August 2001 - Zope-Dev

Z SQL Method problems (now two confirmed bugs)
by Andy Dustman 10 Aug '01

10 Aug '01

[Moving this to Zope-Dev] I've done some more investigation and determined there is a fundamental flaw in the way Z SQL Method parameters are handled. On Tue, 7 Aug 2001, Andy Dustman wrote: > I have a Z SQL Method (SELECT) with the following parameters: > > HostId DomainId Name IP > > and the following SQL: > > SELECT > HostId, DomainId, RecordType, Name, IP, Distance, Target, TTL, > StartEndTime, Location, Updated > FROM Hosts > <dtml-sqlgroup where> > <dtml-sqltest HostId column="HostId" type=int optional> > <dtml-and> > <dtml-sqltest DomainId column="DomainId" type=int optional> > <dtml-and> > <dtml-sqltest Name column="Name" type=nb optional> > <dtml-and> > <dtml-sqltest IP column="IP" type=int optional> > </dtml-sqlgroup> > > Note that all tested columns are optional. Using the Test tab, everything > works correctly: If I leave off values, that portion isn't rendered. > > Now... I have a DTML Method which performs: > > <dtml-in SELECT mapping> ... </dtml-in> > > This bombs unless all the parameters are specified in form data. Now, for the reason it bombs: When called, a Z SQL Method ultimately gets information about parameters from the parse() function in Aquaduct.py. For each parameter parsed (and there are problems with the parsing, but that's another problem), it checks trys three things: 1) Get the parameter value from REQUEST. 2) Failing that: Assign the parameter it's default value, if it exists. 5^H3) Failing that: If the parameter is marked optional, ignore it. Here is the problem: There is no way for parse() to mark a parameter as optional. It simply is not tested for in any way. It also cannot get this information from the <dtml-sqltest ...> element, because it doesn't have access to it or the template. Solution: parse() does have the capability of finding a parameter type (for the above-mentioned reason), i.e. the parameters could be written: HostId:int DomainId:int Name:nb IP:int I propose also allowing :optional to follow the type, so that parse() can set this properly, i.e.: HostId:int:optional DomainId:int:optional Name:nb:optional IP:int:optional Note that currently default values take precedence over optional values (if it could find any). I'll prepare a patch that can do this if requested (DC/ZopeCorp decide this is a good solution) and it will also fix the parameter="value" parsing problem (broken in 2.4.0). -- Andy Dustman PGP: 0xC72F3F1D @ .net http://dustman.net/andy I'll give spammers one bite of the apple, but they'll have to guess which bite has the razor blade in it.

6 7

Zope-2.4.0 and python 2.1.1 error
by Dario Lopez-Kästen 10 Aug '01

10 Aug '01

Hello, I have the following problem with Zope-2.4.0 Source release compiled on Solaris (SunOS 5.6 Generic_105181-21 sun4u sparc SUNW,Ultra-4) It seems that it if user A exports a folder owned by user B, then user B cannot import it back and take ownership of it. However it is Ok if user A imports user Bs folder; after import user B can take back ownerships og his folder from user A. Is this a bug? Here's what we did: 1) User A exports a Zope 2.3.3 folder owned by user B 2) User A imports to folder to Zope 2.4.0 3) User A deletes folder, since in Zope 2.4.0 user should own the folder 4) Log out user A, login user B 6) User B imports folder, taking ownership, and fails with message below 7) User A logs in on other machine to server imports folder, OK 8) User B creates new folder and in it imports the folder. Fails again. 9) User B takes ownership of folder imported by user A. Sucess Error message: Traceback (most recent call last): File "/usr/local/zope/ZopeInstall/Zope-2.4.0/z2.py", line 774, in ? asyncore.loop() File "/usr/local/python-2.1.1/lib/python2.1/asyncore.py", line 194, in loop poll_fun (timeout, map) File "/usr/local/python-2.1.1/lib/python2.1/asyncore.py", line 86, in poll r,w,e = select.select (r,w,e, timeout) select.error: (4, 'Interrupted system call') Sincerely, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario(a)ita.chalmers.se ICQ will yield no hits IT Systems & Services

1 0

DCO2 beta5 and Solaris
by Dario Lopez-Kästen 10 Aug '01

10 Aug '01

Hello! Has anybody gotten any success using DCO2Beta5 with Solaris and Zope 2.3.3 and the LAtest Hotfix installed? I have it working w/o problems on my Win2K machine and Zope-2.4.0 but not on our Solaris server with 2.3.2 nor 2.3.3 /dario - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario(a)ita.chalmers.se ICQ will yield no hits IT Systems & Services

2 2

ftp problems
by Terry Kerr 10 Aug '01

10 Aug '01

Hi, I have seen many related posts on ftp problems before, but none seem to be specific to my problem. It has really got be stumped! I am FTPing from my box on a local network, though a gateway/firewall/masquerading box to the internet, through to a server running zope with ftp on port 21. The server is running a ipfilter firewall, letting all connections out, but only port 80,21,20,443 in. The gateway box is linux running an ipchains firewall which lets every connectin out, and it has the ftp masquerading kernel module loaded. The problem I have is that my ftp client (linux client, running in passive mode), will connect and authenticate to the zope ftp server, but I can't do anything else. If I turn the firewall off on our remote server, then ftp works fine. However, if I turn the firewall back on, but ftp from our gateway rather than my box behind the gateway, then ftp also works fine. Also, if I turn off the zope server, and run a standard ftpd daemon on port 21 on our remote server, I can ftp to it fine with the firewall turned on. So the problem is specific to zope+firewall+masquerading. Remove either one of those and it works. It makes be think that the ftp server in zope doesn't work in passive mode as it should? Any ideas? -- Terry Kerr (terry(a)adroit.net) Adroit Internet Solutions (www.adroit.net) Phone: +61 3 9563 4461 Fax: +61 3 9563 3856 ICQ: 79303381

2 1

Searchable zope-dev archives?
by David Thibault 09 Aug '01

09 Aug '01

Hello all, Is there a search interface somewhere to the zope-dev archives? If not, it would strike me as strange, given Zope's intrinsic cataloguing features...=) Thanks, Dave

2 1

RE: [Zope-dev] Cookies presented on management login
by David Thibault 09 Aug '01

09 Aug '01

Steve, Thanks for the input on this cookie issue. Also thanks to Chris McDonough who also replied and has expressed an interest in helping with innards questions. I responded to this one simply to apologize for the rich-text post...(insert stupid look here...=). I'm sure I'll post again for this project as soon as I come up w/ the next question...=) Dave Thibault -----Original Message----- From: Steve Alexander [mailto:steve@cat-box.net] Sent: Thursday, August 09, 2001 5:00 PM To: David Thibault Cc: 'zope-dev(a)zope.org' Subject: Re: [Zope-dev] Cookies presented on management login David Thibault wrote: > Hello all, > > I'm new to this list (my first post). I'm currently in a project for > SANS certification in which I'm auditing Zope security. I just noticed > that every time I log in I get a cookie from the server that has the > following info: > > Name: tree-s > Data: "eJzTiFZ3hANPW/VYHU0ALlYElA" You know that tree in the left hand frame of the management interface? Well, that cookie represents the state of the tree. See lib/python/TreeDisplay/TreeTag.py for the cookie handling stuff. It is in the methods encode_seq and encode_str, and the complementary decode_... methods. Please don't post HTML mail to this mailing list. -- Steve Alexander Software Engineer Cat-Box limited

1 0

Cookies presented on management login
by David Thibault 09 Aug '01

09 Aug '01

Hello all, I'm new to this list (my first post). I'm currently in a project for SANS certification in which I'm auditing Zope security. I just noticed that every time I log in I get a cookie from the server that has the following info: Name: tree-s Data: "eJzTiFZ3hANPW/VYHU0ALlYElA" The data is ALWAYS the same. I got the same cookie from a Redhat 7.1 box runnning Zope 2.3.2 as I did from an NT box running Zope 2.4.0. What is this cookie used for in the management process? I'm not at all familiar with Zope's innards (but hopefully I'll get familiar with the security innards at least). Also, trudging through all the source code to find the answer to this is not really a reality for me given the fact that my Python experience is not deep enough. On a separate but related note, could anyone forward me links describing the security innards? I am familiar enough with Zope to know that only certain modules can be imported, etc. However, I've had a really hard time finding anything more detailed than the security howtos that describe assigning permissions & such through the management interface. All the security precautions that have been taken into account when developing the core of Zope are of interest to me. Basically, the project is to hack zope before the hackers do. Hopefully, I won't find anything (or at least just little stuff like I mention in the next paragraph). What I hope will result of this is a checklist that people can go through to harden their Zope boxes. Also, if this is the wrong list to be asking about the security features of the innards, please direct me to the appropriate place. I hope to come up with a substantial review of Zope from a security standpoint. I've already found a couple of things that could be done to help (small things), like editing the header lines in HTTPResponse.py to not give up the server version info in the HTTP headers. Changing it to something like "Atari 2600 SuperServer" would at least keep the hackers from knowing you're running Zope 2.x.y and finding related vulnerabilities...=). Thanks, Dave Thibault

3 2

ZOracleDA with Zope 2.4 and Python 2.1
by Juan Javier Carrera Obrero 09 Aug '01

09 Aug '01

In Win32 plataform, I am updating to Zope 2.4 version and Python 2.1 version, but the ZOracleDA product does not correctly with these versions. I think that this product only runs correctly with the zope 2.1.6 and python 1.5. I have seen that in the ZOdbcDA product the "sql.pyd" library has been changed for use it with zope 2.4 and python 2.1. Anybody knows to how do to run the ZOracleDA product in the Zope 2.4 version and Python 2.1 version in Win32 plataform? I think that the problem is in the library "buffer" and "oci_". I have these libraries for zope 2.1.6 and python 1.5, but I have not theses libraries for the new versions. Also, I have been trying to compile the ZOracleDA's sources with gcc-2.95.2/mingw32 (for win32) as it says in "http://starship.python.net/crew/kernr/mingw32/Notes.html", but I only obtain errors. Anybody can help me? Thank you very much.

3 4

RE: [Zope-dev] 'transparent' proxying to a method not in your nam espace?
by sean.upton＠uniontrib.com 09 Aug '01

09 Aug '01

Were you able to call a method within a namespace for which it did not actually exist in this case? If so, that's sort of what I am after, except instead of user directory service, I'm thinking more along the line of a method directory service for said lookups and method calling. More specifically, I got this _really_ crazy idea into my head... ever since Jim's OSCON Components BOF, my brain has been trying to wrap around high-level use-cases of how it could be useful. That got me thinking a lot about a folder that I have that is bloated with all sorts of stuff; thousands of objects (mostly content), with dozens in the main folder - including code, presentation, sql, and content objects all over the place, and no matter how well I try to organize them, it still seems really messy - but it wouldn't be in service-oriented world. My interest is motivated by some frustrations with Transparent Folders. What I'm actually thinking of, I guess, is a little bit more ambitious: a lightweight 'interim' component/services type of system with a method directory/catalog service; let me explain: I have a folder - let's call it 'Content' - and it doesn't have a method I need to do something, for example, like an automation task set up in a TTW python script. In my ideal vision here, the method can be stuffed off in a central 'Code' folder located somewhere else in the odb hierarchy; My 'Content' folder needs a method called 'purgeExpiredContent' as an automation task. 'purgeExpiredContent' exists in the 'Code' folder; 'Content' doesn't have anything called 'purgeExpiredContent' but 'Content' is not a normal folder - it is a SuperMagicalGeniusFolder(TM) (perhaps there is a better name); if the folder had a dialog with itself, this is the conversation it would have: .................... "Someone just asked me to run a method called purgeExpiredContent. Do I have a method called that in my namespace?" "No." "Ok, I need to find it elsewhere; before I look in the namespace stack using acquisition, I am going to look up in a directory service if the method exists elsewhere. Does the Method Directory Service indicate it knows where this method lives?" "I just queried it, and it does know where this method lives; the path:..." "Ok, I got that path... " "I found the method; I'm going to run it within my ('Content') namespace." "Ok, I'm done..." .................... In this case, the method 'purgeExpiredContent' is more of a service to the 'Content' folder. The 'Method Directory Service' was likely a ZCatalog-derived lookup 'service object' in the Zope root; it's query result contained the path needed for 'Content' to obtain and run the method from wherever it lived (in this case, a folder called 'Code' in the Zope root, but using a method directory service, it really could live anywhere). The 'Content' folder had the smarts to intelligently look in the 'method directory' for methods it didn't have before it traversed its acquisition parents looking for it. It should be said that this feature should be provided via acquisition to contained objects below this SuperMagicalGeniusFolder(TM) called 'Content' and would use the namespace of the object it is called upon. This would make partitioning code, content, and presentation a lot easier. A method directory service and a smart folder like that could even use (optionally, in a componentized universe) as a 'method directory service' query parameter the interface asserted by the object trying to get the method as a means to determine if an method actually can be obtained; the catalog would return no resulting method even if it existed, but didn't work with the correct interface... I know I should just be patient and wait for component architecture ('cause yes, I now really see a need for it), but this idea is just stuck in my head, and I can't get it out cause it seems so useful... and it seems to me that one could use a modified ZCatalog as a good directory service for method lookups. I guess the complicated question (for me, at least) is whether or not the process of acquisition could be interrupted and/or preempted for an alternate traversal means for obtaining methods either inside my Product code or in a hotfix product. The concept of method lookup doesn't seem daunting, but making it execute transparently does. I would hope something like this would be possible without modifications to the Zope core... Sean -----Original Message----- From: Dyon Balding [mailto:dyon.balding@monster.com] Sent: Wednesday, August 08, 2001 10:15 AM To: sean.upton(a)uniontrib.com Cc: zope-dev(a)zope.org Subject: Re: [Zope-dev] 'transparent' proxying to a method not in your namespace? Sean, I think I understand what you're trying to do; if so, I've done something similar. What I had was a list of staff members pulled from LDAP, and a folder containing objects representing some of those staff members (those who had customized their information). The URLs from the staff list page were all the same, ie blah/staff/name or similar. I then had a site access_rule that grabbed and rendered the customized object if it existed, or retrieved some generic information from LDAP and rendered it if it didn't. I think that's approximately what you're trying to do? If the above method sounds plausible I can give you a copy of my code if it's any help. -d On Wed, Aug 08, 2001 at 09:22:51AM -0700, sean.upton(a)uniontrib.com wrote: > Problem: I have a custom folder type, and I want to hijack unsuccessful > method lookups in its namespace and have them transparently proxy to code in > another folder... > > I have a Python product class that uses Folder as it's base; it's cluttered > with code objects, and I don't want to have to use Transparent Folders, > which seem to break one thing or another. I'm also looking for (perhaps) > something as an application-specific alternative/addition to acquisition as > a namespace traversal mechanism. > > I had this idea of storing my various methods in a 'ProjectCode' folder in > the Zope root, and having my 'Folder' evaluate its own namespace looking for > a method; if it doesn't exist, before the Zope looks in the acquisition > parent(s), the 'Folder' looks in the namespace for the 'ProjectCode' (or > some other folder name) folder in the root to find the method, and run it > within the 'Folder' namespace. > > I'm sort of ignorant as to where to start looking if I wanted to do this, > but I'm willing to investigate and figure out how to code it if it's > something that can be done within my product code or in a hotfix, and > doesn't require a patch the size of Texas... > > Thoughts? > > Sean > > ========================= > Sean Upton > Senior Programmer/Analyst > SignOnSanDiego.com > The San Diego Union-Tribune > 619.718.5241 > sean.upton(a)uniontrib.com > ========================= > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) -- | Dyon Balding . Software Engineer . HiringTools.Monster.com | dyon(a)hiringtools.com . +1 415 288 3375

2 1

RFC: SecurityJihad Proposal
by Michael R. Bernstein 09 Aug '01

09 Aug '01

Hello All, As some of you may have noticed, I've been working on a proposal for removing Zope's inconsistencies regarding security that currently make writing Python products less straightforward then it should/could be. The proposal is at: http://dev.zope.org/Wikis/DevSite/Proposals/SecurityJihad What the proposal covers: - The cruft that has accumulated - The problems the cruft causes - The workarounds that the cruft makes neccessary - A proposal for removing the cruft, while maintaining what backwards compatibility we can. Note that while I think that a certain amount of backwards compatibility can be maintained, some breakage *must* occur if the workarounds are to be eliminated for product developers. Declaration of Jihad: Inconsistencies suck. Security inconsistencies are dangerous, and encourage the creation of insecure products. The incocnsistencies must be eliminated! I declare Jihad on all security inconsistencies! :-) Comments welcome, Michael Bernstein.

1 0