January 2009 - Zope-Dev

Zope Tests: 8 OK
by Zope Tests Summarizer 22 Jan '09

22 Jan '09

Summary of messages to the zope-tests list. Period Wed Jan 21 12:00:00 2009 UTC to Thu Jan 22 12:00:00 2009 UTC. There were 8 messages: 8 from Zope Tests. Tests passed OK --------------- Subject: OK : Zope-2.8 Python-2.3.7 : Linux From: Zope Tests Date: Thu Jan 22 03:44:52 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010903.html Subject: OK : Zope-2.9 Python-2.4.5 : Linux From: Zope Tests Date: Thu Jan 22 03:45:53 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010904.html Subject: OK : Zope-2.10 Python-2.4.5 : Linux From: Zope Tests Date: Thu Jan 22 03:46:53 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010905.html Subject: OK : Zope-2.11 Python-2.4.5 : Linux From: Zope Tests Date: Thu Jan 22 03:47:53 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010906.html Subject: OK : Zope-trunk Python-2.4.5 : Linux From: Zope Tests Date: Thu Jan 22 03:48:55 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010907.html Subject: OK : Zope-trunk Python-2.5.2 : Linux From: Zope Tests Date: Thu Jan 22 03:49:55 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010908.html Subject: OK : Zope[2.buildout]-trunk Python-2.4.5 : Linux From: Zope Tests Date: Thu Jan 22 03:50:55 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010909.html Subject: OK : Zope[2.buildout]-trunk Python-2.5.2 : Linux From: Zope Tests Date: Thu Jan 22 03:51:55 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010910.html

1 0

Salt-weakness in zope.app.authentication passwordmanagers?
by Uli Fouquet 22 Jan '09

22 Jan '09

Hi there, while working on a password manager tool (commandline) for Grok I stumbled over the usage of salts in the password managers of `zope.app.authentication`. In short, they seem to generate (and store) a salt number but do not make any use of it when it comes to creating the hashes (SHA1, MD5, whatever). As a result, same passwords lead always to same hashes, only the leading salt number is different. This could be exploited by dictionary attacks. The zope.app.authentication implementation for SHA1-encoding looks roughly like this (other hash-encodings have the same problem, if this is a valid problem):: def encodePassword(password, salt=None): if salt is None: salt = "%08x" % randint(0, 0xffffffff) return salt + sha.new(password).hexdigest() It looks to me that this way `salt` is only an arbitrary string that gets stored in front of the real hash value. The hash value itself will not change with the salt. When I run the following code (`checkPassword` like in `zope.app.authentication.password`):: def checkPassword(storedPassword, password): salt = storedPassword[:-40] return storedPassword == encodePassword(password, salt) for i in range(0,3): enc = encodePassword('asd') print 'Encode "asd"', enc print 'Check: ', checkPassword(enc, 'asd') I get:: Encode "asd" 81bde2dbf10e2821bbbea527ea02200352313bc059445190 Check: True Encode "asd" c96cfabdf10e2821bbbea527ea02200352313bc059445190 Check: True Encode "asd" bdba5b69f10e2821bbbea527ea02200352313bc059445190 Check: True As you can see, only the first eight letters change. And they are cleartext part of the encoded password. Not a problem for an dictionary-attacker: if one of the hashes in his/her dictionary are equal to ``f10e2821bbbea527ea02200352313bc059445190``, then the password is cracked. Salts do not improve the security level here, I think. What I assume to be correct, would be to build the hash from the salt plus password (instead of only the password):: def encodePassword(password, salt=None): if salt is None: salt = "%08x" % randint(0, 0xffffffff) return salt + sha.new(salt + password).hexdigest() Using this modified function, I get:: Encode "asd" 11ac348fe526cc38813fca0e5bd0a59ec3a16686bfa42502 Check: True Encode "asd" 08de8fa19212d743867f8867adee55a9efbe566a8ec56731 Check: True Encode "asd" d454b892224b0cf5b41767acfa80a3732b82c52fc2ee5e9f Check: True Now it is harder for an attacker. His dictionary has not only to provide the pure hashes for every entry in the dictionary, but also 16**8 variants for _each_ of the entries. That's it, I think, what salt is used for. As I am not a computer scientist nor a mathematician, I am not sure, whether these are valid concerns. But I would like to know, what others think about this. Maybe you can correct me here. Best regards, -- Uli

6 20

Zope Tests: 6 OK, 2 Failed
by Zope Tests Summarizer 21 Jan '09

21 Jan '09

Summary of messages to the zope-tests list. Period Mon Jan 19 12:00:00 2009 UTC to Tue Jan 20 12:00:00 2009 UTC. There were 8 messages: 8 from Zope Tests. Test failures ------------- Subject: FAILED (failures=2) : Zope[2.buildout]-trunk Python-2.4.5 : Linux From: Zope Tests Date: Mon Jan 19 20:57:35 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010893.html Subject: FAILED (failures=2) : Zope[2.buildout]-trunk Python-2.5.2 : Linux From: Zope Tests Date: Mon Jan 19 20:58:35 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010894.html Tests passed OK --------------- Subject: OK : Zope-2.8 Python-2.3.7 : Linux From: Zope Tests Date: Mon Jan 19 20:51:30 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010887.html Subject: OK : Zope-2.9 Python-2.4.5 : Linux From: Zope Tests Date: Mon Jan 19 20:52:30 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010888.html Subject: OK : Zope-2.10 Python-2.4.5 : Linux From: Zope Tests Date: Mon Jan 19 20:53:30 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010889.html Subject: OK : Zope-2.11 Python-2.4.5 : Linux From: Zope Tests Date: Mon Jan 19 20:54:32 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010890.html Subject: OK : Zope-trunk Python-2.4.5 : Linux From: Zope Tests Date: Mon Jan 19 20:55:32 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010891.html Subject: OK : Zope-trunk Python-2.5.2 : Linux From: Zope Tests Date: Mon Jan 19 20:56:32 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010892.html

3 2

Zope Tests: 6 OK, 2 Failed
by Zope Tests Summarizer 21 Jan '09

21 Jan '09

Summary of messages to the zope-tests list. Period Tue Jan 20 12:00:00 2009 UTC to Wed Jan 21 12:00:00 2009 UTC. There were 8 messages: 8 from Zope Tests. Test failures ------------- Subject: FAILED (failures=2) : Zope[2.buildout]-trunk Python-2.4.5 : Linux From: Zope Tests Date: Tue Jan 20 20:55:51 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010901.html Subject: FAILED (failures=2) : Zope[2.buildout]-trunk Python-2.5.2 : Linux From: Zope Tests Date: Tue Jan 20 20:57:04 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010902.html Tests passed OK --------------- Subject: OK : Zope-2.8 Python-2.3.7 : Linux From: Zope Tests Date: Tue Jan 20 20:49:38 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010895.html Subject: OK : Zope-2.9 Python-2.4.5 : Linux From: Zope Tests Date: Tue Jan 20 20:50:48 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010896.html Subject: OK : Zope-2.10 Python-2.4.5 : Linux From: Zope Tests Date: Tue Jan 20 20:51:49 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010897.html Subject: OK : Zope-2.11 Python-2.4.5 : Linux From: Zope Tests Date: Tue Jan 20 20:52:49 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010898.html Subject: OK : Zope-trunk Python-2.4.5 : Linux From: Zope Tests Date: Tue Jan 20 20:53:49 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010899.html Subject: OK : Zope-trunk Python-2.5.2 : Linux From: Zope Tests Date: Tue Jan 20 20:54:50 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010900.html

1 0

Re: [Zope-dev] [Zope-tests] UNKNOWN : Zope[2.buildout]-trunk Python-2.5.2 : Linux
by Stefan H. Holek 19 Jan '09

19 Jan '09

Enough! I have put a copy of docutils-0.4.tar.gz on the test server and point buildout at it via ~/.buildout/default.cfg. Stefan On 19.01.2009, at 02:55, Zope Tests wrote: > Zope Tests : UNKNOWN > Zope[2.buildout]-trunk Python-2.5.2 : Linux > > Running /usr/local/python2.5/bin/python ./bin/test --all > /usr/local/python2.5/bin/python: can't open file './bin/test': > [Errno 2] No such file or directory > > UNKNOWN > [snip] > Getting distribution for 'docutils==0.4'. > While: > Installing test. > Getting distribution for 'docutils==0.4'. > Error: Can't download http://prdownloads.sourceforge.net/docutils/docutils-0.4.tar.gz?download > : 404 Not Found

2 1

Release zc.selenium on pypi
by Christian Zagrodnick 19 Jan '09

19 Jan '09

Hi, there is zc.selenium on svn.zope.org which is not on pypi. Could this be released? Also it speaks of the ZVLS in some files which doesn't seem to be correct. -- Christian Zagrodnick · cz(a)gocept.com gocept gmbh & co. kg · forsterstraße 29 · 06112 halle (saale) · germany http://gocept.com · tel +49 345 1229889 4 · fax +49 345 1229889 1 Zope and Plone consulting and development

2 2

Zope Tests: 7 OK, 1 Unknown
by Zope Tests Summarizer 19 Jan '09

19 Jan '09

Summary of messages to the zope-tests list. Period Sun Jan 18 12:00:00 2009 UTC to Mon Jan 19 12:00:00 2009 UTC. There were 8 messages: 8 from Zope Tests. Unknown ------- Subject: UNKNOWN : Zope[2.buildout]-trunk Python-2.5.2 : Linux From: Zope Tests Date: Sun Jan 18 20:55:42 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010886.html Tests passed OK --------------- Subject: OK : Zope-2.8 Python-2.3.7 : Linux From: Zope Tests Date: Sun Jan 18 20:45:10 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010879.html Subject: OK : Zope-2.9 Python-2.4.5 : Linux From: Zope Tests Date: Sun Jan 18 20:46:40 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010880.html Subject: OK : Zope-2.10 Python-2.4.5 : Linux From: Zope Tests Date: Sun Jan 18 20:48:11 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010881.html Subject: OK : Zope-2.11 Python-2.4.5 : Linux From: Zope Tests Date: Sun Jan 18 20:49:41 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010882.html Subject: OK : Zope-trunk Python-2.4.5 : Linux From: Zope Tests Date: Sun Jan 18 20:51:11 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010883.html Subject: OK : Zope-trunk Python-2.5.2 : Linux From: Zope Tests Date: Sun Jan 18 20:52:41 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010884.html Subject: OK : Zope[2.buildout]-trunk Python-2.4.5 : Linux From: Zope Tests Date: Sun Jan 18 20:54:11 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010885.html

1 0

Re: [Zope-dev] SVN: Products.GenericSetup/trunk/Products/GenericSetup/tests/common.py Hhm, pdb?!?
by Tres Seaver 18 Jan '09

18 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hanno Schlichting wrote: > Log message for revision 94810: > Hhm, pdb?!? > > Changed: > U Products.GenericSetup/trunk/Products/GenericSetup/tests/common.py > > -=- > Modified: Products.GenericSetup/trunk/Products/GenericSetup/tests/common.py > =================================================================== > --- Products.GenericSetup/trunk/Products/GenericSetup/tests/common.py 2009-01-17 20:01:44 UTC (rev 94809) > +++ Products.GenericSetup/trunk/Products/GenericSetup/tests/common.py 2009-01-17 20:41:54 UTC (rev 94810) > @@ -53,7 +53,6 @@ > for i in range( len( zipped ) ) > if zipped[i][0] != zipped[i][1] > ] > - import pdb; pdb.set_trace() > > print 'Found:' > print fxml That breakpoint was inside an if block guarded by 'if debug:', which shouldn't be set by any "real" test. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJcrke+gerLs4ltQ4RAjWsAJ9WZErodZw4kACPvfEfKqWep5spGQCfQAqS NDOhvmIvdID8+kxl40QzssM= =g6P0 -----END PGP SIGNATURE-----

2 2

Next Step to Bug Resolution???
by Tim Cook 18 Jan '09

18 Jan '09

Hi All, I have had an issue on the table for months. I started a dialog about it here: http://mail.zope.org/pipermail/zope3-users/2008-October/008215.html The thread was interesting, helpful and did lead me to find an error in some schema definitions because of a misunderstanding of the required attribute. But that had nothing to do with the problem. It was first thought that it was a nasty, empty error report. After some investigation I discovered that it was an error that shouldn't be an error. Once I determined what I thought was the cause and a possible fix I posted a bug report on Launchpad https://bugs.launchpad.net/zope3/+bug/301226 So here we are. I have a possible solution and the only comments I get from the Zope Community are private emails (yes plural) asking me if anyone is working on this issue. I have to say that as far as I can tell; no. At this point I would be happier if someone just told me why my fix might negatively affect the other schema field validations. Now I realize that I must be the only person in the entire world to exercise zope.schema this way. BUT! It should work or it should be WELL documented that you cannot have cascading attribute=Object(IMySchema) definitions. The description of the project is here: http://www.openehr.org/wiki/display/dev/OSHIP+Developer%27s+Wiki This is a rather major project. See: http://www.ohloh.net/p/oship for some metrics. We have just received three years of funding from the Brazilian government to complete the platform and develop an Epidemiological decision support system on top of it to improve the recognition of syndromic outbreaks. Right now the hardworking core open source team understands that we need to replace zope.schema._field.py with our own to make it work. But when the project is ready, in a few months, for healthcare application developers worldwide to start using it. It may be a hard sell to say; "Yeah we use the really cool, robust, well tested and trusted application server called the Zope Component Architecture because it really shows the strengths of the open source development process. Oh, by the way, after everything is installed you have to replace a core ZCA file with the one we provide you in order to make it actually work." Doesn't sound very professional to me and it should be embarrassing to the Zope Community if that has to happen. Thank you for reading this long posting. I hope someone delivers me a Holiday package in the form of a fixed zope.schema package. :-) Cheers, Tim -- Timothy Cook, MSc Health Informatics Research & Development Services LinkedIn Profile:http://www.linkedin.com/in/timothywaynecook Skype ID == timothy.cook ************************************************************** *You may get my Public GPG key from popular keyservers or * *from this link http://timothywayne.cook.googlepages.com/home* **************************************************************

8 27

Zope Tests: 8 OK
by Zope Tests Summarizer 18 Jan '09

18 Jan '09

Summary of messages to the zope-tests list. Period Sat Jan 17 12:00:00 2009 UTC to Sun Jan 18 12:00:00 2009 UTC. There were 8 messages: 8 from Zope Tests. Tests passed OK --------------- Subject: OK : Zope-2.8 Python-2.3.7 : Linux From: Zope Tests Date: Sat Jan 17 20:53:28 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010871.html Subject: OK : Zope-2.9 Python-2.4.5 : Linux From: Zope Tests Date: Sat Jan 17 20:54:59 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010872.html Subject: OK : Zope-2.10 Python-2.4.5 : Linux From: Zope Tests Date: Sat Jan 17 20:56:29 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010873.html Subject: OK : Zope-2.11 Python-2.4.5 : Linux From: Zope Tests Date: Sat Jan 17 20:57:59 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010874.html Subject: OK : Zope-trunk Python-2.4.5 : Linux From: Zope Tests Date: Sat Jan 17 20:59:29 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010875.html Subject: OK : Zope-trunk Python-2.5.2 : Linux From: Zope Tests Date: Sat Jan 17 21:00:59 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010876.html Subject: OK : Zope[2.buildout]-trunk Python-2.4.5 : Linux From: Zope Tests Date: Sat Jan 17 21:02:29 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010877.html Subject: OK : Zope[2.buildout]-trunk Python-2.5.2 : Linux From: Zope Tests Date: Sat Jan 17 21:03:59 EST 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-January/010878.html

1 0