I'll swear that a couple of weeks back, just after I got the Flash 5 upgrade I had this running with whatever version of Zope was extant then! Unfortunately I've been following along with the CVS checkouts without archiving them so I can't prove it. Anyone remember if there have been recent changes in this area ? And I'd be glad of a hint as to how to go about patching my Zope to allow both forms of encoding: my first naive attempt to just add an 'or' clause to the content-type test in HTTPRequest.py didn't work :-( And, as I'm not so experienced in Zope fiddling, what is the best approach to doing 'print statement' type debugging - I tried using zLOG.LOG but as near as I can tell the logging didn't go anywhere that I could find! Are there gotchas in using logging like this? In retrospect, I suppose the two previous paras may also just indicate that it's never getting to that part of the code at all .... oh dear ! Thanks in advance for any help or hints, Nigel. -- Nigel Head Houbits Hi-Tech Servers nhead(a)houbits.com

1 0

Access problems
by Danny William Adair 03 Oct '00

03 Oct '00

Hi all! I have a serious and extremely urgent problem concerning my zope installation(2.2.1 on Unix): Whatever resource I'm trying to access, I get the following --------------- Attribute Error --------------- Traceback (innermost last): File /home/sites/site3/users/.../2-2-1/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/sites/site3/users/.../2-2-1/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/sites/site3/users/.../2-2-1/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: ApplicationDefaultPermissions) File /home/sites/site3/users/.../2-2-1/lib/python/ZPublisher/Publish.py, line 162, in publish File /home/sites/site3/users/.../2-2-1/lib/python/ZPublisher/BaseRequest.py, line 438, in traverse File /home/sites/site3/users/.../2-2-1/lib/python/ZPublisher/BaseRequest.py, line 514, in old_validation (Object: broken) AttributeError: (see above) Furthermore, I have to authenticate on _every_ occasion, even with objects I know are totally available to Anonymous. After (http) authentication I get the above mentioned attribute error. I'm clueless. What is this about? Thanking you so much in advance, Prost, Danny P.S.: Of course I can't recall doing anything rude to my installation, actually I can't recall doing _anything_. (What they all say)

1 0

XSLTMethod and ZDOM
by gotcha＠swing.be 03 Oct '00

03 Oct '00

Hello, This a message from a newbie to the Zope-xml process. I have already tried to get pointers to the current discussion, but it has been difficult to get some. So this is my participation to the current building process. I hope it is not a repeat of concepts which has already been proposed many times. XSLT is a tree-to-tree transformation language. Most current implementations rely on the DOM to access the tree. As a Zope system can currently be accessed through ZDOM, it should be possible to apply a XSLT stylesheet to any Zope node, provided that those nodes have been designed to output XML. This would allow to go a step further than 'just' transforming a XMLDocument stored in ZODB but also to access totally dynamic XML produced with the whole potential of Zope (DTML, ZSQL, Python, Perl and so on). You would be able to associate specific stylesheet to the different nodes level (XSLTMethod) and to associate a default XSLT to any folderish or documentish object in ZODB. This would ease the presentation-content separation we all wish to build inside or Web Applications. I think this is a better path for complex apps than the template model. In fact, by producing XML, you give yourself a bigger chance to reuse the logic hidden inside the data aggregation process than by having to rebuild access to the different methods you built to fill a XHTML template. I perfectly get that the publishing environments needs both tools to provide solutions to both simple and complex contexts. I would really appreciate any comment on this small brick for the building. Cheers, PS Excuse the cross posting on Zope-Dev and Zope-xml but Zope- xml does not seem to still be alive. Godefroid Chapelle --------------------- BubbleNet sprl rue Victor Horta 30 1348 Louvain-la-Neuve Belgium --------------------------------------------------------------------- This mail sent through SwinG Webmail: http://mail.swing.be

1 0

Re: CoreSessionTracking proposal
by gotcha＠swing.be 03 Oct '00

03 Oct '00

--- In zope(a)egroups.com, Chris McDonough <chrism@d...> wrote: > I suppose I could implement something like this (encode the IP address > into the token) and provide a knob to turn it on and off on the id > manager. I'm not going to do this for the first iteration, I need to > get it working first. :-) > > Steve Spicklemire wrote: > > > > I forget now where I saw this.... but one of the session managers I looked > > at once checked the IP address of the visitor to make sure it was the > > same for the entire session, or longer. This at least makes it much harder > > to hijack a session, even though it means that long-lived cookies might > > be fooled as a user gets a new dynamic IP address... I think WebHub is using the IP address. WebHub is a product built and working witrh Delphi. I tried to find where they mention it on their website (http://www.webhub.com) but could not find it. In fact, if I remember well the server remembers the IP address (instead of crunching it into the id) and check the correspondence between the session id and the IP address when answering request. I was told that some ISP change your IP address during a connection but never took the time to check if it is true. > > > > -steve > > > > >>>>> "Chris" == Chris McDonough <chrism@d...> writes: > > > > Chris> Session tokens, AFAICT, cannot be secured. They can only > > Chris> be obfuscated, which mitigates the risk that they will be > > Chris> guessed. However, there's no way to completely secure > > Chris> them, no matter how many MD5 hashing algorithms you run on > > Chris> them. If a session token is stolen, that's the key that > > Chris> the "attacker" needs to visit the website "as you". I've > > Chris> addressed this in the implementation by giving the session > > Chris> token a random element, and this mitigates a guessing > > Chris> attack, but not a theft attack. > > -- > Chris McDonough > Digital Creations, Publishers of Zope > http://www.zope.org Cheers, Godefroid Chapelle --------------------- BubbleNet sprl rue Victor Horta 30 1348 Louvain-la-Neuve Belgium --------------------------------------------------------------------- This mail sent through SwinG Webmail: http://mail.swing.be

3 2