- Zope-Dev - Zope lists

Addressing client-side trojan problem
by Ken Manheimer 25 Sep '01

25 Sep '01

Shane Hathaway <shane(a)zope.com> wrote: > sean.upton(a)uniontrib.com wrote: > > > Personally, I think this really should be an integration issue instead of a > > Zope issue: use a front-end proxy server (i.e. Squid) and set up ACLs to > > prevent this... > > > This hasn't been fixed because it's not well understood. Javascript can > POST an invisible form, AFAIK. The problem occurs on the browsers of > users who are *already authenticated*. It has nothing to do with Zope > or any server software, really. I recently saw a _very_ interesting description of how capability-based distributed computing (and the Principle of Least Authority) is used to address vulnerabilities to client side trojans, viruses, etc. I think the approach may apply to the web situation. "Capabilities" are a signficant, fairly established idea in the realm of distributed operating systems, but are not very familiar more generally. This description is by far the most approachable i've seen (and perhaps, the first i've understood:) - i highly recommend looking it over. It's in a substantial overview of the very nifty looking scripting language, E, which is specifically designed to provide secure, reliable, manageable distributed computing scripting. The relevant bits are at: http://www.skyhunter.com/marcs/ewalnut.html#SEC41 A page or two down it describes the ramifications for things like computer viruses, if you want to skip straight to the punch. That part doesn't quite capture the way i expect we would use it to address the client-side trojan problem. Offhand, i suspect we could use these principles with Zope cookies and capability-specific roles. This approach provides a means for implementing something along the lines that chris petrilli was suggesting a while back, with incremental, rather than either/or, role privileges. Ken klm(a)zope.com

2 1

DISCUSS: Community checkins for CVS
by James Johnson 25 Sep '01

25 Sep '01

> Does anyone think this is close enough that I can go ahead and get the > bootstrap group (under ten, selected by us) going? I'd like to avoid > making them sign and mail an agreement, then do it again if there's > substantive changes. Have fun with it.

1 0

RE: Barriers to Zope popularity: Part 2: source control
by Jay, Dylan 25 Sep '01

25 Sep '01

> -----Original Message----- > From: Kenichi Sato > Sent: Monday, 24 September 2001 5:49 PM > To: djay > Subject: Barriers to Zope popularity: Part 2: source control > > > Dear Mr. Jay, Dylan, > > I am Ken Sato, a manager of software development projects. I'm now > taking a look at Zope as a tool to publish project related > information internally. > > Zope looks nice but I found it has two potential problems. > > 1. WYSIWYG editing > 2. Source control (by ClearCase) > > Then, I found that you pointed out exactly same things in the > zope-dev mailing list. > (http://lists.zope.org/pipermail/zope-dev/1999-September/001602.html) > > Because the post was two years ago, I wonder if you have already > solved the above problems. It would be very helpful for me if you > could give me some information on this issue, please. Hope you don't mind me CC'ing this to zope-dev. I still see both these issues as important and still see the lack of progress towards Zope working well in traditional development environments being a real outage. Plus others may have different opinions about the current state of affairs 1. I have not used Zope Page Templates but these are supposed to solve the wysiwyg problem. They are an alternative to DMTLDocuments. They allow for much better seperation of code and presentation. Get you graphics people to use webdav to edit the html with whatever editor they want and the coding people argment the html rather than rip it appart. http://www.zope.org/Documentation/Articles/ZPT1 Personally I like DTML and back then I did suggest a way DTML could used in a similar way to Page Templates (basically have a view mode of a DTML document that incorparates the rendered content as well as the DTML code such that when the page is edited and saved back, it will save all the changed parts back to the where they came from, i.e. the different DTMLMethods that made up the page). but like most of my ideas I din't have the ability or time to implement it. 2. Hasn't really been solved. There are sort of attempts that work now with CVS (I havn't tried it) http://www.zope.org/Members/sspickle/ZCVSMixin This but there are proposals that will better solve this problem, but no implementation on the way that I can see. The problem is really one of synchronization. You want two different representations that are both kept upto date. One for zope to use, one for all the reasons we have things under source control. You may or may not want control of when the synchronization occurs. Here are some related proposals http://www.zope.org//Wikis/DevSite/Proposals/SynchronizationMechanismZCVSMix in http://www.zope.org/Wikis/DevSite/Proposals/SynchronizationTab http://www.zope.org/Wikis/DevSite/Proposals/RepresentingObjectsOnTheFilesyst em I also see a lot of parallels with the work going on with ZODB replication. If you had replication between a normal ZODB and some filesystem source control ZODB then you would have the source control synchronization problem solved maybe? http://dev.zope.org/Wikis/DevSite/Projects/ZEOReplicatedStorage/FrontPage

4 3

RE: Dreamweaver, Webdav and PUT.
by Terry Kerr 25 Sep '01

25 Sep '01

Hi, I discovered that if I define the PROPFIND method on the LockNullResource class as follows: def PROPFIND(self, REQUEST, RESPONSE): """Retrieve properties defined on the resource.""" self.dav__init(REQUEST, RESPONSE) cmd=davcmds.PropFind(REQUEST) result=cmd.apply(self) RESPONSE.setStatus(207) RESPONSE.setHeader('Content-Type', 'text/xml; charset="utf-8"') RESPONSE.setBody(result) return RESPONSE then the dreamweaver PUT works perfectly. I don't know enough about Webdav to know if this is a satisfactory fix or not, but it seems to work for me. The collector is down currently but I will put it in when it is back up unless others advise me not to. terry -- Terry Kerr (terry(a)adroit.net) Chief Technical Officer Adroit Internet Solutions (www.adroit.net) Phone: +61 3 9563 4461 Fax: +61 3 9563 3856 ICQ: 79303381

2 1

RE: [Zope-dev] Zope on Windows: enhancements proposed
by Adrian Hungate 25 Sep '01

25 Sep '01

I edit the registry... One of my many favourite pass-times, right up there with running out in traffic. Seriously though, once an instance is configured, why would you want to change it? (Assuming you get it right that is) Adrian... -- Adrian Hungate Try Zope - http://www.zope.org - You might like it. If you do, try my Zope products - http://www.zope.org/Members/haqa - You might like them too! -----Original Message----- From: Richard Jones [mailto:richard@bizarsoftware.com.au] Sent: 25 September 2001 07:33 To: Adrian Hungate; zope-dev(a)zope.org Subject: Re: [Zope-dev] Zope on Windows: enhancements proposed On Tuesday 25 September 2001 16:26, Adrian Hungate wrote: > I have to disagree about the Zope (%s), I have been known to run 2 or 3 > Zope services, for different instances, and I always know that I can find > them all huddled together at the bottom of the Service Manager - Very > useful. So does that mean they have different names in the service manager? How do you configure the instances? Richard

2 1

Zope on Windows: enhancements proposed
by Richard Jones 25 Sep '01

25 Sep '01

We've got a wonderful zope control panel (which installs into the standard windows Control Panel) and zope service which we'll be making available in binary and source form this week. Like the Mac OS X controller, this is simply a trivial re-branding extension of our work in supporting the usability of our Bizar Shop product. The windows controller works on win95/win98/NT/win2k. It controls a "real" windows service on platforms were services are run (NT/win2k), and otherwise controls a "service daemon" which stays in the system tray. We'll call this service "Zope", and its job is to lauch "python [script] [args]" with some Zope-specific environment fiddling (INSTANCE_HOME env, cd ${SOFTWARE_HOME}, STUPID_LOG_FILE env). The current method of starting Zope as a windows service using PythonService.exe is kludgy, mostly because of the unnecessary layer of python. The Zope binary distribution's use of PythonService.exe does the same thing that our Zope service does (in the end), which is to lauch "python z2.py [args]". We'd like to propose that the service distributed with Zope move over to using our code. Our control panel will be able to control "Zope (WebSite)", but we probably won't offer the ability to configure it (editing the z2[s].py file in-place is possible - we do that now - but it's rather hackish). So, best scenario is that Zope ships with the controller and our service. Worst scenario is that the controller is downloaded separately and can only stop/start PythonService. In the second case, we'd still ship our service and install it - meaning that there'd be two Zope services in the service manager, but at least the controller, which appears in the control panel, would still be able to fully control Zope. As a separate issue - we're curious about the naming of the Zope installation - why is it called WebSite (and the Zope service "Zope (WebSite)")? The name clashes with another product that's fairly well-known in the windows community originally from O'Reilly: http://www.oreilly.com/software/index.html ... and since Zope is a fairly distinctive name ... Richard ps. happy to put this up as a project if required.

2 3

apache ProxyPass and REMOTE_ADDR -- any further discussion or
by Joseph Wayne Norton 25 Sep '01

25 Sep '01

consensus? User-Agent: Wanderlust/2.5.8 (Smooth Criminal) SEMI/1.14.3 (Ushinoya) FLIM/1.14.2 (Yagi-Nishiguchi) APEL/10.3 MULE XEmacs/21.4 (patch 1) (Copyleft) (i386-debian-linux) Reply-To: norton(a)alum.mit.edu MIME-Version: 1.0 (generated by SEMI 1.14.3 - "Ushinoya") Content-Type: text/plain; charset=US-ASCII Hello. I have put together a patch (see below) which adds the necessary support for performing user authentication based on domain (and logging) if your zope server is hiding behind apache+mod_proxy+mod_proxy_add_forward. I noticed a posting to zope-dev early this year regarding apache ProxyPass and SiteAccess http://aspn.activestate.com/ASPN/Mail/Message/zope-Dev/479449 Has there been any further discussion or consensus on this issue? regards, - joe n. *** Zope-2.4.1-src/ZServer/HTTPServer.py Wed Aug 8 22:04:32 2001 --- zope-2.4.1/ZServer/HTTPServer.py Tue Sep 25 12:01:55 2001 *************** *** 294,299 **** --- 294,315 ---- if value and not env_has(key): env[key]=value env.update(self.env_override) + + # set REMOTE_ADDR_X and REMOTE_HOST_X + if env_has('HTTP_X_FORWARDED_FOR'): + # only fetch last addr -- appended by mod_proxy_add_forward + remote_addr_x = strip(split(env['HTTP_X_FORWARDED_FOR'], ",")[-1]) + if remote_addr_x != '': + env['REMOTE_ADDR_X']=remote_addr_x + # If we're using a resolving logger, try to get the + # remote host from the resolver's cache. + if hasattr(server.logger, 'resolver'): + dns_cache=server.logger.resolver.cache + if dns_cache.has_key(env['REMOTE_ADDR_X']): + remote_host_x=dns_cache[env['REMOTE_ADDR_X']][2] + if remote_host_x is not None: + env['REMOTE_HOST_X']=remote_host_x + return env def continue_request(self, sin, request): *** Zope-2.4.1-src/ZServer/medusa/http_server.py Tue Jul 3 04:45:22 2001 --- zope-2.4.1/ZServer/medusa/http_server.py Tue Sep 25 12:29:08 2001 *************** *** 284,291 **** else: name = t[0] self.channel.server.logger.log ( ! self.channel.addr[0], ' - %s [%s] "%s" %d %d "%s" "%s"\n' % ( name, self.log_date_string (time.time()), --- 284,295 ---- else: name = t[0] + channel_addr=self.get_header('X-Forwarded-For') + if channel_addr: channel_addr = string.strip(string.split(channel_addr, ",")[-1]) + if not channel_addr: channel_addr = self.channel.addr[0] + self.channel.server.logger.log ( ! channel_addr, ' - %s [%s] "%s" %d %d "%s" "%s"\n' % ( name, self.log_date_string (time.time()), *** Zope-2.4.1-src/lib/python/AccessControl/User.py Sat Aug 4 22:49:26 2001 --- zope-2.4.1/lib/python/AccessControl/User.py Tue Sep 25 12:00:54 2001 *************** *** 1039,1048 **** if len(spec) == 1 and spec[0] == '*': return 1 ! if request.has_key('REMOTE_HOST'): host=request['REMOTE_HOST'] ! if request.has_key('REMOTE_ADDR'): addr=request['REMOTE_ADDR'] if not host and not addr: --- 1039,1052 ---- if len(spec) == 1 and spec[0] == '*': return 1 ! if request.has_key('REMOTE_HOST_X'): ! host=request['REMOTE_HOST_X'] ! elif request.has_key('REMOTE_HOST'): host=request['REMOTE_HOST'] ! if request.has_key('REMOTE_ADDR_X'): ! addr=request['REMOTE_ADDR_X'] ! elif request.has_key('REMOTE_ADDR'): addr=request['REMOTE_ADDR'] if not host and not addr:

1 0

removal of User Folders
by Jim Penny 24 Sep '01

24 Sep '01

Is there some function that is called when a User Folder is removed? If so, what is it? If not, is there a recommended way to delete users, any information stored about the User Folder's configuration, etc.? Thanks. Jim Penny

2 1

ZCatalog problem: sort_on bug
by Steve Alexander 24 Sep '01

24 Sep '01

I'm getting a strange problem with ZCatalog, using python 2.1, Zope from CVS. I get all the results I expect with this: <ul> <dtml-in "Catalog(process_step=['start','mailed'])"> <li> &dtml-subject_name; -- &dtml-relationship_name; -> &dtml-rater_name; </dtml-in> </ul> But, I only get one subject_name's worth of results with this: <ul> <dtml-in "Catalog(process_step=['start','mailed'], sort_on='subject_name')"> <li> &dtml-subject_name; -- &dtml-relationship_name; -> &dtml-rater_name; </dtml-in> </ul> This smells like a BTrees bug to me, but I'm not sure. I'm looking into this closely now, but if anyone's seen this before, please speak up! -- Steve Alexander Software Engineer Cat-Box limited

1 3

RE: [Zope-dev] Vulnerability: attacking can get file list and dir ectory
by sean.upton＠uniontrib.com 24 Sep '01

24 Sep '01

Personally, I think this really should be an integration issue instead of a Zope issue: use a front-end proxy server (i.e. Squid) and set up ACLs to prevent this... Sean -----Original Message----- From: Oliver Bleutgen [mailto:myzope@gmx.net] Sent: Monday, September 24, 2001 9:10 AM To: zope-dev(a)zope.org Subject: Re: [Zope-dev] Vulnerability: attacking can get file list and directory Hi shane, > Oliver Bleutgen wrote: >> From a non-technical, PR-wise point of view let me add that >> this type of "vulnerability" easily gets zope mentioned on lists >> like bugtraq. The perception is that these thing really are >> vulnerabilities. > You're right, a quick search on google for "path disclosure > vulnerability" yields a lot of hits for lots of applications. > It troubles me that people consider PDV to be important at all when the > client-side trojan bug is still fully exploitable on all browsers > including IE and Mozilla! (AFAIK) Client-side trojans, which can cause > your browser to invisibly post a comment on a weblog, execute a > financial transaction, or break into servers you maintain, are a major > risk. I had put something about that theme at the client-side trojan wiki, put I'll repeat myself since you mentioned it ... Methinks the creators of the http/1.1 rfc were aware of the dangers we call client-side trojan and wrote the following: " 9.1.1 Safe Methods Implementors should be aware that the software represents the user in their interactions over the Internet, and should be careful to allow the user to be aware of any actions they might take which may have an unexpected significance to themselves or others. In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested. Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the side-effects, so therefore cannot be held accountable for them. " Zope really should not accept GET requests to dangerous manage_* (or other) methods, that would ensure it's at least compliant with the spirit of that rfc. If the user decides to use a browser which allows javascript to auto-submit forms and stuff, it's his choice. I have a feeling that other ideas like checking referer etc. are bound to fail after one or two generations of new browsers. We should have in mind that the same people who will design these browsers already had the bright idea of implementing auto-submitting of hidden forms. > PDV just yields information you might give out anyway. But maybe we > could deal with it anyway by writing an "error.log" instead of sending > the traceback to the browser. What do you think? I fear it would make working with zope harder for unexperienced users. When working with apache/perl on linux, I always had a tail -f /var/log/httpd/error.log running in a terminal, but if you're solely working on windows without using the power of cygwin or other tools, this might get tedious. What I would like to see is a error "product" which can be freely configured to show more or less details depending on its context (i.e. user/role etc.) and able to optionally write to a log file. I know this is a lot of work and has its technical problems, but it's a nice imagination. cheers, oliver _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

2 1