Zope-Dev

zope-dev@zope.dev

May 2002

85 participants
72 discussions

Does 'undo' scan the entire ZODB?
by Ivo van der Wijk 02 May '02

02 May '02

Hi All, I just noticed that the undo tab on our zopeserver takes ages to load. If I try to trace the zope proces (as far as possible), it looks asif the entire Data.fs is scanned. Does zope scan the entire ZODB for old versions? It slows down our server enourmously with a 3G Data.fs. If so, aren't there more efficient ways to do this (backreferences to old versions for example) Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam, NL -=- T +31-20-4688336 F +31-20-4688337 Linux/Web/Zope/SQL/MMBase W http://www.amaze.nl E info(a)amaze.nl Network Solutions W http://vanderwijk.info E ivo(a)amaze.nl Consultancy PGP http://vanderwijk.info/pgp -=-

3 2

copy/paste security
by Christopher N. Deckard 01 May '02

01 May '02

Hi, It is common knowledge that we can restrict access to an object by taking away many of the permissions from the security manager in the ZMI. Especially in the case of some objects like Oracle database connections, you don't want other people to be able to snag your "connect string" which contains username and password information. However, if a user has access to any folder on the system, they can programatically (and in some cases use the ZMI) copy the objects to anohter location. For example, if a user can view the management screens in a folder, they can copy an object, paste it to another location, give his self Manager local roles, and then view the "connect string". This works basically for every object. The problem is the CopySupport._canCopy method, which always returns 1 (true). It looks like this should be overridden for special products, but the base functionality should do some basic permission checking to determine if the object is copyable or should be copied. Below is a diff for OFS/CopySupport which adds a check to _canCopy to look for the "Access contents information" permission. -Chris -- -------------------------------------------------------------------- Christopher N. Deckard | Lead Web Systems Developer cnd(a)ecn.purdue.edu | Engineering Computer Network http://www.ecn.purdue.edu/ | Purdue University ---- zlib.decompress('x\234K\316Kq((-J)M\325KM)\005\000)"\005w') --- --- CopySupport.py.orig Wed May 1 14:59:46 2002 +++ CopySupport.py Wed May 1 15:02:34 2002 @@ -382,7 +382,9 @@ def _canCopy(self, op=0): """Called to make sure this object is copyable. The op var is 0 for a copy, 1 for a move.""" - return 1 + if self.REQUEST.AUTHENTICATED_USER.has_permission('Access contents information', self): + return 1 + return 0 def _notifyOfCopyTo(self, container, op=0): """Overide this to be pickly about where you go! If you dont

1 0