January 2003 - Zope-Dev

ACL patch for zope 2.6
by Erik Dahl 14 Jan '03

14 Jan '03

I wanted to add a little more security to a zope site that has no firewall in front of it but is mostly for internal users. To do this I put a check in the accept callback of http_server. Not sure how much security increase this really gives but I wonder if anyone would find it useful (or if anyone has a better solution)? Here is the patch. I only added the acl to the http server, it would be easy to do for the others as well (but I have these turned off). -EAD diff -C3 -r ./z2.py /home/edahl/zope/z2.py *** ./z2.py 2002-10-08 17:18:20.000000000 -0400 --- /home/edahl/zope/z2.py 2003-01-14 10:48:40.000000000 -0500 *************** *** 222,227 **** --- 222,234 ---- - The start of response output, and - The end of the request. + -A acl + Add an access control list to the HTTP server. List should be comma + delimited and can contain any part of the begining of an ip address. + For instnace 1.2.,3.4. would allow two class b networks 1.2.0.0/16 + and 3.4.0.0/16. + + Environment settings are of the form: NAME=VALUE. Note: you *must* use Python 2.1 or later! *************** *** 332,337 **** --- 339,350 ---- # Use a daemon process USE_DAEMON = 1 + # Access control list by IP + # each ip should be the begining of an ip + # ie 1.2. would allow the class b 1.2.0.0 + # mulitple ips should be comma delimited + ACL_LIST=() + # ######################################################################## *************** *** 386,392 **** opts, args = getopt.getopt(sys.argv[1:], ! 'hz:Z:t:i:a:d:u:w:W:f:p:m:Sl:2DP:rF:L:XM:C', ['icp=', 'force-http-connection-close' ]) --- 399,405 ---- opts, args = getopt.getopt(sys.argv[1:], ! 'hz:Z:t:i:a:d:u:w:W:f:p:m:Sl:2DP:rF:L:XM:CA:', ['icp=', 'force-http-connection-close' ]) *************** *** 470,475 **** --- 483,490 ---- if v=='-': v='' FCGI_PORT=v elif o=='-M': DETAILED_LOG_FILE=v + elif o=='-A': + ACL_LIST = v.split(',') except SystemExit: sys.exit(0) except: *************** *** 646,652 **** ip=address, port=port, resolver=rs, ! logger_object=lg) except socket.error, why: if why[0] == 98: # address in use raise port_err % {'port':port, --- 661,669 ---- ip=address, port=port, resolver=rs, ! logger_object=lg, ! acl_list=ACL_LIST) ! except socket.error, why: if why[0] == 98: # address in use raise port_err % {'port':port, diff -C3 -r ./ZServer/HTTPServer.py /home/edahl/zope/ZServer/HTTPServer.py *** ./ZServer/HTTPServer.py 2002-10-03 22:29:49.000000000 -0400 --- /home/edahl/zope/ZServer/HTTPServer.py 2003-01-14 09:28:44.000000000 -0500 *************** *** 357,365 **** channel_class = zhttp_channel shutup=0 ! def __init__ (self, ip, port, resolver=None, logger_object=None): self.shutup=1 ! http_server.__init__(self, ip, port, resolver, logger_object) self.shutup=0 self.log_info('HTTP server started at %s\n' '\tHostname: %s\n\tPort: %d' % ( --- 357,366 ---- channel_class = zhttp_channel shutup=0 ! def __init__ (self, ip, port, resolver=None, logger_object=None, ! acl_list=None): self.shutup=1 ! http_server.__init__(self, ip, port, resolver, logger_object, acl_list) self.shutup=0 self.log_info('HTTP server started at %s\n' '\tHostname: %s\n\tPort: %d' % ( diff -C3 -r ./ZServer/medusa/http_server.py /home/edahl/zope/ZServer/medusa/http_server.py *** ./ZServer/medusa/http_server.py 2002-06-20 10:39:34.000000000 -0400 --- /home/edahl/zope/ZServer/medusa/http_server.py 2003-01-14 10:31:21.000000000 -0500 *************** *** 558,569 **** channel_class = http_channel ! def __init__ (self, ip, port, resolver=None, logger_object=None): self.ip = ip self.port = port asyncore.dispatcher.__init__ (self) self.create_socket (socket.AF_INET, socket.SOCK_STREAM) ! self.handlers = [] if not logger_object: --- 558,571 ---- channel_class = http_channel ! def __init__ (self, ip, port, resolver=None, logger_object=None, ! acl_list=None): self.ip = ip self.port = port asyncore.dispatcher.__init__ (self) self.create_socket (socket.AF_INET, socket.SOCK_STREAM) ! self.acl_list = acl_list ! self.handlers = [] if not logger_object: *************** *** 652,657 **** --- 654,673 ---- self.total_clients.decrement() return + # check acl to see if we accept this connection + if self.acl_list: + ip = addr[0] + message = 'connection from client ' + ip + self.log_info(message) + for acl in self.acl_list: + if ip.find(acl) == 0: + break + else: + message += " blocked" + self.log_info(message, 'warning') + self.total_clients.decrement() + return + self.channel_class (self, conn, addr) def install_handler (self, handler, back=0):

1 0

RE: [Zope-dev] Rendering of objects in DTML
by Bjorn Stabell 14 Jan '03

14 Jan '03

> Bjorn Stabell wrote: > > Hello, > > > > When a content is rendered by the Zpublisher, its index_html() is > > called. When it is rendered in DTML, e.g., as <dtml-var > content>, its > > __call__ method is called. The __call__ method is also > called if the > > object appears in <dtml-if content> or <dtml-with content>. Is it > > possible to render these two cases differently from <dtml-var > > content>? > > Which two cases? > What do you mean by 'differently'? > > cheers, > > Chris I would like <dtml-var content> <dtml-with content>... <dtml-if content> to call different functions. The first renders the object, the second returns a mapping of the content's attributes/properties, the third checks for "trueness" of the content. Rendering a content could be an expensive operation and I don't want to do it when doing dtml-with and dtml-if.

3 2

Can I run 2 zope servers on one machine?
by Tena Sakai 13 Jan '03

13 Jan '03

Folks, Can I run 2 zope servers on one machine? I have a machine that runs zope 2.5.1. I want to run zope 2.6 on the same machine without taking 2.5.1 down. Is this possible? 2.5.1 runs on port 7117 and I chose 7118 for 2.6. port. What I got was: 2003-01-13T14:39:44 PANIC(300) z2 Startup exception Traceback (innermost last): Module __main__, line 726, in ? Module ZServer.FTPServer, line 602, in __init__ Module ZServer.medusa.ftp_server, line 727, in __init__ Module ZServer.medusa.asyncore, line 306, in bind error: (125, 'Address already in use') Would it be possible to run 2.6 on port 7118 and specify that ftp for this zope server to use a specific ftp port? [I'm just mumbling... In the file ZServer/medusa.ftp_server there is a definition of port=21 (line 701). What happens if I hack this and put some big number like 9221 instead?] Regards, Tena Sakai

3 2

Re: [Zope-dev] Zope and Python compatibility
by Charlie Reiman 13 Jan '03

13 Jan '03

> To: "Lennart Regebro" <lennart(a)regebro.nu> > cc: zope-dev(a)zope.org > Subject: Re: [Zope-dev] Zope and Python compatibility > From: Guido van Rossum <guido(a)python.org> > Date: Mon, 13 Jan 2003 09:56:23 -0500 > > > What would the arguments be for sticking with Zope 2.1.3 for Zope 2.7? I > > feel most people want to use the latest and greatest versions, > usually... > > Actually, most people don't care about the latest and greatest, and > would prefer tried and trusted. Especially if the latest and greatest > means they have to install more stuff. I disagree. If I wanted to stagnate, I just wouldn't upgrade. Speaking as a joe average user, I'd much rather see forward progress on development. That way, when I do hit a bug with my current (old) version I have somewhere to go. Besides, most systems ship with 2.2.2 right now. Demanding 2.1.3 means installing more stuff for new users, not vice-versa. Right now I'm in a bit of a pickle since our inhouse development is all on 2.2.2. But I'm the sole Zope developer so I have to stick with 2.1.3 (and its weaker error checking). Obviously, they can coexist and that's not a huge problem but it is annoying. I understand that 2.6 runs with 2.2.2... well, that's fine but in the spirit of your comment above: that's a little too far into the realm of the unknown and untested. Without papal blessing, I'm not willing to hack up my 2.6 to run under 2.2.2 and put it into production. There is also the matter of pride. I'd rather have Zope running on the latest and greatest, especially since 2.2 has been out for months now and 2.3 is already alpha. Running under an old version implies that there is something wrong with Python 2.2 or Zope 2.6 that just can't be fixed.

1 0

Rendering of objects in DTML
by Bjorn Stabell 13 Jan '03

13 Jan '03

Hello, When a content is rendered by the Zpublisher, its index_html() is called. When it is rendered in DTML, e.g., as <dtml-var content>, its __call__ method is called. The __call__ method is also called if the object appears in <dtml-if content> or <dtml-with content>. Is it possible to render these two cases differently from <dtml-var content>? Regards, -- Bjorn

2 1

zope-dev You can look and feel younger,make 2003 your year
by Vashti Podolski 13 Jan '03

13 Jan '03

2 1

zope and python compatibility
by Tena Sakai 12 Jan '03

12 Jan '03

Greetings zope-dev folks, Please help me out. I have seen below via google search: Zope 2.5 + Python 2.1 --> Good Zope 2.6 + Python 2.1 --> Good Zope 2.7 + Python 2.1 --> Bad Zope 2.5 + Python 2.2 --> Bad Zope 2.6 + Python 2.2 --> Bad Zope 2.7 + Python 2.2 --> Good This article/note was from September, 2002. Can someone please comment if the data above is still valid? Thank you. Tena Sakai (tena.sakai.b(a)bayer.com)

10 13

title_or_id permissions on Files
by Brian R Brinegar 11 Jan '03

11 Jan '03

Hello, I have a folder full of files. One of these files has the "View" permission removed from all roles so that no one can view this file. I also have a python script which lists the files in the folder like this: for file in context.objectValues('File'): print file.title_or_id() This code fails when it tries to access the title_or_id method of the file with the "View" permission removed. However, if I change the python script to something like this: for file in context.objectValues('File'): print file.getProperty('title', file.getId()) Everything works. I believe that the restricting permission for the title_or_id method should be "Access Contents Information" not "View". However I am not sure where the title_or_id method of File is defined. Should I submit this as a bug? This has caused me trouble in the past and it seems like the second python example should not have to be used since the title_or_id method exists. Thanks, -Brian Brinegar ECN Web Systems Developer

4 5

Custom Repository for Storing Objects
by Sameer Maggon 09 Jan '03

09 Jan '03

Hi, I am a newbie to Zope and have just gone through the tutorials and a little bit of ZopeBook. I have my own Custom Repository (RDBMS based) that has the features like storing flat files, folders etc. It also has provisions for user management. I have the XML APIs (lanuage is not a problem) for interacting with the repository. Can I store all the objects created in Zope in that repository? Further I also want that the authentication should also be done based on that repository (its like the roles and users defined in the custom system). Is it possible in Zope? I can comprehend that I would need to develop some kind of an interface that sits between the two for integration, but I wanted to know that whether it is possible in Zope or not? Its like when a user creates a folder or an object, the request is actually send to a module and then that module stores the object in my repository (may be the format is little bit changed) and vice-versa. Anticipating a positive response Sameer Maggon

3 2

XML-RPC External Method bug
by Nathan 'Nato' Uno 09 Jan '03

09 Jan '03

Greetings! I've been working with some of my coworkers tracking a problem very similar to the one described in this thread: http://lists.zope.org/pipermail/zope-dev/2002-November/017922.html which is also outlined here: http://zope.nipltd.com/public/lists/zope-archive.nsf/ByKey/B9323F6D666D3D5C and I've found out some things which may be helpful in finding a better long-term solution. There appears to be a problem with the way that External Methods are inspected when called via XML-RPC. Specifically, mapply() doesn't know what arguments the external method is expecting, apparently because the 'func_defaults' attribute of the object doesn't seem to be set properly. Interestingly enough, if apply() is called then the external method is fully inspected (presumably because it's actually invoked), after which the external method call works properly via XML-RPC. Practically this means that when I invoke an external method via XML-RPC and pass the correct arguments, mapply() doesn't know what arguments the method is expecting, assumes (in essence) that it expects 0, and returns 'too many arguments' (where 1 > 0). However, if I invoke the external method with *no* arguments, mapply() assumes that everything is good and invokes apply(), which throws a TypeError (function expects at least 1 argument, 0 given). If I then invoke the method *again* with the proper arguments (i.e. I use exactly the same call I made the first time), then the object inspected by mapply() has the 'func_defaults' attribute correctly set and the method works properly. I've spent the better part of two days sprinkling LOG() calls throughout ZPublisher, so I can give some more detailed information if anyone's really interested. In the meantime, I temporarily hacked my local copy of mapply() to invoke apply(object, '') for every call, forcing the method to be properly inspected/cached/whatever, then caught the TypeError and moved on to the rest of mapply. This worked for me, causing all of my XML-RPC calls to function properly, but concerned me because it opened the possibility of apply(object, '') being called successfully twice for an object that takes no arguments. So I backed that out and hacked by local copy of publish() instead, calling apply(object, '') for any object whose path matches my external methods. This should work for us without any unintended side effects, but I'd obviously like to be involved with a long-term solution that would benefit the whole community. Please let me know if there's any more information I can give or anything else I can contribute. I'd be glad to do more legwork, but I got bogged down last night trying to unravel the inspection/creation of external method objects, and can't really proceed effectively without some pointers on how that stuff works and where to poke around. Thanks very much, Nathan 'Nato' Uno Hostway Corporation Nathan.Uno(a)hostway.com

3 4