- Zope-Dev - Zope lists

Suggestion for small(?) change in BaseRequest.py. Security effects?
by Lennart Regebro 03 Sep '04

03 Sep '04

First Explanation: ================== We have been discussing how to implement the challenge support in PluggableAuthService, and I have been trying a couple of different ways. (Note: challenge-support in this context means, how to ask the client for authenticifcation credentials, that is username and password, or tickets, or certificates, or something.) The preferred solution has been narrowed down to using a way similar to CookieCrumbler, that is, replacing the current response-objects unauthorized() method with a method that does the challenge, like so: if not req.get('disable_cookie_login__', 0): if attempt == ATTEMPT_LOGIN or attempt == ATTEMPT_NONE \ or attempt == ATTEMPT_RESUME: # Modify the "unauthorized" response. req._hold(ResponseCleanup(resp)) resp.unauthorized = self.unauthorized resp._unauthorized = self._unauthorized Now, there is one tiny problem with that, and that problem is in BaseRequest.Traverse(). (BaseRequest.py, line 438): if user is None and roles != UNSPECIFIED_ROLES: response.unauthorized() if user is not None: ... As you see, this code assumes that response.unauthorized will raise an error. If it does not, the code will continue *as if the user is validated*. An error will occur later, since the user isn't validated, so it's nota security hole (is think), but it causes a problem: The only acceptable end of an unauthortized() is to raise an exception. This means in practice, either the Unauthorized exception that prpvoces the standasd 401 login box challenge, or a Redirect to a login page. This seems a bit limiting, and there has been requests for doing other things, such as returning an HTML form directly, and whatnot. Then, suggestion: ================= My tests seems to show that inserting a return after the unauthorized call above: if user is None and roles != UNSPECIFIED_ROLES: response.unauthorized() return will solve this issue. It is now possible to NOT raise an exception in unauthorized and still not get problems. Instead, you can now to a RESPONSE.redirect(), or you can replace the body with setBody for a login form, or something like that. I haven't been able to find any other code that continues after an unathorized call, so this should be the only place. Also, during normal operation, it is obvuiosly a safe bet. The change in itself has no nasty side effects. Last, questions: ================ Are there any other problems with NOT raising an exception in unathorized(). Becuase if there is, we probably limit the possible challenge responses to a redirect, and then this change makes no difference. I would suggest that the change goes in ANYWAY, to stop people almost accessing stuff by fiddling with response.unauthorized (although I admit I don't know how to do that). Lennart Regebro

4 6

Re: [Zope-dev] Re: Developing plugins for PluggableAuthService
by Lennart Regebro 03 Sep '04

03 Sep '04

Chris Withers wrote: > Lennart Regebro wrote: > >> Chris Withers wrote: >> >>> Is there any chance I could tempt you to change these to be Python >>> 2.3 style logging calls? >> >> >> >> Sure. remind me of the syntax. :) > > > import logging > > logger = logging.getLogger('event.whatever') > > logger.error('whatever',exc_info=1) > > You could also read: > > http://docs.python.org/lib/module-logging.html > > ...for a more complete description :-) > > cheers, > > Chris OK, Thanks. I'm noticing that (with Zope 2.7.2) when I do this, I do not get the modulname (whatever) nor the exception level WARNING printed to the log. Is this a config error, or am I doing something wrong? Because quite obviously, it should be there, right?

2 3

Zope MemoryError after installing Plone
by Matt Shaw 02 Sep '04

02 Sep '04

Hi all, I just compiled a fresh copy of zope 2.7 - it started up just fine. So then I grabbed Plone 2.0.4. After copying Plone to my Products directly, I cannot startup Zope and I get a MemoryError. Here is the tb: http://paste.plone.org/1317 I'm using python 2.3.3 on freebsd4 - Do I need recompile python with some special flag? Thanks, Matt ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Plone-users mailing list Plone-users(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/plone-users

2 1

portal_actions via listFilteredActionsFor
by Krzysztof Kubacki 02 Sep '04

02 Sep '04

Hallo, I have the problem. Zope 2.7.0, Plone-2.0.3, Linux I list actions from portal_actions actions python: here.portal_actions.listFilteredActionsFor(here) I recive a list with actions. Depending on kind of logged user I recive that list in diffrent count. I mean that when I'm Manager the list is bigger than I'm SiteManager. I suppose that it depends on permissions. Where I can set it? I would like to recive the same list being Manager and SiteManage as well. Thanks in advance KK

2 1

Announce: August Zope Bug Day!
by Chris Withers 01 Sep '04

01 Sep '04

Hi All, This announcement is pretty late, so I'm expecting it to be more of a low-key affair. That said, there's is a CMF bug day happening at the same time, so who knows... What? Zope Bug Day working from http://collector.zope.org/Zope When? Friday 3rd September - from when you wake up until when the day ends! Where? #zope-dev on irc.zope.org Come along and help if you've got a chance! Read this if you want to know how: http://dev.zope.org/CVS/BugDays cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

Developing plugins for PluggableAuthService
by Lennart Regebro 01 Sep '04

01 Sep '04

I just made a very neat plugin for PAS. I added it and activated it for everything it can do. It is now the *only* plugin active for Extraction, Challenge and Reset Credentials. The problem is howvere, that nothing happens. None of the methods in the plugin gets called, ever! So, eh, has anybody else here written plugins for PAS so they can point me in the right direction? //Lennart

4 16

Pointless code in ZPublisher.HTTPRequest ?
by Paul Winkler 01 Sep '04

01 Sep '04

Can anyone enlighten me on what this is for? >From ZPublisher.HTTPRequest.HTTPRequest.keys: n=0 while 1: n=n+1 key = "URL%s" % n if not self.has_key(key): break n=0 while 1: n=n+1 key = "BASE%s" % n if not self.has_key(key): break Unless I am particularly stupid today (quite possible), the above has no affect on the return value, and no direct side effects. I tried commenting it out and ran all unit tests with no apparent difference. While digging deeper for indirect side effects, I see that self.has_key() calls self.__getitem__() which calls self.get(). The only side effect of self.get('URLn') that I see is that if self.other.has_key('PUBLISHED'), the calculated URL will get cached for the duration of the request in self.other['URLn']. (And also in self._urls which AFAICT is used only to keep track of which keys we've written to self.other, so we can quickly clean them out in _resetURLS().**) So maybe that's the sole purpose of the code in question; some extra logging suggests that it does in fact have that effect. But it's hard for me to be sure. Can anyone confirm or deny? Or is there something else that I'm missing? ** btw, this too smells a bit funny to me... why bother to keep a separate data structure in sync, when we could just do: for i in range(9): try: del(self.other['URL%d' % i]) i += 1 except KeyError: break -- Paul Winkler http://www.slinkp.com

3 5

Transcience ? Problems
by Dario Lopez-Kästen 31 Aug '04

31 Aug '04

Greetings I have the following error showing up in my event.log (Zope 2.7.1, python 2.34, Plone 2.03) ---- ... File "/usr/local/zope/instances/cdks/Products/PlacelessTranslationService/Negotiator.py", line 266, in _negotiate userchoices = getLangPrefs(request, kind) File "/usr/local/zope/instances/cdks/Products/PlacelessTranslationService/Negotiator.py", line 54, in getLangPrefs accepted = handler.getAccepted(env, kind) File "/usr/local/zope/instances/cdks/Products/PlacelessTranslationService/Negotiator.py", line 172, in getAccepted language = request.SESSION.get('pts_language', None) File "/usr/local/zope/software/zope-2.7.1/lib/python/ZPublisher/HTTPRequest.py", line 1218, in __getattr__ v = self.get(key, default, returnTaints=returnTaints) File "/usr/local/zope/software/zope-2.7.1/lib/python/ZPublisher/HTTPRequest.py", line 1178, in get if callable(v): v = v() File "/usr/local/zope/software/zope-2.7.1/lib/python/Products/Sessions/SessionDataManager.py", line 94, in getSessionData return self._getSessionDataObject(key) File "/usr/local/zope/software/zope-2.7.1/lib/python/Products/Sessions/SessionDataManager.py", line 181, in _getSessionDataObject ob = container.new_or_existing(key) File "/usr/local/zope/software/zope-2.7.1/lib/python/Products/Transience/Transience.py", line 768, in new_or_existing self[key] = item File "/usr/local/zope/software/zope-2.7.1/lib/python/Products/Transience/Transience.py", line 439, in __setitem__ current_bucket = self._data[current_ts] KeyError: 1093704740 ---- After this my site locks up ans is not responding. What I do get in the log is thousands of conflict errors: -- ****** File "/usr/local/zope/software/zope-2.7.1/lib/python/Products/Transience/Transience.py", line 439, in __setitem__ current_bucket = self._data[current_ts] KeyError: 1093704740 ------ 2004-08-28T16:52:53 INFO(0) ZODB conflict error at /VirtualHostBase/https/XXX:443/cdks/VirtualHostRoot/heartbeat.txt (430 conflicts since startup at 2 004-08-26T15:50:14) ------ 2004-08-28T16:52:59 INFO(0) ZODB conflict error at /VirtualHostBase/https/XXX:443/cdks/VirtualHostRoot/heartbeat.txt (431 conflicts since startup at 2 004-08-26T15:50:14) ... ------ 2004-08-30T08:46:22 INFO(0) ZODB conflict error at /VirtualHostBase/https/XXX:443/cdks/VirtualHostRoot/heartbeat.txt (60082 conflicts since startup at 2004-08-26T15:50:14) ------ 2004-08-30T08:46:23 INFO(0) ZODB conflict error at /VirtualHostBase/https/XXX:443/cdks/VirtualHostRoot/heartbeat.txt (60083 conflicts since startup at 2004-08-26T15:50:14) -- ****** The only thing that helps at his point is restarting. Any ideas on what might be happening? And why I keep getting these conflict errors? Thanks, /dario -- -- ------------------------------------------------------------------- Dario Lopez-Kästen, IT Systems & Services Chalmers University of Tech.

3 2

UI improvement for catalog
by Christian Theune 31 Aug '04

31 Aug '04

Hi. I'm landing a small UI improvement for the ZCatalog ZMI interface. It let's you set a path filter to show catalog entries from, if a PathIndex called "path" exists. (This is created by default in CMF and Plone sites). Feedback is welcome. Theuni -- Christian Theune <ct(a)gocept.com> gocept gmbh & co. kg

2 1

how to start workflow instance on another zope server with SOAP?
by Aruna Kathiriya 31 Aug '04

31 Aug '04

Hi, I am very new to open source. I am trying to start an instance of a workflow on a Zope server from another Zope server. I did successfully with XML-RPC call but I need to do it with SOAP. I am note sure weather I can do it or not. I am running two Zope servers on my local m/c on 2 different ports. One is 8080 and 2nd one is 8090. On 8080: Page_template : SoapTest2 <html> <body> Activate instance at other server: <span tal:define= " l_user python:request.get('AUTHENTICATED_USER');"> <form action="SubmitNewSoapTest2" method="post" enctype="multipart/form-data"> <input type="file" name="p_file"><br> <input type="hidden" name="user" tal:attributes= "value python:l_user;"> <input type="hidden" name="password" value="Aruna"> <input type="submit" value="Submit"> </form> </span> </body> </html> SubmitNewSoapTest2 is external method. the python script for that is testTrigger as follow. from SOAPpy import SOAPProxy import xml.sax def startTestInstance2(self,p_file,user,password): myFile =p_file.read() # parser = xml.sax.make_parser() # parser.parse(myFile) url = 'http://localhost:8090/' namespace = 'urn:xmethods-testInstance' server = SOAPProxy(url, namespace) return server.SoapTestInstance(p_file,user,password) On 8090: I have a python script SoapTestInstance having 3 parameters (p_file,user,password) and following code. wf = context.TestFlow i_id = wf.addInstance('TestProcess', '', '', '', 0) instance = wf.getInstance(i_id) instance.manage_addFile(id="theFile", file=p_file, title="") wf.startInstance(i_id) wf.activateWorkitem(i_id, '0', user ) wf.completeWorkitem(i_id, '0') return "created new instance with code %s" % i_id It gives me following error. Error Type: SAXParseException Error Value: http://www.w3.org/TR/REC-html40/loose.dtd:31:2: error in processing external entity reference Any help will be appriciated. I already stucked here.. Aruna Kathiriya Sr.Consultant CIGNEX Technologies, Inc U: www.cignex.com "Implement IT Right"

2 1