- Zope-Dev - Zope lists

python methods & zope - security hole ?
by Joseph Wayne Norton 31 Jan '01

31 Jan '01

Evan - I believe I have found a situation while using python methods that exposes a security hole. A user that can create python methods can grant the Manager role to himself by simply writing and then calling the manage_users method. This issue might also apply to other scenarios. I created a simple test case to check the behavior ... - create a user without any roles in a acl_users folder (see below) - create a python method such as the one below that grants root access to the user (see below) - create a dtml method that calls the python method .... this method should have view and access content information granted (see below) to the user created in the first step. In my case, I'm simply using the anonymous role ... but it could be another role setup for developers, content editors, etc. - execute the dtml method (see below) I also created a similiar test case for dtml methods and the dtml method behaved as I expected .... preventing the user from obtaining the manage_users role because they do not have the role in the first place. I just want to confirm if this is a known issue or a new issue (or feature or mistake in my zope setup). I'm currently running with zope 2.2.5 and python methods 0-1-7. If this is indeed an issue, it might be worthwhile to simply document this issue on the PythonMethods product page. thanks, - joe n. ############################################################################### # Here is the output of this behavior ... UserName: dummy_non_manager Roles: () Has 'View' ?: 0 Has 'Manage users' ?: 0 user 'dummy_non_manager' roles '['Manager']' user 'dummy_manager' roles '['Manager']' UserName: dummy_non_manager Roles: ('Manager',) Has 'View' ?: 1 Has 'Manage users' ?: 1 ############################################################################### # Here is the python method args: self,REQUEST body: ret = '' users = {'dummy_manager' : ['Manager'],'dummy_non_manager' : ['Manager']} for u in users.keys(): roles = users.get(u) REQUEST.set('name', u) REQUEST.set('roles', roles) self.acl_users.manage_users('Change',REQUEST) ret = ret + ('user \'%s\' roles \'%s\' \n' % (u, roles)) return ret ############################################################################### # Here is the dtml method: <dtml-var standard_html_header> UserName: <dtml-var "REQUEST['AUTHENTICATED_USER'].getUserName()"> Roles: <dtml-var "REQUEST['AUTHENTICATED_USER'].getRoles()"> Has 'View' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('View',REQUEST['AUTHENTICATED_USER'])"> Has 'Manage users' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('Manage users',REQUEST['AUTHENTICATED_USER'])"> <dtml-var "acl_users_roles_python_method(REQUEST)"> UserName: <dtml-var "REQUEST['AUTHENTICATED_USER'].getUserName()"> Roles: <dtml-var "REQUEST['AUTHENTICATED_USER'].getRoles()"> Has 'View' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('View',REQUEST['AUTHENTICATED_USER'])"> Has 'Manage users' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('Manage users',REQUEST['AUTHENTICATED_USER'])"> <dtml-var standard_html_footer> -- -- Joseph Norton norton(a)alum.mit.edu +81-3-3822-6936 2-10-7 Tabata, Kita-ku, Tokyo 114-0014, Japan (〒114-0014 東京都北区田端２丁目10-7)

1 0

Zope Service Won't Start
by Nai A. Tzeo 31 Jan '01

31 Jan '01

Hello, I've encountered a slight problem. My company is running Zope as an NT service and it's been running great for a few months but it stopped working today. I was installing ZmxODBCDA by copying the files from the zip to Zope. After copying the files over, I restarted Zope via NT Service. Keeps throwing start service due to logon failure. I don't know what to do. Rebooted and deleted all the files I was installing and still can't get the server started. Anyone has any suggestion? I'm a total newbie and am at lost. There are going to be a lot of piss off people tomorrow if I don't get this working tonight. TIA, Nai

3 2

2.30 help system authentication problem?
by Ross Lazarus 30 Jan '01

30 Jan '01

I never allow anonymous to have any permissions in my zope root and I have just noticed that I have to grant the view right to anonymous or the help button gives me an authentication error - even when I'm logged in as manager/owner. Is it just me? New 2.30 source install on solaris 2.6 using an old Data.fs (which has been through many upgrades...) I'll put this in the collector if anyone can confirm it please.

2 1

Security hole in CookieCrumbler
by Shane Hathaway 30 Jan '01

30 Jan '01

Hi folks, It turns out that the released versions of the CookieCrumbler product have a terrible security hole. I recommend you uninstall it immediately. I'm not going to be able to deal with the problem fully today, but if you're interested in getting a solution right away you can grab today's PTK from CVS which contains a version of CookieCrumbler without the hole. Thanks to Phil Harris for finding the problem. Shane

1 0

ZPatterns
by Tom Deprez 30 Jan '01

30 Jan '01

Hi, Is there any way to get ZPatterns working even if you don't have a C++ compiler on Win32? Isn't there a working dll version available, somewhere? Thanks, Tom.

3 2

ANN: CoreSessionTracking 0.7
by Chris McDonough 30 Jan '01

30 Jan '01

A new release of the "CoreSessionTracking" product is out. The product allows you to associate state with anonymous visitors between requests. The latest version (0.7) fixes a fairly serious kid-clicking-related bug found by Randall Kern that effects RAM-based ("internal") session data containers. If you need to upgrade from 0.6, all that is required is to untar/ungzip this release on top of the 0.6 release files. Then you must restart. You can find the product at http://www.zope.org/Members/mcdonc/Products/CoreSessionTracking/index_html - C

1 0

LoginManager and Control_Panel - The Never Ending Story
by Itai Tavor 30 Jan '01

30 Jan '01

Hi, I posted several questions about this problem, but got no replies. I thought I'd try again with a bit more information. The problem is accessing Control_Panel from a folder that contains a LoginManager. I tested the same setup using a plain acl_users and found one difference. Zope/ acl_users/ user_1 (Manager) Test1/ acl_users/ (User Folder) user_2 (Manager) cnt1 (owned by user_1, Manager proxy role) cnt2 (owned by user_2, Manager proxy role) Test2/ acl_users/ (LoginManager) user_3 (Manager) cnt1 (owned by user_1, Manager proxy role) cnt2 (owned by user_3, Manager proxy role) cnt1 and cnt2 are DTML Methods containg: <dtml-var Control_Panel fmt=html-quote> Logging in to /Test1/ with user_2, both /Test1/cnt1 and /Test1/cnt2 return the Control_Panel object. Loggin in to /Test2/ with user_3, /Test2/cnt1 return the Control_Panel object. /Test2/cnt2 returns KeyError: Control_Panel. ZDebug reports: Unauthorized: User itai, who is the owner of /OzCoasters/cnt2, is defined in the context of /OzCoasters, which is not an ancestor of /Control_Panel. Hope anyone can understand this... it's confusing the stuffing out of me. But basically, the Manager proxy role allows a method to access Control_Panel regardless of where its owner and the logged in user are defined. But with LoginManager, Control_Panel is only accessible if the owner is defined in a regular User Folder above the LoginManager. Any idea why this is happening? Any suggestions on how to test it? I know it's more likely to be a problem in my implementation of the user-supplied parts of LoginManager than a bug in LM... but my LM works in all other ways, and it doesn't seem to be doing anything wrong. Any help would be, er, helpful (To borrow the words of King Arthur. Hey, a python reference! Do I get points for that?) -- -- Itai Tavor -- "Je sautille, donc je suis." -- itai(a)optusnet.com.au -- - Kermit the Frog -- -- 'Supposing a tree fell down, Pooh, when we were underneath it?' -- -- 'Supposing it didn't,' said Pooh after careful thought. --

1 0

Possible TransparentFolders bug?
by Itai Tavor 30 Jan '01

30 Jan '01

Hi, The TransparentFolders Product seems to make everything transparent... not just transparent folders. Zope/ Folder_A/ method_A Folder_B/ (transparent folder) method_B I'd expect the only effect of the transparent folder to be that /Folder_A/method_B would work. But /method_A and /method_B also work. Tested in Zope 2.3b2 and 2.3b3 with TransparentFolders 0.3. -- -- Itai Tavor -- "Je sautille, donc je suis." -- itai(a)optusnet.com.au -- - Kermit the Frog -- -- 'Supposing a tree fell down, Pooh, when we were underneath it?' -- -- 'Supposing it didn't,' said Pooh after careful thought. --

2 3

zope 2.3.0 upgrade bug: inituser trashes existing user
by Zope mailing lists 30 Jan '01

30 Jan '01

I have not thoroughly tested this, but I have done it twice to make sure I could reproduce the error I saw in the specific circumstances I saw it. I suspect the bug is generic, but don't have the time to prove it right now. My setup: INSTANCE_HOME style setup. Zpatterns installed in 2.3.0 tree EMarket installed in the instance products folder. RedHat Linux 5.2 (I think, how do you tell on a linux system?) python from RPMs, zope 2.3.0 from source install (wo_pcgi). I upgraded an existing site by simply changing my zopectl (see my product) PYTHONHOME setting to the 2.3.0 tree, shutting down the site (which had been running 2.2.4), and restarting. Now, at this point I did not understand how inituser was supposed to work, so I had copied my old access file to be my inituser file, thinking the name had changed but the semantics were similar. Imagine my surprise when the inituser file dissapeared when I started zope <grin>. The problem is that the inituser *replaced* the single existing user in the acl_users folder. This must be a bug. --RDM PS: I also was amazed to find that having ZDebug (without Chris' patch) in my Products folder left my site *wide* open: anonymous could view and edit methods. This might be worth a warning on the web site, even though it is unlikely anyone would run production with ZDebug installed.

2 1

2.3.0 release badness
by richard＠bizarsoftware.com.au 30 Jan '01

30 Jan '01

I've just updated to 2.3.0 release using CVS. My CSS serving has subsequently broken. The CSS serving worked fine with the CVS code from 2.3.0b2. I didn't get to check b3 - we had a public holiday on Friday and that meant that the one working day assigned to the b3 release was lost to me (and _most_ other Australians). Anyway, that's a separate issue ... I've done a diff against the CVS as of last Tuesday, but I can't see an obvious place where the Zope code has changed to make the CSS serving fail. Under Netscape (versions 4.72 -> 4.75), a 'back button' request results in a truncated plain-text display of the CSS that is linked from the page. The zope server log shows the request as being successfully served. I telnet'ed to the server and requested the CSS manually, and the headers all look fine. A packet sniffer seems to say that all is well. Now for the fun: this only happens for local requests - someone requesting the same pages over the ethernet will get them fine. Only Netscape and only locally. Konqueror locally works fine. The CSS is being served using the attached class. Some further experimentation: 1. load the same page five times as follows: http://mymachine:8080/blah/ http://127.0.0.1:8080/blah/ http://127.0.0.2:8080/blah/ http://10.0.0.20:8080/blah/ http://127.0.0.3:8080/blah/ 2. starting from either end of those URLs in the browser history, hit the 'forward' button or 'back' button four times to get to the other end. 3. note that the first hit of 'forward' or 'back' (and sometimes other hits too) the CSS is served as plain text Of course, embedding the style in the page (a-la the Zope management interface) gets around this problem, but this is not an option for us. Again, this was not a problem pre 2.3.0 b3 / release... Richard -- Richard Jones richard(a)bizarsoftware.com.au Senior Software Developer, Bizar Software (www.bizarsoftware.com.au)

7 10