- Zope-Dev - Zope lists

RE: [Zope-dev] Cookies presented on management login
by David Thibault 09 Aug '01

09 Aug '01

Steve, Thanks for the input on this cookie issue. Also thanks to Chris McDonough who also replied and has expressed an interest in helping with innards questions. I responded to this one simply to apologize for the rich-text post...(insert stupid look here...=). I'm sure I'll post again for this project as soon as I come up w/ the next question...=) Dave Thibault -----Original Message----- From: Steve Alexander [mailto:steve@cat-box.net] Sent: Thursday, August 09, 2001 5:00 PM To: David Thibault Cc: 'zope-dev(a)zope.org' Subject: Re: [Zope-dev] Cookies presented on management login David Thibault wrote: > Hello all, > > I'm new to this list (my first post). I'm currently in a project for > SANS certification in which I'm auditing Zope security. I just noticed > that every time I log in I get a cookie from the server that has the > following info: > > Name: tree-s > Data: "eJzTiFZ3hANPW/VYHU0ALlYElA" You know that tree in the left hand frame of the management interface? Well, that cookie represents the state of the tree. See lib/python/TreeDisplay/TreeTag.py for the cookie handling stuff. It is in the methods encode_seq and encode_str, and the complementary decode_... methods. Please don't post HTML mail to this mailing list. -- Steve Alexander Software Engineer Cat-Box limited

1 0

Cookies presented on management login
by David Thibault 09 Aug '01

09 Aug '01

Hello all, I'm new to this list (my first post). I'm currently in a project for SANS certification in which I'm auditing Zope security. I just noticed that every time I log in I get a cookie from the server that has the following info: Name: tree-s Data: "eJzTiFZ3hANPW/VYHU0ALlYElA" The data is ALWAYS the same. I got the same cookie from a Redhat 7.1 box runnning Zope 2.3.2 as I did from an NT box running Zope 2.4.0. What is this cookie used for in the management process? I'm not at all familiar with Zope's innards (but hopefully I'll get familiar with the security innards at least). Also, trudging through all the source code to find the answer to this is not really a reality for me given the fact that my Python experience is not deep enough. On a separate but related note, could anyone forward me links describing the security innards? I am familiar enough with Zope to know that only certain modules can be imported, etc. However, I've had a really hard time finding anything more detailed than the security howtos that describe assigning permissions & such through the management interface. All the security precautions that have been taken into account when developing the core of Zope are of interest to me. Basically, the project is to hack zope before the hackers do. Hopefully, I won't find anything (or at least just little stuff like I mention in the next paragraph). What I hope will result of this is a checklist that people can go through to harden their Zope boxes. Also, if this is the wrong list to be asking about the security features of the innards, please direct me to the appropriate place. I hope to come up with a substantial review of Zope from a security standpoint. I've already found a couple of things that could be done to help (small things), like editing the header lines in HTTPResponse.py to not give up the server version info in the HTTP headers. Changing it to something like "Atari 2600 SuperServer" would at least keep the hackers from knowing you're running Zope 2.x.y and finding related vulnerabilities...=). Thanks, Dave Thibault

3 2

ZOracleDA with Zope 2.4 and Python 2.1
by Juan Javier Carrera Obrero 09 Aug '01

09 Aug '01

In Win32 plataform, I am updating to Zope 2.4 version and Python 2.1 version, but the ZOracleDA product does not correctly with these versions. I think that this product only runs correctly with the zope 2.1.6 and python 1.5. I have seen that in the ZOdbcDA product the "sql.pyd" library has been changed for use it with zope 2.4 and python 2.1. Anybody knows to how do to run the ZOracleDA product in the Zope 2.4 version and Python 2.1 version in Win32 plataform? I think that the problem is in the library "buffer" and "oci_". I have these libraries for zope 2.1.6 and python 1.5, but I have not theses libraries for the new versions. Also, I have been trying to compile the ZOracleDA's sources with gcc-2.95.2/mingw32 (for win32) as it says in "http://starship.python.net/crew/kernr/mingw32/Notes.html", but I only obtain errors. Anybody can help me? Thank you very much.

3 4

RE: [Zope-dev] 'transparent' proxying to a method not in your nam espace?
by sean.upton＠uniontrib.com 09 Aug '01

09 Aug '01

Were you able to call a method within a namespace for which it did not actually exist in this case? If so, that's sort of what I am after, except instead of user directory service, I'm thinking more along the line of a method directory service for said lookups and method calling. More specifically, I got this _really_ crazy idea into my head... ever since Jim's OSCON Components BOF, my brain has been trying to wrap around high-level use-cases of how it could be useful. That got me thinking a lot about a folder that I have that is bloated with all sorts of stuff; thousands of objects (mostly content), with dozens in the main folder - including code, presentation, sql, and content objects all over the place, and no matter how well I try to organize them, it still seems really messy - but it wouldn't be in service-oriented world. My interest is motivated by some frustrations with Transparent Folders. What I'm actually thinking of, I guess, is a little bit more ambitious: a lightweight 'interim' component/services type of system with a method directory/catalog service; let me explain: I have a folder - let's call it 'Content' - and it doesn't have a method I need to do something, for example, like an automation task set up in a TTW python script. In my ideal vision here, the method can be stuffed off in a central 'Code' folder located somewhere else in the odb hierarchy; My 'Content' folder needs a method called 'purgeExpiredContent' as an automation task. 'purgeExpiredContent' exists in the 'Code' folder; 'Content' doesn't have anything called 'purgeExpiredContent' but 'Content' is not a normal folder - it is a SuperMagicalGeniusFolder(TM) (perhaps there is a better name); if the folder had a dialog with itself, this is the conversation it would have: .................... "Someone just asked me to run a method called purgeExpiredContent. Do I have a method called that in my namespace?" "No." "Ok, I need to find it elsewhere; before I look in the namespace stack using acquisition, I am going to look up in a directory service if the method exists elsewhere. Does the Method Directory Service indicate it knows where this method lives?" "I just queried it, and it does know where this method lives; the path:..." "Ok, I got that path... " "I found the method; I'm going to run it within my ('Content') namespace." "Ok, I'm done..." .................... In this case, the method 'purgeExpiredContent' is more of a service to the 'Content' folder. The 'Method Directory Service' was likely a ZCatalog-derived lookup 'service object' in the Zope root; it's query result contained the path needed for 'Content' to obtain and run the method from wherever it lived (in this case, a folder called 'Code' in the Zope root, but using a method directory service, it really could live anywhere). The 'Content' folder had the smarts to intelligently look in the 'method directory' for methods it didn't have before it traversed its acquisition parents looking for it. It should be said that this feature should be provided via acquisition to contained objects below this SuperMagicalGeniusFolder(TM) called 'Content' and would use the namespace of the object it is called upon. This would make partitioning code, content, and presentation a lot easier. A method directory service and a smart folder like that could even use (optionally, in a componentized universe) as a 'method directory service' query parameter the interface asserted by the object trying to get the method as a means to determine if an method actually can be obtained; the catalog would return no resulting method even if it existed, but didn't work with the correct interface... I know I should just be patient and wait for component architecture ('cause yes, I now really see a need for it), but this idea is just stuck in my head, and I can't get it out cause it seems so useful... and it seems to me that one could use a modified ZCatalog as a good directory service for method lookups. I guess the complicated question (for me, at least) is whether or not the process of acquisition could be interrupted and/or preempted for an alternate traversal means for obtaining methods either inside my Product code or in a hotfix product. The concept of method lookup doesn't seem daunting, but making it execute transparently does. I would hope something like this would be possible without modifications to the Zope core... Sean -----Original Message----- From: Dyon Balding [mailto:dyon.balding@monster.com] Sent: Wednesday, August 08, 2001 10:15 AM To: sean.upton(a)uniontrib.com Cc: zope-dev(a)zope.org Subject: Re: [Zope-dev] 'transparent' proxying to a method not in your namespace? Sean, I think I understand what you're trying to do; if so, I've done something similar. What I had was a list of staff members pulled from LDAP, and a folder containing objects representing some of those staff members (those who had customized their information). The URLs from the staff list page were all the same, ie blah/staff/name or similar. I then had a site access_rule that grabbed and rendered the customized object if it existed, or retrieved some generic information from LDAP and rendered it if it didn't. I think that's approximately what you're trying to do? If the above method sounds plausible I can give you a copy of my code if it's any help. -d On Wed, Aug 08, 2001 at 09:22:51AM -0700, sean.upton(a)uniontrib.com wrote: > Problem: I have a custom folder type, and I want to hijack unsuccessful > method lookups in its namespace and have them transparently proxy to code in > another folder... > > I have a Python product class that uses Folder as it's base; it's cluttered > with code objects, and I don't want to have to use Transparent Folders, > which seem to break one thing or another. I'm also looking for (perhaps) > something as an application-specific alternative/addition to acquisition as > a namespace traversal mechanism. > > I had this idea of storing my various methods in a 'ProjectCode' folder in > the Zope root, and having my 'Folder' evaluate its own namespace looking for > a method; if it doesn't exist, before the Zope looks in the acquisition > parent(s), the 'Folder' looks in the namespace for the 'ProjectCode' (or > some other folder name) folder in the root to find the method, and run it > within the 'Folder' namespace. > > I'm sort of ignorant as to where to start looking if I wanted to do this, > but I'm willing to investigate and figure out how to code it if it's > something that can be done within my product code or in a hotfix, and > doesn't require a patch the size of Texas... > > Thoughts? > > Sean > > ========================= > Sean Upton > Senior Programmer/Analyst > SignOnSanDiego.com > The San Diego Union-Tribune > 619.718.5241 > sean.upton(a)uniontrib.com > ========================= > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) -- | Dyon Balding . Software Engineer . HiringTools.Monster.com | dyon(a)hiringtools.com . +1 415 288 3375

2 1

RFC: SecurityJihad Proposal
by Michael R. Bernstein 09 Aug '01

09 Aug '01

Hello All, As some of you may have noticed, I've been working on a proposal for removing Zope's inconsistencies regarding security that currently make writing Python products less straightforward then it should/could be. The proposal is at: http://dev.zope.org/Wikis/DevSite/Proposals/SecurityJihad What the proposal covers: - The cruft that has accumulated - The problems the cruft causes - The workarounds that the cruft makes neccessary - A proposal for removing the cruft, while maintaining what backwards compatibility we can. Note that while I think that a certain amount of backwards compatibility can be maintained, some breakage *must* occur if the workarounds are to be eliminated for product developers. Declaration of Jihad: Inconsistencies suck. Security inconsistencies are dangerous, and encourage the creation of insecure products. The incocnsistencies must be eliminated! I declare Jihad on all security inconsistencies! :-) Comments welcome, Michael Bernstein.

1 0

Emergency User Stupidity with Transactions
by Chris Withers 09 Aug '01

09 Aug '01

Chris Withers wrote: > > Hi, > > I need to import a _big_ .zexp (1.8GB) > > To stop browsers timing out, I wrote a little script to do this: > > from urllib import urlopen > > print "start" > urlopen('http://username:password@localhost:80/manage_importObject?set_owner:int=0&f…').read() > print "done" > > ...which runs and print: > > start > done > > ...but when I I got to the root management interface, I see no 'my' object. > > Weird. Go to the Database Info page in the control panel and the Data.fs _has_ > grown by 1.8GB, so where's the object?! I printed the results of the urlopen. I was getting an 'Emergency User Cannot Own' error. But, and this is crazy, the Data.fs is still growing by the size of the import, even though it hasn't been successfully imported!!! Ideas? Chris

1 0

Bug in all database adapters?
by Shai Berger 09 Aug '01

09 Aug '01

Hi, I think I just found a deep bug that runs through most, if not all, relational database adapters, and some other products (notably, session management) too. These products usually inherit ZRDB.TM, and trust it for their trnasaction management. The adapters usually just implement _begin (if they need to start the transaction explicitly), _abort and _finish. The problem is that TM handles two-phase-commit quite badly, or so it seems to me. Since most DAs don't need to prepare for commits, it ignores tpc_begin (the first phase), and calls _finish on tpc_finish (the second phase). Now, since it ignores tpc_begin, TM's authors thought they can ignore tpc_abort too -- and they did. However, this is wrong. If an object raises an exception in the first phase, the only method called for other ones may be tpc_abort. As a result, database transactions will be left hanging -- when the Zope transaction ends, they will be neither committed nor rolled back, and any locks they acquired will stay in force. I have seen this in Zope 2.3.2, but as far as I've seen the changelogs show nothing related in later versions. Am I missing something?

3 2

DCOracle 1.32 weirdness -- quick help needed
by Shai Berger 09 Aug '01

09 Aug '01

Hi Zopers, Sorry for cross-posting -- I need help on this rather fast... I have been using ZOracleDA and DCOracle quite happily. Now, I needed to branch a "test" zope from the "dev" zope. As I was using the INSTANCE_HOME setup, this was a breeze: I shut zope down, copied the instance directory tree, meddled a little with the start scripts to give it different ports, fixed my httpd.conf, et voila. A new zope, up and running, independent of the first one. Except... Except that Oracle connections won't open. When I try to open them manually, they say, """ <strong>Invalid connection string: </strong><CODE>not/gonna@tellya</CODE><br>  <PRE> Traceback (innermost last): File /home/src/Zope-2.3.2-src/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /home/src/Zope-2.3.2-src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/src/Zope-2.3.2-src/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: RoleManager) File /home/src/Zope-2.3.2-src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/src/dev/../Zope-2.3/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: manage_open_connection) File /home/src/Zope-2.3.2-src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: manage_open_connection) File /home/src/Zope-2.3.1-src/lib/python/Shared/DC/ZRDB/Connection.py, line 220, in manage_open_connection (Object: RoleManager) File /home/src/Zope-2.3.1-src/lib/python/Shared/DC/ZRDB/Connection.py, line 240, in connect (Object: RoleManager) File /home/src/test/Products/ZOracleDA/db.py, line 123, in __init__ File /home/src/test/Products/ZOracleDA/DCOracle/ocidb.py, line 90, in cursor File /home/src/test/Products/ZOracleDA/DCOracle/ociCurs.py, line 105, in __init__ BadRequest: (see above) </PRE> """ At first I thought it was some stupid system thing, where the paths of the .pyc files were somehow encoded in them. So I went and deleted them all, and restarted, to no avail. Then I thought that it was the same problem, but with the python extensions. But it couldn't be: they were not built on this machine at all, and some files (Python's /lib/config/...) that are required in order to do this are missing. I have on the same Zope an installation of DCO2, patched to allow it to coexist with ZOracleDA. This works flawlessly. And ZOracleDA works flawlessly on the original, "dev" zope. Zope 2.3.2 ZOracleDA 2.1 (I think; only indication is the CHANGES.txt file) DCOracle 1.3.2 (I think) Oracle 8.0.5 (I don't think this matters) Red Hat 6.2 Any ideas? Thanks, Shai.

3 3

Uninstall Leakfinder
by Chris Withers 09 Aug '01

09 Aug '01

Hi Shane, What the recommended way to uninstall the Leakfinder product? cheers, Chris

2 2

Help!!!(how to search for a file in a particular folder is there any method?)
by Suresh Eddala 08 Aug '01

08 Aug '01

hello, i want to get the particular DTML Document URL in a particular folder by searching file name in that folder dynamically. please help Suresh Babu Eddala ZeOmega Infotech. Pvt Ltd. India _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

2 1