- Zope-Dev - Zope lists

Custom Login
by Ivan Raikov 24 Sep '01

24 Sep '01

Hello, Recently, I had to replace ZPublisher's default authentication scheme, as part of a product I'm working on. I am aware of the existence of LoginManager, exUserFolder, etc., but in this case I needed to have a custom login screen at root level, i.e. completely get rid of the basic HTTP authentication and browser popup window. So I replaced some of the HTTPRequest and HTTPResponse methods in order to present the user an HTML form whenever an 'Unauthorized' exception is raised. While I'm sure such an issue has arisen hundreds of times, somehow I was unable to find a product or a How-To that specifically addresses it, which means either I don't know how to browse the Web, or nobody has bothered to document their knowledge in the area. So I went ahead and created a simple Zope product that, upon installing, makes the necessary changes in HTTPRequest and HTTPResponse (HotFix style), so that cookie-based, HTML form login replaces the default one. For the curious, the product can be found at http://www.prism.gatech.edu/~gte085h/zope/CustomLogin/ In regards to this product, I've been pondering some questions that I'd like to be answered by knowledgeable people, if possible: 1. Is there a product that makes the changes I described, and where can I find it? 2. Does anyone think it's a good idea to provide some kind of a standardized API for replacing ZPublisher's authentication? 3. If a user attempts to access a resource, and is denied access, my modified HTTPResponse simply redirects to the login form, without bothering to record the URL the user originally tried to access (which can be a bad or a good thing, I suppose). Is there any way for an HTTPResponse instance to find out the URL of its HTTPRequest? 4. Not entirely related to this topic, but I noticed that the ChannelPipe class, used for communication between ZServer and ZPublisher, serves only one object instance at a time. What would be some practical difficulties in changing this class to serve multiple HTTPResponse instances? Finally, after noticing the ongoing discussion about the error HTML contents produced by ZPublisher upon an exception, I'd like to point out that it's extremely trivial to replace HTTPResponse._error_html and provide either custom behavior (e.g. sending email to the administrator), or custom HTML code, whether loaded from a file or hardcoded. Is anyone interested in me writing a How-To on this topic? The product I described above, already does that, so it would be rather easy for me to put together some documentation, provided that nobody has bothered to write any. Let me know... Sincerely, Ivan Raikov

2 1

RE: [Zope-dev] Vulnerability: attacking can get file list and dir ectory
by sean.upton＠uniontrib.com 24 Sep '01

24 Sep '01

On a high-traffic site, wouldn't the log get really big, really quickly with tracebacks? It is also nice to have the tracebacks in the browser window for debugging... Why not just enable tracebacks to clients from trusted IP address ranges or domains... Set this up as an option in Z2.py? Anyway, that's my 3-mile high take on it... Sean -----Original Message----- From: Shane Hathaway [mailto:shane@zope.com] Sent: Monday, September 24, 2001 7:59 AM To: Oliver Bleutgen Cc: zope-dev(a)zope.org Subject: Re: [Zope-dev] Vulnerability: attacking can get file list and directory Oliver Bleutgen wrote: > From a non-technical, PR-wise point of view let me add that > this type of "vulnerability" easily gets zope mentioned on lists > like bugtraq. The perception is that these thing really are > vulnerabilities. You're right, a quick search on google for "path disclosure vulnerability" yields a lot of hits for lots of applications. It troubles me that people consider PDV to be important at all when the client-side trojan bug is still fully exploitable on all browsers including IE and Mozilla! (AFAIK) Client-side trojans, which can cause your browser to invisibly post a comment on a weblog, execute a financial transaction, or break into servers you maintain, are a major risk. PDV just yields information you might give out anyway. But maybe we could deal with it anyway by writing an "error.log" instead of sending the traceback to the browser. What do you think? Shane _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

3 2

Re: [Zope-dev] Vulnerability: attacking can get file list and directory
by Oliver Bleutgen 24 Sep '01

24 Sep '01

> On Sunday 23 September 2001 08:24 pm, Joachim Werner allegedly wrote: >> > Vulnerability: attacking can get file list and directory >> > Tested on Win32 platform >> > >> > Example: >> > telnet zopeserver 8080 >> > PROPFIND / HTTP/1.0 >> > <enter> >> > <enter> >> > <enter> >> > >> > < list files and directory > >> > >> > This tested on my site: >> > security.instock.ru 8080 >> >> This one really seems to be the old "WebDAV is not safe" one. I guess it >> has been tackled already. You should be able to switch the file listing >> off >> for the Anonymous User in Zope 2.4.1 ... >> >> Joachim > I totally agree. Tracebacks should not be visible to anonymous users! > Although I would hesitate to call this a vulnerability, it ranks up there > with the old ability to call objectIds by URL as anonymous. > The less information that anonymous users can glean about the server, the > better. From a non-technical, PR-wise point of view let me add that this type of "vulnerability" easily gets zope mentioned on lists like bugtraq. The perception is that these thing really are vulnerabilities. Proof: 17.9. A posting named "Yet another path disclosure vulnerability" targeted at oracle 9i appserver, and 21.9. "RM Security Advisory: Xcache Path Disclosure Vulnerability" both of which describe exactly the analogon to how zope handles things. cheers, oliver

7 7

Re: [Zope-dev] Vulnerability: attacking can get file list and directory
by Oliver Bleutgen 24 Sep '01

24 Sep '01

Hi shane, > Oliver Bleutgen wrote: >> From a non-technical, PR-wise point of view let me add that >> this type of "vulnerability" easily gets zope mentioned on lists >> like bugtraq. The perception is that these thing really are >> vulnerabilities. > You're right, a quick search on google for "path disclosure > vulnerability" yields a lot of hits for lots of applications. > It troubles me that people consider PDV to be important at all when the > client-side trojan bug is still fully exploitable on all browsers > including IE and Mozilla! (AFAIK) Client-side trojans, which can cause > your browser to invisibly post a comment on a weblog, execute a > financial transaction, or break into servers you maintain, are a major > risk. I had put something about that theme at the client-side trojan wiki, put I'll repeat myself since you mentioned it ... Methinks the creators of the http/1.1 rfc were aware of the dangers we call client-side trojan and wrote the following: " 9.1.1 Safe Methods Implementors should be aware that the software represents the user in their interactions over the Internet, and should be careful to allow the user to be aware of any actions they might take which may have an unexpected significance to themselves or others. In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested. Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the side-effects, so therefore cannot be held accountable for them. " Zope really should not accept GET requests to dangerous manage_* (or other) methods, that would ensure it's at least compliant with the spirit of that rfc. If the user decides to use a browser which allows javascript to auto-submit forms and stuff, it's his choice. I have a feeling that other ideas like checking referer etc. are bound to fail after one or two generations of new browsers. We should have in mind that the same people who will design these browsers already had the bright idea of implementing auto-submitting of hidden forms. > PDV just yields information you might give out anyway. But maybe we > could deal with it anyway by writing an "error.log" instead of sending > the traceback to the browser. What do you think? I fear it would make working with zope harder for unexperienced users. When working with apache/perl on linux, I always had a tail -f /var/log/httpd/error.log running in a terminal, but if you're solely working on windows without using the power of cygwin or other tools, this might get tedious. What I would like to see is a error "product" which can be freely configured to show more or less details depending on its context (i.e. user/role etc.) and able to optionally write to a log file. I know this is a lot of work and has its technical problems, but it's a nice imagination. cheers, oliver

1 0

New: Cross Site Scripting vulnerability
by ALife 24 Sep '01

24 Sep '01

Example: http://www.zope.org/Documentation/<SCRIPT>alert(document.domain)</SCRIPT> http://www.zope.org/lalalalal<SCRIPT>alert(document.domain)</SCRIPT> http://www.zope.org/<SCRIPT>alert(document.cookie)</SCRIPT> For example, an attacker might post a message like Hello message board. This is a message. <SCRIPT>malicious code</SCRIPT> This is the end of my message. When a victim with scripts enabled in their browser reads this message, the malicious code may be executed unexpectedly. Scripting tags that can be embedded in this way include <SCRIPT>, <OBJECT>, <APPLET>, and <EMBED>.

6 6

Re: [Zope-dev] New: Cross Site Scripting vulnerability
by Oliver Bleutgen 23 Sep '01

23 Sep '01

Aargh, I sent that first to zope(a)zope.org ... >> Hello message board. This is a message. >> <SCRIPT>malicious code</SCRIPT> >> This is the end of my message. > I don't really see your point other than a carelessly implemented app may > expose these kind of vulnerabilities. Python (and hence Zope) has a > library > for stripping out this sort of malicious HTML. > Search for Strip-o-Gram or Squishdot on Zope.org for examples of how this > can be used. umm chris, you're right, but this example http://www.zope.org/Documentation/<SCRIPT>alert(document.domain)</SCRIPT> executes the script. I don't exactly see why/where but I feel this really shouldn't happen. As I see it, it's more a problem of zope's standard_error page, which constructs links to the classic zope site. I don't see a zope-specific bug here, too. cheers, oliver

1 0

questions about writing a DA
by StevenLee 23 Sep '01

23 Sep '01

hi,all I have got several questions here,and maybe you can give me some advice. What I am trying to do is write a product which can communicate with ODBC Socket Server, a win32 server application that allow applications to have access to Data Sources managed by Windows ODBC DataSource Administrator. And now a class written in python can communicate with ODBC Socket Server. BTW,the class mentioned above handles the connection to the server,sending SQL statement,and Receiving results. As far as I know, in Zope,to access Data Sources,one must create a Database connection and ZSQLMethods associated with it to get the results. (but I have doubt about this, IMHO,there must be some other way to do so,but what is it.). Now,I am rather confused about how to solve the problem. First,is what I need to write a DA? or just a common product? Second,if it's a DA, how can I use the existing class? I have read the article named "how to write a DA" in the how-tos,but it is quite abstract to me. Third,where can I find more about the DataBase Connection and ZSQLMethod ? especially on how they work together to access databases. OK,I am not sure whether I have made me understood, in fact,I am not quite clear myself. if you have any questions about that,I will reply ASAP. thanks for your great patience,I will be grateful if you can give me some advice. thank you! Best Wishes yours sincerely Steven Lee

2 1

Simple question about namespaces
by Sidnei da Silva 21 Sep '01

21 Sep '01

Hello everyone, Im trying to do something like this: when a user access: http://www.mysite.com/somefolder i wish to return: http://www.mysite.com/onefolder/anotherfolder/somefolder but do this in a transparent form, without redirecting the user. I guess, by calling the "somefolder" in the context of "onefolder/anotherfolder". Maybe by overriding "__bobo_traverse__" Hope you can help me this time, cause the other questions I have asked to this list where not answered by anyone. Thanx in advance. -- Sidnei da Silva X3ng Consultoria e Desenvolvimento Ltda. sidnei(a)x3ng.com.br

2 1

Re: [Zope-dev] Simple question about namespaces
by Sidnei da Silva 21 Sep '01

21 Sep '01

Hello Antonio, Actually, the problem can not be solved by the Virtual Host Product, for what i know. Let me explain the situation: Im trying to create something like a Template Folder, that contains some folders with images, some DTML Methods that create menus and the like, and a Content Folder, that contains the Content itself. I can have Templates that have just specialized parts of the template and look over at the Main Template folder, in case of not found some object at the Specialized Template. Im having trouble at two points: * First, in making the Specialized Template look over at the Main Template under not found some content (like i said, the specialized content may containt one or two images inside a images folder). Ive tried doing this by overriding the __bobo_traverse__ method of the Specialized Template, but it not worked. * Second, when i call the Content Folder, it is needed to apply the template to it. The content has a property that says what is the Specialized Template that has to be applied when calling it, so, when i call: http://www.mysite.com/ContentFolder i need to apply the template to the folder, maybe calling: http://www.mysite.com/MainTemplate/SpecializedTemplate/ContentFolder But i wish to do this by code, instead of redirecting the user to this url. Hope you understand what ive explained here, and if cannot help me, maybe can tell me who can help me. Thanx.... Em Friday 21 September 2001 10:00, you wrote: > This is not an answer. But you can find information, in how to´s, Zope Help, > or Products Help. Look for Virtual Host Product. > > Antonio Carrasco > > ¿The other question? > > ----- Original Message ----- > From: "Sidnei da Silva" <sidnei(a)x3ng.com.br> > To: <zope-dev(a)zope.org> > Sent: Friday, September 21, 2001 2:08 PM > Subject: [Zope-dev] Simple question about namespaces > > > > Hello everyone, > > > > Im trying to do something like this: > > when a user access: > > http://www.mysite.com/somefolder > > i wish to return: > > http://www.mysite.com/onefolder/anotherfolder/somefolder > > but do this in a transparent form, without redirecting the user. I guess, > by > > calling the "somefolder" in the context of "onefolder/anotherfolder". > Maybe > > by overriding "__bobo_traverse__" > > > > Hope you can help me this time, cause the other questions I have asked to > > this list where not answered by anyone. > > > > Thanx in advance. > > > > -- > > Sidnei da Silva > > X3ng Consultoria e Desenvolvimento Ltda. > > sidnei(a)x3ng.com.br > > > > _______________________________________________ > > Zope-Dev maillist - Zope-Dev(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope-dev > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope ) > > > > -- Sidnei da Silva X3ng Consultoria e Desenvolvimento Ltda. sidnei(a)x3ng.com.br

1 0

Structure-text : <html>
by Sin Hang Kin 21 Sep '01

21 Sep '01

When I use <dtml-var StructureTextDoc fmt=structured-text> I got <html> </html> in the result. Are there any reason that it should be there? I wounder how can structured text generate valid html or be used in wap applications. If structured text is hard coded to output unnecessary <html> then I consider it a serious bug. And there should be coding rules that ensure in future no such bugs exist in Zope. Rgs, Kent Sin --------------------------------- kentsin.weblogs.com kentsin.imeme.net

3 2