September 2013 - Zope-Dev

(optional) CSRF protection in zope.formlib
by Jan-Wijbrand Kolman 21 Nov '13

21 Nov '13

Hi, I've been working on CSRF protection for zope.formlib. I have a "csrfprotection" branch in my zope.formlib fork on github. The changes against the current zope.formlib mainline can be found here: https://github.com/janwijbrand/zope.formlib/compare/csrfprotection When creating form components based on zope.formlib.form.FormBase, one can enable this protection just by setting the attribute ``protected`` to True on the component. This implementation is based on the following assumptions: * We do not want to keep server-side state(!) * An "attacker" that attempts CSRF cannot get to information stored in cookies that are meant for the domain of the (forged) request. * The token stored in the cookie is sufficiently random and long, to be practically "unguessable" by the attacker. * The form submit is deemed valid as long as the token in the cookie is identical to a hidden input value that is part of the form submit. My questions: * Do you find this feature useful enough to be, in principle, included in zope.formlib? * I'd like to kindly request someone to review my branch and provide feedback. The included test cases describe a few more questions and concerns about this implementation. Thank you in advance! kind regards, jw

3 8

[z3c.recipe.i18n] Review of Buildout 2 support
by Sebastien Douche 06 Nov '13

06 Nov '13

Hi, Does anyone can review or merge the PR please? https://github.com/zopefoundation/z3c.recipe.i18n/pull/1 -- Sebastien Douche <sdouche(a)gmail.com> Twitter: @sdouche / G+: +sdouche

2 3

zope-tests - OK: 9
by Zope tests summarizer 30 Sep '13

30 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-29 00:00:00 UTC and 2013-09-30 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 413 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results --------------

1 0

zope-tests - OK: 9
by Zope tests summarizer 29 Sep '13

29 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-28 00:00:00 UTC and 2013-09-29 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 412 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results --------------

1 0

zope-tests - OK: 9
by Zope tests summarizer 28 Sep '13

28 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-27 00:00:00 UTC and 2013-09-28 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 411 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results --------------

1 0

zope-tests - OK: 9
by Zope tests summarizer 27 Sep '13

27 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-26 00:00:00 UTC and 2013-09-27 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 410 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results --------------

1 0

zope-tests - FAILED: 5, OK: 9
by Zope tests summarizer 27 Sep '13

27 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-25 00:00:00 UTC and 2013-09-26 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 409 [1] winbot / zc.ngi_py_265_32 [2] winbot / zope.app.authentication_py_265_32 [3] winbot / zope.app.http_py_265_32 [4] winbot / zope.app.publication_py_265_32 [5] winbot / zope.app.wsgi_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / zc.ngi_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078948.html [2] FAILED winbot / zope.app.authentication_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078945.html [3] FAILED winbot / zope.app.http_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078946.html [4] FAILED winbot / zope.app.publication_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078944.html [5] FAILED winbot / zope.app.wsgi_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078947.html

2 1

zope-tests - FAILED: 1, OK: 9
by Zope tests summarizer 25 Sep '13

25 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-24 00:00:00 UTC and 2013-09-25 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 408 [1] winbot / zope.app.wsgi_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / zope.app.wsgi_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078930.html

1 0

zope-tests - FAILED: 1, OK: 9
by Zope tests summarizer 25 Sep '13

25 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-23 00:00:00 UTC and 2013-09-24 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 407 [1] winbot / zope.app.wsgi_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / zope.app.wsgi_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-September/078913.html

2 1

zope-tests - FAILED: 1, OK: 7
by Zope tests summarizer 24 Sep '13

24 Sep '13

This is the summary for test reports received on the zope-tests list between 2013-09-22 00:00:00 UTC and 2013-09-23 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 [1] winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / ztk_11 py_270_win32 https://mail.zope.org/pipermail/zope-tests/2013-September/078904.html

2 1