- Zope-Dev - Zope lists

Re: [Zope-dev] Secure Tranactions with Zserver
by Christopher Petrilli 02 Aug '99

02 Aug '99

> While ZOPE with Apache-SSL is certainly possible , I personally would > prefer a more tightly coupled structure than the lightweight server to server > protocols provide(such as the certificate if available of the client > ) . I'll probably step on a few toes, but since this is my background and what I did before I came to work for DC, I'll put some of this to rest for the "foreseeable future"... It is possible to get access to the entire certificate via CGI from both Apache and Netscape (I can't and would rather not speak of IIS), and therefore you can garner whatever pieces you need out of it. In addition, mod_ssl allows for a nice ability to grab pre-parsed sections of the certificate without having to implement ASN.1/BER, which my dear friends, is a Good Thing. ASN.1 makes perl look readable, and is vague in the utmost and pedantic in the extreme. (Yes, I know that's contradictory, but Anthony Baxter I'm sure would agree with his interactions with SNMP). In addition, "tight integration" in this context is being used to imply "more security" I believe, which is a red herring, and implies that we as a company, are more focused on the cryptographic implications of what we do. While I might have a background in cryptography, most people around here don't, nor do they want it. For more information please read: http://www.counterpane.com/whycrypto.html This is Bruce Schneier's quite lucid essay on why crypto is harder than it appears on the outset. I'm not sure I wish to dedicate my entire time and resources to focusing on this, I would rather find someone else who has done an excellent job and allow us to leverage our own unique capabilities. The second aspect would be performance, however, anyone who has dealt with SSL, much less client-certificates and the overhead of dealing with them, understands that these are not generally solutions for high-transaction situations. If they are, then you are getting involved in hardware cryptographic accelerators (IBM's ISCF, Crysalis, Rainbow, etc.) and these are a bag into and of themselves. This would be a rather nasty Pandora's box to open, having stepped into interoperability before with a previous employer. I have spent literally months debugging PKCS-11 interface issues that change between revs of hardware. Just don't go there :-) > Tight integration of the SSL-Crypto extention with the zserver > would allow security/permission capatibilities to be set on objects based > upon a closed verification chain via client certificates Well, if you've violated the system integrity of any commercially available server (i.e. NT, UNIX, etc), then you've basically violated the chain of verification. So passing this information through CGI isn't that much less secure in the overall scheme of things. I would like to see this handled through a module, as it is better there than through ZServer. > If encryption and X609v3 are available then zope becomes a FAR more > interesting possibility for ecommerce. This is somewhat true, however, X.509 certificates are only in use in intranets at this point, and in some extranet applications. It is certainly not a dominant form of authentication at this point, nor probably will it be until some UI issues are resolved. Currently, there are divergent camps about how to deal with multiple authorities, and whether someone should have multiple certificates for different purposes, or if authority should be designated through arbitrary v3 extensions. This is a MAJOR ideological issue that is much harder than it seems. Today, 99.99% of e-commerce sites only require SSL integration, which we can accomplish today by using Netscape, Apache/SSL, Stronghold or IIS, and in fact we have several customers who use this exact situation. Integration with PKI is a speculative issue today. > And besides its on the TODO list > for the Zserver... It should be removed, and will be. I will categorically state that integration into ZServer is not on the horizon in any form of "near future" for both resource and export issues. > Pyhon SSL modules ARE available in source... This is a non-issue. > the question is where and how...(and preferably offshore i.e. NON US > developement). Not today, not by us. If someone else wishes to do this, deal with all export (and import in some countries) issues, etc., and deal with the multitude of crypto issues which again, are not trivial, then they are more than welcome to do so. Our "roadmap" is based on integration with well know, well tested servers which implement SSL in a known way. Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

1 0

Ask Slashdot - Zope's the Topic!
by Scott Cropper 02 Aug '99

02 Aug '99

Check out http://slashdot.org/askslashdot/99/07/31/0323235.shtml. Someone named "Codeshark" is asking about Zope and its reliability, stability, and ease of use. Lets all join in and give Zope (and of course, Digital Creations) a well deserved pat on the back. Scott Cropper scropper(a)earthlink.net

1 0

SMTP access
by Joerg Wittenberger 02 Aug '99

02 Aug '99

Hello folks, the other day I've got an idea, which IMHO is worth to consider, but I'm not sure about. I find zope a very intersting thing, but there is a drawback: you can't operate disconnected. Proposal: It would be really cool if I could prepare a xml message with the same content as a filled in formular or just a http/get request would have and send this to an object. Zope would reply with a mail message containing the reply. To illustrate that a little more: a form like that: <form method="post" action="..." ><input type=text name="phone"></form> would be sent in as phone=mynumber for http but as <phone> mynumber </phone> for email. The url would have to be encoded within the user name somehow e. g. an action url like http://www.dom.tld/foo/bar could be encoded as say: "foo/bar" <zope(a)www.dom.tld> Cookies, when required could maybe encoded in message-ids. I must admit: this is just an idea, I'm a bit too new to zope to judge about feasibility. How is yours, gurus? /Jerry ------- End of forwarded message -------

2 1

BUG in online help?
by Robin Becker 02 Aug '99

02 Aug '99

I'm getting this when clicking on certain items in the help system eg DTML Document Zope Error Zope has encountered an error while publishing this resource. exceptions.AttributeError Sorry, a Zope error occurred. Traceback (innermost last): File C:\Python\devel\ZOPE\lib\python\ZPublisher\Publish.py, line 256, in publish_module File C:\Python\devel\ZOPE\lib\python\ZPublisher\Publish.py, line 161, in publish File C:\Python\devel\ZOPE\lib\python\ZPublisher\mapply.py, line 154, in mapply (Object: objectitem) File C:\Python\devel\ZOPE\lib\python\ZPublisher\Publish.py, line 98, in call_object (Object: objectitem) File C:\Python\devel\ZOPE\lib\python\App\special_dtml.py, line 120, in __call__ (Object: objectitem) (Info: C:\Python\devel\Zope\lib\python\HelpSys/objectitem.dtml) File C:\Python\devel\ZOPE\lib\python\DocumentTemplate\DT_String.py, line 502, in __call__ (Object: objectitem) File C:\Python\devel\ZOPE\lib\python\HelpSys\HelpUtil.py, line 151, in get_docstring_html (Object: DTMLDocument) File C:\Python\devel\ZOPE\lib\python\StructuredText\StructuredText.py, line 527, in __str__ File C:\Python\devel\ZOPE\lib\python\StructuredText\StructuredText.py, line 610, in _str File C:\Python\devel\ZOPE\lib\python\StructuredText\StructuredText.py, line 557, in normal File C:\Python\devel\ZOPE\lib\python\StructuredText\StructuredText.py, line 508, in ctag File C:\Python\devel\Zope\lib\python\ts_regex.py, line 174, in __call__ File C:\Python\Lib\regsub.py, line 38, in gsub AttributeError: regs Object Reference gives Zope Error Zope has encountered an error while publishing this resource. exceptions.AttributeError Sorry, a Zope error occurred. Traceback (innermost last): File C:\Python\devel\ZOPE\lib\python\ZPublisher\Publish.py, line 256, in publish_module File C:\Python\devel\ZOPE\lib\python\ZPublisher\Publish.py, line 161, in publish File C:\Python\devel\ZOPE\lib\python\ZPublisher\mapply.py, line 154, in mapply (Object: objectref) File C:\Python\devel\ZOPE\lib\python\ZPublisher\Publish.py, line 98, in call_object (Object: objectref) File C:\Python\devel\ZOPE\lib\python\App\special_dtml.py, line 120, in __call__ (Object: objectref) (Info: C:\Python\devel\Zope\lib\python\HelpSys/objectref.dtml) File C:\Python\devel\ZOPE\lib\python\DocumentTemplate\DT_String.py, line 502, in __call__ (Object: objectref) File C:\Python\devel\Zope\lib\python\DocumentTemplate\DT_In.py, line 689, in renderwob (Object: hs_objectvalues) File C:\Python\devel\Zope\lib\python\DocumentTemplate\DT_With.py, line 132, in render (Object: sequence-item) File C:\Python\devel\ZOPE\lib\python\HelpSys\ObjectRef.py, line 118, in __getattr__ (Object: Chart) AttributeError: __call__ -- Robin Becker

1 1

Dynamic SQL statement construct
by HCSCCS＠prudential.com.my 02 Aug '99

02 Aug '99

As usual, I'm beeen using Zope-1.10.3-src, Zap-1.10, RedHat 5.2 and lately ZPyGresql Database Adaptor. I wonder whether we can dymanicaly construct an SQL statement. Below is the following situation: DTML Method 1 :- ============ Contain 3 same combo box as the first, second and third sort key. Each combo box contains 3 sort keys, Aeg. A, B, C. User will choose the combination of keys they want and submit the page.. DTML Method 2 : ============ Display the information as the sorted manner defined in the earlier page. So how do you guys think? Can Z SQL Method do that? The followings are the possible key combinations: ABC ACB BAC BCA CAB CBA AB AC BA BC CA CB A B C Do we need to BUILD 15 Z SQL Method?? If not, what is the proper way? Please reply to hcsccs(a)prudential.com.my as well. Thanks a lot, Paul Chung Paul Chung Executive IT Department Prudential Assurance Malaysia Berhad

2 1

Strange Characters and Zope
by Robin Becker 02 Aug '99

02 Aug '99

I was demonstrating the implementation in Zope of my Generational Accounting web model. The Academic saw how marvellous it was and wanted immediately to change some of the text in the pages. It was in word so I said 'save as html' and then we'll hack it into the database pages. Foolish me. Word inserts many strange characters into it's version of HTML. One of them being character 0x92. This causes the page to start flinging out save as dialogs. Can someone enlighten me as to what characters may be safely embedded/used in Zope DTML. We figured 0x92 fairly easily. The next document had something else weird and I haven't yet found out what. -- Robin Becker

6 15

Callbacks
by Scott Robertson 02 Aug '99

02 Aug '99

I'm trying to write a product that will use a callback/hook schema. That way a user can specify wether a DTMLMethod or a SQLMEthod should handle a paticular error. So I have an object with a function defined like this. def callback(self): """Call back test""" func = getattr(self, 'ring') return apply(func, (self, globals())) 'ring' is a document method defined in the root folder. It finds this object but when it tries to render 'ring' it can't find standard_html_header and gives me this traceback. Traceback (innermost last): File /home/sroberts/Zope/lib/python/ZPublisher/Publish.py, line 255, in publish_module File /home/sroberts/Zope/lib/python/ZPublisher/Publish.py, line 161, in publish File /home/sroberts/Zope/lib/python/ZPublisher/mapply.py, line 154, in mapply (Object: callback) File /home/sroberts/Zope/lib/python/ZPublisher/Publish.py, line 98, in call_object (Object: callback) File /home/sroberts/Zope/lib/python/Products/Wampum/WampumGenerator.py, line 83, in callback (Object: wamp) File /home/sroberts/Zope/lib/python/OFS/DTMLMethod.py, line 158, in __call__ (Object: ring) File /home/sroberts/Zope/lib/python/OFS/DTMLMethod.py, line 154, in __call__ (Object: ring) File /home/sroberts/Zope/lib/python/DocumentTemplate/DT_String.py, line 514, in __call__ (Object: ring) KeyError: standard_html_header I thought that maybe this was an aquisition problem so I tried using the __of__() call like this: return apply(func.__of__(self), (self, globals())) This gave the same error. Any thoughts? --------------------------------------------------- - Scott Robertson Phone: 714.972.2299 - - CodeIt Computing Fax: 714.972.2399 - - http://codeit.com - ---------------------------------------------------

3 2

PyGreSQL DA: help testing
by Ross J. Reedstrom 02 Aug '99

02 Aug '99

Well Zopeists - I stuck my neck out on the postgres-hackers list late last week, and said I'd take a look at whiping the postgres DA into shape to work with Zope2. This involved modifying the PyGreSQL pgmodule source (wrapping calls to the backend with Py_START_ALLOW_THREADS and PY_END_ALLOW_THREADS macros), as well as the DB class inside ZPyGreSQLDA. Well, I think I've at least got it limping along, at Level 2, using the THUNKED_TM 'Kludge of the Century'. I chose to pass the Zope transaction points on through to the Postgres backend, initiating and ending transactions via the _begin, and _finish calls. Hope this is how it's supposed to work. I get what looks to be the correct set of lines in my postgres logs. It all seems to work in my hands, but this is my first attempt at working with threads, and I've written very little Python, besides ;-) So, I need help with suggestions on how to test everything. For this, I mean formal regression-type tests, at the python module interface level, both inside and outside Zope, rather than end-user, plug it in and see if it works for me testing. Anyone? Ross -- Ross J. Reedstrom, Ph.D., <reedstrm(a)rice.edu> NSBRI Research Scientist/Programmer Computer and Information Technology Institute Rice University, 6100 S. Main St., Houston, TX 77005

1 0

Secure Tranactions with Zserver
by zope 01 Aug '99

01 Aug '99

While ZOPE with Apache-SSL is certainly possible , I personally would prefer a more tightly coupled structure than the lightweight server to server protocols provide(such as the certificate if available of the client ) . Tight integration of the SSL-Crypto extention with the zserver would allow security/permission capatibilities to be set on objects based upon a closed verification chain via client certificates (2 two majors support genning them with a simple code fragment. If encryption and X609v3 are available then zope becomes a FAR more interesting possibility for ecommerce. And besides its on the TODO list for the Zserver... Pyhon SSL modules ARE available in source... the question is where and how...(and preferably offshore i.e. NON US developement). cheers A pyhon/Zope novice but a Apache/mod-ssl/php fanatic who wandered here from midgard

2 1

Re: [Zope-dev] CatalogAwareness?
by Kevin Dangoor 01 Aug '99

01 Aug '99

-----Original Message----- From: Michel Pelletier <michel(a)digicool.com> To: Kevin Dangoor <kid(a)kendermedia.com> Cc: David Kankiewicz <kankie(a)thegrid.net>; Zope-Dev(a)zope.org <Zope-Dev(a)zope.org> Date: Sunday, August 01, 1999 2:18 AM Subject: Re: [Zope-dev] CatalogAwareness? >Kevin Dangoor wrote: >> >> I'm setting up my own Findable base class (as discussed in previous >> messages) to handle this. It appears that if you change a property that is >> specified as meta data in the ZCatalog, you'll need to refresh that entry in >> the Catalog, right? Does CatalogAware deal with that at all? Does it offer a >> method to update the object? (Does anything happen automatically if the item >> is renamed or if properties are changed?) > >The way to Zope portal toolkit components keep themsevles current with >the Catalog is to first uncatalog themsevles, and then recatalog >themselves. If the catalog that they acquire cares about some property >about that object, then those propeties will get cataloged. otherwise >the object ignored. For my 'Findable' class, I made an updateObject method that will uncatalog and then recatalog the object. I guess I was curious if the CatalogAware class has such a method as well. >If I remember correctly, there are also hooks that objects can set on >themselves that get called by the zope transaciton machinery. I would >need to ask jim if it's a good idea for an object to try to acquire a >catalog and uncatalogs and recatalogs itself right before the commit, >thus if the object changed the catalog recatalogs the object. That would be nifty. Then the cataloging machinery is quite transparent. Just make the ZClass inherit from CatalogAware and setup the Catalog with the properties you want and you're all set! It's not too onerous to have to call an update or refresh method when the object is edited, however. >(The previous sentence reminds me of something Ken once said, 'Engish is >verbing.' (or was it 'English verbs.'?)) I believe the Hacker's Dictionary says "any noun can be verbed". Kevin

1 0