Zope is not handling correct XML-RPC request. Even the example from http://www.zope.org/Members/Amos/XML-RPC is not working. Even worst if a request like this one in the quoted example is send to the web server it will report information about the local server installation and the internal network. Included are a request and response to www.zope.org. As one may see the server is installed in /usr/local/base/Zope-2.3.2-modified/ and it rely on 10.0.11.3:1380 for request processing. All this may be useful debug information but it is not acceptable for a production server! I'm not familiar with Zope and I cannot say is it only a configuration problem or it is a problem in the code. I do not have time to investigate that but a similar result may be achieved with the distribution offered for download. Please let me know if I have to send this bug information to some one else. I would like to be informed and when this issue is resolved so I can announce it on Bug-Traq. Regards, Rossen Raykov <cut here> $ telnet www.zope.org 80 Trying 63.102.49.33... Connected to www.zope.org. Escape character is '^]'. POST /Foo/Bar/MyFolder HTTP/1.0 Content-Type: text/xml Content-length: 95 <?xml version="1.0"?> <methodCall> <methodName>objectIds</methodName> <params/> </methodCall> HTTP/1.0 500 Internal Server Error Server: Zope/Zope 2.3.2 (source release, python 1.5.2, linux2) ZServer/1.1b1 Date: Sat, 23 Mar 2002 03:09:14 GMT Bobo-Exception-File: /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py Content-Type: text/html Bobo-Exception-Type: RuntimeError Bobo-Exception-Value: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"<HTML> <HEAD <TITLE>Welcometo Zope.org</TITLE <link rel="stylesheet" href="http://10.0.11.3:1380/zope_css" type="text/css" </HEAD <BOD Content-Length: 6864 Bobo-Exception-Line: 748 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <HTML> <HEAD> <TITLE>Welcome to Zope.org</TITLE> <link rel="stylesheet" href="http://10.0.11.3:1380/zope_css" type="text/css"> </HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#000066" VLINK="#606060" TOPMARGIN="0" LEFTMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0"> <BASEFONT FACE="Verdana, Arial, Helvetica, sans-serif" SIZE="2"> <TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0" > <TR> <TD WIDTH="10" BGCOLOR="#6699cc" ALIGN=CENTER> </TD> <TD COLSPAN="2" BGCOLOR="#6699CC" VALIGN="TOP" WIDTH="165"><A HREF="/"><IMGSRC="/Images/zopecom.gif" ALT="Zope" ALIGN="ABSMIDDLE" WIDTH="150" HEIGHT="63" BORDER="0"></A></TD> <TD BGCOLOR="#6699CC" VALIGN="TOP" ALIGN="RIGHT" xWIDTH="99%" CLASS="welcome"> <p class="welcome"> <a class="globalmenu" href="http://www.zope.com">Business Services</A> | <A CLASS="globalmenu" HREF="/SiteIndex/searchForm">Search</A> | <a CLASS="globalmenu" href="/Products">Download</a> | <a CLASS="globalmenu" href="/Documentation">Documentation</a> | <a CLASS="globalmenu" href="/Resources">Resources</a> | <a class="globalmenu" href="http://dev.zope.org">Development</a> <BR> <FORM ACTION="/SiteIndex/search" METHOD="GET" name="search"> Search <INPUT TYPE="text" NAME="text_content" SIZE="15"> <INPUT TYPE="IMAGE" SRC="/Images/go.gif" ALT="Go Button!" ALIGN="ABSMIDDLE" BORDER="0" WIDTH="20" HEIGHT="20"> </FORM> </p> </TD> <TD WIDTH="10" BGCOLOR="#6699CC" ALIGN="RIGHT" VALIGN="BOTTOM"><IMG SRC="/Images/blue-rounder1.gif" WIDTH="14" HEIGHT="20" BORDER="0"></TD> </TR> <TR> <TD WIDTH="10" BGCOLOR="#6699cc"> </td> <TD WIDTH="150" BGCOLOR="#6699CC" VALIGN=TOP> <H2 CLASS="lefttitle"> Guest</H2> <p class="sidemenu"> <A CLASS="sidemenu" HREF="/Register/register.html">Join Zope.org</A> <BR> <A CLASS="sidemenu" HREF="/login.html?came_from=http://10.0.11.3:1380">Log in</A> </p> <HR NOSHADE SIZE="0.5" WIDTH="95%"> <H2 CLASS="lefttitle"> Zope Exits</H2> <p class="sidemenu"> <A CLASS="sidemenu" HREF="http://dev.zope.org/">dev.zope.org</A><BR> <A CLASS="sidemenu" HREF="http://cmf.zope.org/">CMF Dogbowl</A><BR> <A CLASS="sidemenu" HREF="http://collector.zope.org/Zope">Zope Collector</A><BR> <A CLASS="sidemenu" HREF="http://cvs.zope.org/">Zope CVS</A><BR> <A CLASS="sidemenu" HREF="http://www.zopezen.org/">ZopeZen</A><BR> <A CLASS="sidemenu" HREF="http://www.zopenewbies.net/">Zope Newbies</A><BR> <a class="sidemenu" href="http://www.zopelabs.com/">Zope Labs</a><br /> <A CLASS="sidemenu" HREF="http://www.eurozope.org/">EuroZope</A><BR> <A CLASS="sidemenu" HREF="http://www.zopera.org/">Zopera</A><BR> <A CLASS="sidemenu" HREF="http://zdp.zope.org">ZDP</A><BR> <A CLASS="sidemenu" HREF="http://www.freezope.org">FreeZope</A><BR> <a CLASS="sidemenu" href="http://www.nipltd.net/Free">NIP Free Zope Hosting</a> </p> <HR NOSHADE SIZE="0.5" WIDTH="95%"> <p><a href="http://www.amazon.com/exec/obidos/ASIN/0735711372/zopeorg-20"> <img src="http://www.zope.org/Images/zopebook.png" alt="The Zope Book" height="140" width="109" border="0" /></a> </p> <p><a href="http://python.org/" alt="Python Powered!" ><img src="http://www.zope.org/Images/python.gif" border="0"></a></p> </TD> <TD COLSPAN="2" VALIGN=TOP> <table cellpadding="10" cellspacing="0" border="0" width="100%"> <tr valign="top"> <td> <TABLE BORDER="0" WIDTH="100%"> <TR> <TD WIDTH="10%" ALIGN="CENTER"> <STRONG><FONT SIZE="+6" COLOR="#77003B">!</FONT></STRONG> </TD> <TD WIDTH="90%"><BR> <FONT SIZE="+2">System Unavailable</FONT> <P>This site is currently experiencing technical difficulties. Please contact the site administrator for more information. For additional technical information, please refer to the HTML source for this page. Thank you for your patience.</P> </TD> </TR> </TABLE> <pre> Error type: RuntimeError Error value: Syntax error at line 5: bogus `<' </pre> <p align="center"> <form> <input type="button" value="More Information..." onClick='window.location = "view-source:" + window.location.href'> </form> </p> </td> </tr> </table> </TD> <TD WIDTH="10" ALIGN=CENTER> </TD> </TR> <TR><TD WIDTH="10" BGCOLOR="#6699cc"ALIGN=CENTER> </TD> <TD WIDTH="150" BGCOLOR="#6699CC" ALIGN=RIGHT VALIGN=BOTTOM><IMG SRC="/Images/blue-rounder2.gif" WIDTH="142" HEIGHT="20" BORDER="0" ALT=""></TD> <TD COLSPAN="2" ALIGN=CENTER CLASS="plain"><HR NOSHADE SIZE="0" WIDTH="95%"> <a href="/privacy.html">Privacy policy</a> <A HREF="http://10.0.11.3:1380?pp=1">Printable Page</A> <A HREF="/Members//feedback_form?came_from=http://10.0.11.3:1380">Feedback to this page's author</a> <A HREF="http://10.0.11.3:1380/feedback_site_form?whats_up=Welcome%20to%20Zope. org&origin_url=http://10.0.11.3:1380">Feedback about Zope.org</A> <A HREF="http://10.0.11.3:1380/view_source">DTML Source</A> </TD> <TD WIDTH="10" ALIGN=CENTER> </TD> </TR> <TR> <TD WIDTH="10"> </TD> <TD WIDTH="150"> <p style="font-size: 60%; color: #cfcfcf;">served by app2</p></TD> <TD WIDTH="150"> </TD> <TD> </TD> <TD WIDTH="10"> </TD> </TR> </TABLE> <P CLASS="copyright">© 2002 <a href="http://www.zope.com/">Zope Corporation</aAll rights reserved.</P> </BODY> </HTML> <!-- Traceback (innermost last): File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 187, in publish File /usr/local/base/Zope-2.3.2-modified/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: ApplicationDefaultPermissions) File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 136, in publish File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/HTTPRequest.py, line 414, in processInputs File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/xmlrpc.py, line 120, in parse_input File /usr/local/base/Zope-2.3.2-modified/lib/python/xmlrpclib.py, line 531, in loads File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 153, in close File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 365, in goahead File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 748, in syntax_error RuntimeError: (see above) --> Connection closed by foreign host. _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
You are running Zope in debug mode (with the -D switch in the "start" file). This is the default. Please try running Zope in non-debug mode (remove the -D switch) and try this again. ----- Original Message ----- From: "Rossen Raykov" <raikovr@yahoo.com> To: <zope-dev@zope.org> Cc: <klm@zope.com>; <zope@zope.org> Sent: Tuesday, April 02, 2002 2:33 PM Subject: [Zope] isecure XML-RPC handling.
Zope is not handling correct XML-RPC request.
Even the example from http://www.zope.org/Members/Amos/XML-RPC is not working.
Even worst if a request like this one in the quoted example is send to the web server it will report information about the local server installation and the internal network.
Included are a request and response to www.zope.org.
As one may see the server is installed in /usr/local/base/Zope-2.3.2-modified/ and it rely on 10.0.11.3:1380 for request processing.
All this may be useful debug information but it is not acceptable for a production server!
I'm not familiar with Zope and I cannot say is it only a configuration problem or it is a problem in the code.
I do not have time to investigate that but a similar result may be achieved with the distribution offered for download.
Please let me know if I have to send this bug information to some one else.
I would like to be informed and when this issue is resolved so I can announce it on Bug-Traq.
Regards, Rossen Raykov
<cut here> $ telnet www.zope.org 80 Trying 63.102.49.33... Connected to www.zope.org. Escape character is '^]'. POST /Foo/Bar/MyFolder HTTP/1.0 Content-Type: text/xml Content-length: 95
<?xml version="1.0"?> <methodCall> <methodName>objectIds</methodName> <params/> </methodCall>
HTTP/1.0 500 Internal Server Error Server: Zope/Zope 2.3.2 (source release, python 1.5.2, linux2) ZServer/1.1b1 Date: Sat, 23 Mar 2002 03:09:14 GMT Bobo-Exception-File: /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py Content-Type: text/html Bobo-Exception-Type: RuntimeError Bobo-Exception-Value: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"<HTML> <HEAD <TITLE>Welcometo Zope.org</TITLE <link rel="stylesheet" href="http://10.0.11.3:1380/zope_css" type="text/css" </HEAD <BOD Content-Length: 6864 Bobo-Exception-Line: 748
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <HTML> <HEAD> <TITLE>Welcome to Zope.org</TITLE> <link rel="stylesheet" href="http://10.0.11.3:1380/zope_css" type="text/css">
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#000066" VLINK="#606060" TOPMARGIN="0" LEFTMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0"> <BASEFONT FACE="Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0" > <TR> <TD WIDTH="10" BGCOLOR="#6699cc" ALIGN=CENTER> </TD> <TD COLSPAN="2" BGCOLOR="#6699CC" VALIGN="TOP" WIDTH="165"><A HREF="/"><IMGSRC="/Images/zopecom.gif" ALT="Zope" ALIGN="ABSMIDDLE" WIDTH="150" HEIGHT="63" BORDER="0"></A></TD> <TD BGCOLOR="#6699CC" VALIGN="TOP" ALIGN="RIGHT" xWIDTH="99%" CLASS="welcome"> <p class="welcome"> <a class="globalmenu" href="http://www.zope.com">Business Services</A> | <A CLASS="globalmenu" HREF="/SiteIndex/searchForm">Search</A> | <a CLASS="globalmenu" href="/Products">Download</a> | <a CLASS="globalmenu" href="/Documentation">Documentation</a> | <a CLASS="globalmenu" href="/Resources">Resources</a> | <a class="globalmenu" href="http://dev.zope.org">Development</a> <BR>
<FORM ACTION="/SiteIndex/search" METHOD="GET" name="search"> Search <INPUT TYPE="text" NAME="text_content" SIZE="15"> <INPUT TYPE="IMAGE" SRC="/Images/go.gif" ALT="Go Button!" ALIGN="ABSMIDDLE" BORDER="0" WIDTH="20" HEIGHT="20"> </FORM> </p> </TD> <TD WIDTH="10" BGCOLOR="#6699CC" ALIGN="RIGHT" VALIGN="BOTTOM"><IMG SRC="/Images/blue-rounder1.gif" WIDTH="14" HEIGHT="20" BORDER="0"></TD> </TR>
<TR> <TD WIDTH="10" BGCOLOR="#6699cc"> </td>
<TD WIDTH="150" BGCOLOR="#6699CC" VALIGN=TOP> <H2 CLASS="lefttitle"> Guest</H2> <p class="sidemenu"> <A CLASS="sidemenu" HREF="/Register/register.html">Join Zope.org</A> <BR> <A CLASS="sidemenu" HREF="/login.html?came_from=http://10.0.11.3:1380">Log in</A> </p>
<HR NOSHADE SIZE="0.5" WIDTH="95%">
<H2 CLASS="lefttitle"> Zope Exits</H2> <p class="sidemenu"> <A CLASS="sidemenu" HREF="http://dev.zope.org/">dev.zope.org</A><BR> <A CLASS="sidemenu" HREF="http://cmf.zope.org/">CMF Dogbowl</A><BR> <A CLASS="sidemenu" HREF="http://collector.zope.org/Zope">Zope Collector</A><BR> <A CLASS="sidemenu" HREF="http://cvs.zope.org/">Zope CVS</A><BR> <A CLASS="sidemenu" HREF="http://www.zopezen.org/">ZopeZen</A><BR> <A CLASS="sidemenu" HREF="http://www.zopenewbies.net/">Zope Newbies</A><BR> <a class="sidemenu" href="http://www.zopelabs.com/">Zope Labs</a><br /> <A CLASS="sidemenu" HREF="http://www.eurozope.org/">EuroZope</A><BR> <A CLASS="sidemenu" HREF="http://www.zopera.org/">Zopera</A><BR> <A CLASS="sidemenu" HREF="http://zdp.zope.org">ZDP</A><BR> <A CLASS="sidemenu" HREF="http://www.freezope.org">FreeZope</A><BR> <a CLASS="sidemenu" href="http://www.nipltd.net/Free">NIP Free Zope Hosting</a>
</p> <HR NOSHADE SIZE="0.5" WIDTH="95%">
<p><a href="http://www.amazon.com/exec/obidos/ASIN/0735711372/zopeorg-20"> <img src="http://www.zope.org/Images/zopebook.png" alt="The Zope Book" height="140" width="109" border="0" /></a> </p>
<p><a href="http://python.org/" alt="Python Powered!" ><img src="http://www.zope.org/Images/python.gif" border="0"></a></p> </TD> <TD COLSPAN="2" VALIGN=TOP> <table cellpadding="10" cellspacing="0" border="0" width="100%"> <tr valign="top"> <td>
<TABLE BORDER="0" WIDTH="100%"> <TR> <TD WIDTH="10%" ALIGN="CENTER"> <STRONG><FONT SIZE="+6" COLOR="#77003B">!</FONT></STRONG> </TD> <TD WIDTH="90%"><BR> <FONT SIZE="+2">System Unavailable</FONT> <P>This site is currently experiencing technical difficulties. Please contact the site administrator for more information. For additional technical information, please refer to the HTML source for this page. Thank you for your patience.</P> </TD> </TR> </TABLE> <pre> Error type: RuntimeError Error value: Syntax error at line 5: bogus `<' </pre> <p align="center"> <form> <input type="button" value="More Information..." onClick='window.location = "view-source:" + window.location.href'> </form> </p>
</td> </tr> </table>
</TD> <TD WIDTH="10" ALIGN=CENTER> </TD> </TR> <TR><TD WIDTH="10" BGCOLOR="#6699cc"ALIGN=CENTER> </TD> <TD WIDTH="150" BGCOLOR="#6699CC" ALIGN=RIGHT VALIGN=BOTTOM><IMG SRC="/Images/blue-rounder2.gif" WIDTH="142" HEIGHT="20" BORDER="0" ALT=""></TD> <TD COLSPAN="2" ALIGN=CENTER CLASS="plain"><HR NOSHADE SIZE="0" WIDTH="95%"> <a href="/privacy.html">Privacy policy</a>
<A HREF="http://10.0.11.3:1380?pp=1">Printable Page</A>
<A HREF="/Members//feedback_form?came_from=http://10.0.11.3:1380">Feedback to this page's author</a>
<A
HREF="http://10.0.11.3:1380/feedback_site_form?whats_up=Welcome%20to%20Zope.
org&origin_url=http://10.0.11.3:1380">Feedback about Zope.org</A>
<A HREF="http://10.0.11.3:1380/view_source">DTML Source</A>
</TD> <TD WIDTH="10" ALIGN=CENTER> </TD> </TR> <TR> <TD WIDTH="10"> </TD> <TD WIDTH="150"> <p style="font-size: 60%; color: #cfcfcf;">served by app2</p></TD> <TD WIDTH="150"> </TD> <TD> </TD> <TD WIDTH="10"> </TD> </TR> </TABLE>
<P CLASS="copyright">© 2002 <a href="http://www.zope.com/">Zope Corporation</aAll rights reserved.</P>
</BODY> </HTML>
<!-- Traceback (innermost last): File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 187, in publish File /usr/local/base/Zope-2.3.2-modified/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: ApplicationDefaultPermissions) File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 136, in publish File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/HTTPRequest.py, line 414, in processInputs File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/xmlrpc.py, line 120, in parse_input File /usr/local/base/Zope-2.3.2-modified/lib/python/xmlrpclib.py, line 531, in loads File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 153, in close File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 365, in goahead File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 748, in syntax_error RuntimeError: (see above)
--> Connection closed by foreign host.
_________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
he's testing against zope.org and the traceback is enclosed html comments, which probably does mean it is debug mode. as for the concerns... i leave that to others. -k On Tuesday 02 April 2002 12:18 pm, Chris McDonough wrote:
You are running Zope in debug mode (with the -D switch in the "start" file). This is the default. Please try running Zope in non-debug mode (remove the -D switch) and try this again.
----- Original Message ----- From: "Rossen Raykov" <raikovr@yahoo.com> To: <zope-dev@zope.org> Cc: <klm@zope.com>; <zope@zope.org> Sent: Tuesday, April 02, 2002 2:33 PM Subject: [Zope] isecure XML-RPC handling.
Zope is not handling correct XML-RPC request.
Even the example from http://www.zope.org/Members/Amos/XML-RPC is not working.
Even worst if a request like this one in the quoted example is send to the web server it will report information about the local server installation and the internal network.
Included are a request and response to www.zope.org.
As one may see the server is installed in /usr/local/base/Zope-2.3.2-modified/ and it rely on 10.0.11.3:1380 for request processing.
All this may be useful debug information but it is not acceptable for a production server!
I'm not familiar with Zope and I cannot say is it only a configuration problem or it is a problem in the code.
I do not have time to investigate that but a similar result may be
achieved
with the distribution offered for download.
Please let me know if I have to send this bug information to some one
else.
I would like to be informed and when this issue is resolved so I can announce it on Bug-Traq.
Regards, Rossen Raykov
<cut here> $ telnet www.zope.org 80 Trying 63.102.49.33... Connected to www.zope.org. Escape character is '^]'. POST /Foo/Bar/MyFolder HTTP/1.0 Content-Type: text/xml Content-length: 95
<?xml version="1.0"?> <methodCall> <methodName>objectIds</methodName> <params/> </methodCall>
HTTP/1.0 500 Internal Server Error Server: Zope/Zope 2.3.2 (source release, python 1.5.2, linux2)
The problem here seems to be that you are trying to do XML-RPC communication with a version of Zope that doesn't support XML-RPC out of the box. You should use a version >= 2.4.0 to get this to work. From the output you sent below, it looks like you're trying to invoke an RPC method call against Zope.org? As far as I can tell, Zope.org (for some odd reason) is STILL running on that very same version -> Zope/Zope 2.3.2 (source release, python 1.5.2, linux2) ZServer/1.1b1 on Linux, so is not XML-RPC enabled, either. Trying to invoke a request will return a site error. On that thought, I'd like to see Zope.org become much more modern, and reflect the *latest* and *greatest* functionality of Zope. Deprecation of the hybrid PTK that's used, as well as updating and polishing of the site regularly. In fact, I'd like to see more of a portal feel to it, that's both personalized and customized to my needs. For instance, log into my account, download 2.5.1b1, come back a week later and here's a big notice that beta2 is available for *my* setup. Also, can we see some Web services? Imagine, in the management interface, and visiting the Control Panel. There is an "Update" tab, which when loaded queries zope.org with the XML-RPC method "zope.webservices.getUpdates(my_install)", which passes in my server's version, installed products, etc. and lists updates, hotfixes, and other notices. With the flexibility and dynamic runtime nature of Python, i wonder how hard it would be to update a running server. Anybody working on this or interesting in seeing this kind of feature? I envision something along the lines of Redhat Network, WindowsUpdate, or Ximian Red Carpet. When visiting Zope.org, this information would be updated, so users would have profiles that store this data. This could be a great start to get new.zope.org up and running. Sounds like I'm volunteering myself if it creates a large demand... :^) Eron On Tuesday 02 April 2002 02:33 pm, Rossen Raykov wrote:
Zope is not handling correct XML-RPC request.
Even the example from http://www.zope.org/Members/Amos/XML-RPC is not working.
Even worst if a request like this one in the quoted example is send to the web server it will report information about the local server installation and the internal network.
Included are a request and response to www.zope.org.
As one may see the server is installed in /usr/local/base/Zope-2.3.2-modified/ and it rely on 10.0.11.3:1380 for request processing.
All this may be useful debug information but it is not acceptable for a production server!
I'm not familiar with Zope and I cannot say is it only a configuration problem or it is a problem in the code.
I do not have time to investigate that but a similar result may be achieved with the distribution offered for download.
Please let me know if I have to send this bug information to some one else.
I would like to be informed and when this issue is resolved so I can announce it on Bug-Traq.
Regards, Rossen Raykov
<cut here> $ telnet www.zope.org 80 Trying 63.102.49.33... Connected to www.zope.org. Escape character is '^]'. POST /Foo/Bar/MyFolder HTTP/1.0 Content-Type: text/xml Content-length: 95
<?xml version="1.0"?> <methodCall> <methodName>objectIds</methodName> <params/> </methodCall>
HTTP/1.0 500 Internal Server Error Server: Zope/Zope 2.3.2 (source release, python 1.5.2, linux2) ZServer/1.1b1 Date: Sat, 23 Mar 2002 03:09:14 GMT Bobo-Exception-File: /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py Content-Type: text/html Bobo-Exception-Type: RuntimeError Bobo-Exception-Value: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"<HTML> <HEAD <TITLE>Welcometo Zope.org</TITLE <link rel="stylesheet" href="http://10.0.11.3:1380/zope_css" type="text/css" </HEAD <BOD Content-Length: 6864 Bobo-Exception-Line: 748
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <HTML> <HEAD> <TITLE>Welcome to Zope.org</TITLE> <link rel="stylesheet" href="http://10.0.11.3:1380/zope_css" type="text/css">
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#000066" VLINK="#606060" TOPMARGIN="0" LEFTMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0"> <BASEFONT FACE="Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0" > <TR> <TD WIDTH="10" BGCOLOR="#6699cc" ALIGN=CENTER> </TD> <TD COLSPAN="2" BGCOLOR="#6699CC" VALIGN="TOP" WIDTH="165"><A HREF="/"><IMGSRC="/Images/zopecom.gif" ALT="Zope" ALIGN="ABSMIDDLE" WIDTH="150" HEIGHT="63" BORDER="0"></A></TD> <TD BGCOLOR="#6699CC" VALIGN="TOP" ALIGN="RIGHT" xWIDTH="99%" CLASS="welcome"> <p class="welcome"> <a class="globalmenu" href="http://www.zope.com">Business Services</A>
| <A CLASS="globalmenu" HREF="/SiteIndex/searchForm">Search</A> | <a CLASS="globalmenu" href="/Products">Download</a> | <a CLASS="globalmenu" href="/Documentation">Documentation</a> | <a CLASS="globalmenu" href="/Resources">Resources</a> | <a class="globalmenu" href="http://dev.zope.org">Development</a>
<BR>
<FORM ACTION="/SiteIndex/search" METHOD="GET" name="search"> Search <INPUT TYPE="text" NAME="text_content" SIZE="15"> <INPUT TYPE="IMAGE" SRC="/Images/go.gif" ALT="Go Button!" ALIGN="ABSMIDDLE" BORDER="0" WIDTH="20" HEIGHT="20"> </FORM> </p> </TD> <TD WIDTH="10" BGCOLOR="#6699CC" ALIGN="RIGHT" VALIGN="BOTTOM"><IMG SRC="/Images/blue-rounder1.gif" WIDTH="14" HEIGHT="20" BORDER="0"></TD> </TR>
<TR> <TD WIDTH="10" BGCOLOR="#6699cc"> </td>
<TD WIDTH="150" BGCOLOR="#6699CC" VALIGN=TOP> <H2 CLASS="lefttitle"> Guest</H2> <p class="sidemenu"> <A CLASS="sidemenu" HREF="/Register/register.html">Join Zope.org</A> <BR> <A CLASS="sidemenu" HREF="/login.html?came_from=http://10.0.11.3:1380">Log in</A> </p>
<HR NOSHADE SIZE="0.5" WIDTH="95%">
<H2 CLASS="lefttitle"> Zope Exits</H2> <p class="sidemenu"> <A CLASS="sidemenu" HREF="http://dev.zope.org/">dev.zope.org</A><BR> <A CLASS="sidemenu" HREF="http://cmf.zope.org/">CMF Dogbowl</A><BR> <A CLASS="sidemenu" HREF="http://collector.zope.org/Zope">Zope Collector</A><BR> <A CLASS="sidemenu" HREF="http://cvs.zope.org/">Zope CVS</A><BR> <A CLASS="sidemenu" HREF="http://www.zopezen.org/">ZopeZen</A><BR> <A CLASS="sidemenu" HREF="http://www.zopenewbies.net/">Zope Newbies</A><BR> <a class="sidemenu" href="http://www.zopelabs.com/">Zope Labs</a><br /> <A CLASS="sidemenu" HREF="http://www.eurozope.org/">EuroZope</A><BR> <A CLASS="sidemenu" HREF="http://www.zopera.org/">Zopera</A><BR> <A CLASS="sidemenu" HREF="http://zdp.zope.org">ZDP</A><BR> <A CLASS="sidemenu" HREF="http://www.freezope.org">FreeZope</A><BR> <a CLASS="sidemenu" href="http://www.nipltd.net/Free">NIP Free Zope Hosting</a>
</p> <HR NOSHADE SIZE="0.5" WIDTH="95%">
<p><a href="http://www.amazon.com/exec/obidos/ASIN/0735711372/zopeorg-20"> <img src="http://www.zope.org/Images/zopebook.png" alt="The Zope Book" height="140" width="109" border="0" /></a> </p>
<p><a href="http://python.org/" alt="Python Powered!" ><img src="http://www.zope.org/Images/python.gif" border="0"></a></p> </TD> <TD COLSPAN="2" VALIGN=TOP> <table cellpadding="10" cellspacing="0" border="0" width="100%"> <tr valign="top"> <td>
<TABLE BORDER="0" WIDTH="100%"> <TR> <TD WIDTH="10%" ALIGN="CENTER"> <STRONG><FONT SIZE="+6" COLOR="#77003B">!</FONT></STRONG> </TD> <TD WIDTH="90%"><BR> <FONT SIZE="+2">System Unavailable</FONT> <P>This site is currently experiencing technical difficulties. Please contact the site administrator for more information. For additional technical information, please refer to the HTML source for this page. Thank you for your patience.</P> </TD> </TR> </TABLE> <pre> Error type: RuntimeError Error value: Syntax error at line 5: bogus `<' </pre> <p align="center"> <form> <input type="button" value="More Information..." onClick='window.location = "view-source:" + window.location.href'> </form> </p>
</td> </tr> </table>
</TD> <TD WIDTH="10" ALIGN=CENTER> </TD> </TR> <TR><TD WIDTH="10" BGCOLOR="#6699cc"ALIGN=CENTER> </TD> <TD WIDTH="150" BGCOLOR="#6699CC" ALIGN=RIGHT VALIGN=BOTTOM><IMG SRC="/Images/blue-rounder2.gif" WIDTH="142" HEIGHT="20" BORDER="0" ALT=""></TD> <TD COLSPAN="2" ALIGN=CENTER CLASS="plain"><HR NOSHADE SIZE="0" WIDTH="95%"> <a href="/privacy.html">Privacy policy</a>
<A HREF="http://10.0.11.3:1380?pp=1">Printable Page</A>
<A HREF="/Members//feedback_form?came_from=http://10.0.11.3:1380">Feedback to this page's author</a>
<A HREF="http://10.0.11.3:1380/feedback_site_form?whats_up=Welcome%20to%20Zope . org&origin_url=http://10.0.11.3:1380">Feedback about Zope.org</A>
<A HREF="http://10.0.11.3:1380/view_source">DTML Source</A>
</TD> <TD WIDTH="10" ALIGN=CENTER> </TD> </TR> <TR> <TD WIDTH="10"> </TD> <TD WIDTH="150"> <p style="font-size: 60%; color: #cfcfcf;">served by app2</p></TD> <TD WIDTH="150"> </TD> <TD> </TD> <TD WIDTH="10"> </TD> </TR> </TABLE>
<P CLASS="copyright">© 2002 <a href="http://www.zope.com/">Zope Corporation</aAll rights reserved.</P>
</BODY> </HTML>
<!-- Traceback (innermost last): File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 187, in publish File /usr/local/base/Zope-2.3.2-modified/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: ApplicationDefaultPermissions) File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/Publish.py, line 136, in publish File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/HTTPRequest.py, line 414, in processInputs File /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/xmlrpc.py, line 120, in parse_input File /usr/local/base/Zope-2.3.2-modified/lib/python/xmlrpclib.py, line 531, in loads File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 153, in close File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 365, in goahead File /var/tmp/python/python-root/usr/lib/python1.5/xmllib.py, line 748, in syntax_error RuntimeError: (see above)
--> Connection closed by foreign host.
_________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev ) --- [This E-mail scanned for viruses by Declude Virus]
[This E-mail scanned for viruses by Declude Virus]
On Tue, Apr 02, 2002 at 04:01:41PM -0500, Eron Lloyd wrote:
On that thought, I'd like to see Zope.org become much more modern, and reflect the *latest* and *greatest* functionality of Zope. Deprecation of the hybrid PTK that's used, as well as updating and polishing of the site regularly. In fact, I'd like to see more of a portal feel to it, that's both personalized and customized to my needs. For instance, log into my account, download 2.5.1b1, come back a week later and here's a big notice that beta2 is available for *my* setup. Also, can we see some Web services? Imagine, in the management interface, and visiting the Control Panel. There is an "Update" tab, which when loaded queries zope.org with the XML-RPC method "zope.webservices.getUpdates(my_install)", which passes in my server's version, installed products, etc. and lists updates, hotfixes, and other notices. With the flexibility and dynamic runtime nature of Python, i wonder how hard it would be to update a running server.
Head over to zope-web@zope.org and help out then; the effort to build a new zope.org is already well under way. -- Martijn Pieters | Software Engineer mailto:mj@zope.com | Zope Corporation http://www.zope.com/ | Creators of Zope http://www.zope.org/ ---------------------------------------------
On Tue, 2 Apr 2002, Eron Lloyd wrote:
The problem here seems to be that you are trying to do XML-RPC communication with a version of Zope that doesn't support XML-RPC out of the box. You
I think most people missed the point here. I don't think Rossen is asking for help on running zope or getting xml-rpc to work with it. He's observed a "security" problem: he believes the fact that a traceback including path names is included in the error response is a security exposure. This has been discussed on zope-dev before, but the fact remains that the security community *does* treat exposure of filesystem path information as a security issue. I believe the addition of the variable to control what happens with tracebacks addresses this issue from a security standpoint, which is probably all that Rossen cares about with regards to letting bugtraq know that "the security bug has been fixed". The fact that zope.org itself is still "insecure" in this sense may also be an issue, but not one that is going to get addressed before the new zope.org goes online. --RDM
I think most people missed the point here. I don't think Rossen is asking for help on running zope or getting xml-rpc to work with it. He's observed a "security" problem: he believes the fact that a traceback including path names is included in the error response is a security exposure. This has been discussed on zope-dev before, but the fact remains that the security community *does* treat exposure of filesystem path information as a security issue.
Right. There is already code for Zope 2.6 and Zope 3 that addresses this. Shane's new traceback formatting makes the trace information far more readable in addition to removing filesystem path information. Brian Lloyd brian@zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com
Hi all, My point was that Zope is revealing internal information that is believed to be private and invisible for the Internet users. It happens in its default (debug) installation and even after -D option is removed from the startup script. I try some XML-RPC requests against www.zope.org (2.3.2) and against the default 2.5.0 installation for Windows (with and without -D option). In both cases Zope was reviling the physical location of the distribution. In the case of www.zope.org it was reviling even information about it's internal network (this may be also possible in 2.5.0 but I do not have the time to create complicated enough configuration). In general Zope have not to reveal any physical information neither about it's installation nor about the internal network behind it. If you need to print traces - use relative paths to the server root. If the debug option is omitted - just print the error and do not print any stack dumps at all! People have to be aware that the default installation is in debug mode and the results of that. I believe many people will be surprised to learn that they are exposing information about their private networks and server setups. Finally two clarifications: 1. Zope 2.3.2 do support XML-RPC. Try example one against www.zope.org it will work just fine! 2. Zope Zope 2.5.0 in it's default installation (debug mode) still is revealing information about the physical location of the installed server. See the dump in example two. It is produced as a result of the XML-RPC example from my first e-mail. Regards, Rossen ------------ Example one --------------- POST /Foo/Bar/MyFolder HTTP/1.0 Content-Type: text/xml Content-length: 110 <?xml version='1.0'?> <methodCall> <methodName>title_or_id</methodName> <params> </params> </methodCall> ------------ Example two --------------- ... Bobo-Exception-File: C:\PROGRA~1\WebSite\bin\lib\xmllib.py ... Traceback (innermost last): File C:\PROGRA~1\WebSite\lib\python\ZPublisher\Publish.py, line 150, in publish_module File C:\PROGRA~1\WebSite\lib\python\ZPublisher\Publish.py, line 114, in publish File C:\PROGRA~1\WebSite\lib\python\Zope\__init__.py, line 158, in zpublisher_exception_hook (Object: Zope) File C:\PROGRA~1\WebSite\lib\python\ZPublisher\Publish.py, line 63, in publish File C:\PROGRA~1\WebSite\lib\python\ZPublisher\HTTPRequest.py, line 357, in processInputs File C:\PROGRA~1\WebSite\lib\python\ZPublisher\xmlrpc.py, line 47, in parse_input File C:\PROGRA~1\WebSite\lib\python\xmlrpclib.py, line 531, in loads File C:\PROGRA~1\WebSite\bin\lib\xmllib.py, line 172, in close File C:\PROGRA~1\WebSite\bin\lib\xmllib.py, line 405, in goahead File C:\PROGRA~1\WebSite\bin\lib\xmllib.py, line 794, in syntax_error Error: (see above) ----- Original Message ----- From: "Brian Lloyd" <brian@zope.com> To: "R. David Murray" <bitz@bitdance.com>; <zope-dev@zope.org> Cc: "Rossen Raykov" <raikovr@yahoo.com> Sent: Wednesday, April 03, 2002 12:20 PM Subject: RE: [Zope-dev] Re: [Zope] isecure XML-RPC handling.
I think most people missed the point here. I don't think Rossen is asking for help on running zope or getting xml-rpc to work with it. He's observed a "security" problem: he believes the fact that a traceback including path names is included in the error response is a security exposure. This has been discussed on zope-dev before, but the fact remains that the security community *does* treat exposure of filesystem path information as a security issue.
Right. There is already code for Zope 2.6 and Zope 3 that addresses this. Shane's new traceback formatting makes the trace information far more readable in addition to removing filesystem path information.
Brian Lloyd brian@zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com
_________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
Rossen Raykov wrote:
My point was that Zope is revealing internal information that is believed to be private and invisible for the Internet users. It happens in its default (debug) installation and even after -D option is removed from the startup script.
Rossen and others interested in tracebacks, If you can, please check out the latest Zope from CVS. Tracebacks no longer appear by default, and even when they do, they do not show any filesystem paths. (If you already have a checkout, make sure you use "cvs up -dP" to get the new product.) To see tracebacks, add a "Site Error Log" to your Zope. After an exception has occurred, visit it (it's called error_log). It will let you see the site errors that have occurred recently. Shane
Shane Hathaway writes:
If you can, please check out the latest Zope from CVS. Tracebacks no longer appear by default, and even when they do, they do not show any filesystem paths. (If you already have a checkout, make sure you use "cvs up -dP" to get the new product.) I am very interested in filesystem paths, not necessary absolute ones but relative pathnames are very helpful to locate a problem.
Dieter
There are two completely different things: 1. the server log 2. the output to the client. In the first case you may log everything that you thing it is reasonable - stack traces and dumps, relative and absolute paths, etc. It can may be assumed that is secure since in general it is not accessible out of the box. My personal opinion is that even this log have to differ if -D (debug option) is misplayed. In the second case it is better if Zope is returning just the error or the response. In the XML-RPC case the error have to be a valid XML-RPC response, not a stack trace. I can get that a stack trace may be extremely useful for a developer but cant he see the server's error log? BW if a program is expecting XML-RPC response but it is receiving stack trace it may be a little confusing (especially for a not so well written program ;). Zope first have to conform the protocol for XML-RPC exchange (return XML response) and after that to sweet the developers (dump error in the server's log). Regards, Rossen ----- Original Message ----- From: "Dieter Maurer" <dieter@handshake.de> To: "Shane Hathaway" <shane@zope.com> Cc: "Rossen Raykov" <raikovr@yahoo.com>; <zope-dev@zope.org> Sent: Thursday, April 04, 2002 2:55 PM Subject: Re: [Zope-dev] Re: [Zope] isecure XML-RPC handling.
Shane Hathaway writes:
If you can, please check out the latest Zope from CVS. Tracebacks no longer appear by default, and even when they do, they do not show any filesystem paths. (If you already have a checkout, make sure you use "cvs up -dP" to get the new product.) I am very interested in filesystem paths, not necessary absolute ones but relative pathnames are very helpful to locate a problem.
Dieter
_________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
Rossen Raykov writes:
... 1. the server log 2. the output to the client. ... In the second case it is better if Zope is returning just the error or the response. In the XML-RPC case the error have to be a valid XML-RPC response, not a stack trace. Thus, this may mean an exception with an XML-quoted stack trace. I can get that a stack trace may be extremely useful for a developer but cant he see the server's error log? There are two reasons, I prefer the stack trace in the response:
* the immediate correspondence between the request and the response containing essential information to analyse the problem * newbies Even with the stack trace immediately in the response, they report problems with no or missing essential details about the problem. This will become worse when the error information is hidden in a log.
BW if a program is expecting XML-RPC response but it is receiving stack trace it may be a little confusing (especially for a not so well written program ;). Zope first have to conform the protocol for XML-RPC exchange (return XML response) and after that to sweet the developers (dump error in the server's log). Okay!
Dieter
* the immediate correspondence between the request and the response containing essential information to analyse the problem
It's application problem and the application have to handle it. Log all the request/responses on the server or the client side.
* newbies
They have nothing to do in a production environment don't they?
Even with the stack trace immediately in the response, they report problems with no or missing essential details about the problem.
Then how one can help there?
This will become worse when the error information is hidden in a log.
The point is that production differ from development environment. In the development environment on can do whatever he needs. In a production environment reporting information as physical path on the server, internal network addresses etc. is unexceptable. Look at it from a different prospective: Someone is browsing Internet and a site is responding like: Microsoft OLE DB Provider for ODBC Drivers error '80040e14' [Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the keyword 'or'. /login.asp, line 11 Couple scenarios: 1. If he is a regular user he will go to the next site and most probably will never come back to that site again. 2. If he is tester or developer - oops the code have problem we have to fix it. 3. If he is intruder then "Bingo!" the site have problems escaping special characters before to pass them to the SQL server! Let's have a party! The situation with Zope is similar. Shall the dump help the regular surfer? I doubt so. Shall it benefit the developer or the tester? Most probably not since they are not performing their activities on the production site. Shall it benefit third parity developers that are requesting services from you site? May be particular, since they can report the stack to you, but you may get that information from you log any way. Since they can not control the code on you side this will not make their live easier.. The only left is the intruder! The conclusion is make the server not to dump the stack in the response if -D option does not imply. With -D dump the processor registers if you would like ;) People have to be able to control this and if there is more precise control like debug level - then it is even better.
BW if a program is expecting XML-RPC response but it is receiving stack trace it may be a little confusing (especially for a not so well
written
program ;). Zope first have to conform the protocol for XML-RPC exchange (return XML response) and after that to sweet the developers (dump error in the server's log). Okay!
Dieter
Regards, Rossen _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
From: "Rossen Raykov" <raikovr@yahoo.com>
Shall the dump help the regular surfer? I doubt so.
Shall it benefit the developer or the tester? Most probably not since they are not performing their activities on the production site.
Oh, they most definitely help the developer or tester, because errors do appear on production sites too, and it can be very hard to recreate the problem. BUT: The developer has access to the system, and the dump doesn't have to be included in the HTML output. Maybe error dumps could be sent to a disk-log of some sort?
Shall the dump help the regular surfer? I doubt so.
Shall it benefit the developer or the tester? Most probably not since they are not performing their activities on the production site.
Oh, they most definitely help the developer or tester, because errors do appear on production sites too, and it can be very hard to recreate the problem.
The only one problem there is that if a surfer sees the dump most probably he will not send it to the developer....
BUT: The developer has access to the system, and the dump doesn't have to
be
included in the HTML output. Maybe error dumps could be sent to a disk-log of some sort?
Exactly that's my point. Log it with as many details as you can! Log it on the local file system or use syslog or a database but do not send it to the users browser. Do not put it in the response if the server is running without -D option. Regards, Rossen _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
On Sat, 6 Apr 2002, Rossen Raykov wrote:
BUT: The developer has access to the system, and the dump doesn't have to be included in the HTML output. Maybe error dumps could be sent to a disk-log of some sort?
Exactly that's my point. Log it with as many details as you can!
From what he says, Shane's new "better tracebacks" code, which I believe will be in 2.6, does the equivalent of this.
--RDM
Rossen Raykov writes:
* the immediate correspondence between the request and the response containing essential information to analyse the problem
It's application problem and the application have to handle it. Log all the request/responses on the server or the client side. It's a standard problem, I wish the framework provides a solution (as it did up to now).
* newbies
They have nothing to do in a production environment don't they? I speak about debug mode!
It may or may not have something to do in production environment.
Even with the stack trace immediately in the response, they report problems with no or missing essential details about the problem.
Then how one can help there? We try our best.
One of the most essential features is an immediate feedback upon problems with easy access to the information that may help to analyse the problem.
... The point is that production differ from development environment. In the development environment on can do whatever he needs. In a production environment reporting information as physical path on the server, internal network addresses etc. is unexceptable. I am with you to say that in "non-debug" mode, such information should not be exposed.
However, I think that debug mode can even in a production environment be necessary under some circumstances. I do not need internal port information, network addresses of absolute path, but I may need other (more sensible) information about the problem.
....
The conclusion is make the server not to dump the stack in the response if -D option does not imply. Okay!
With -D dump the processor registers if you would like ;) I won't ;-), it's not the adequate abstraction level.
Dieter
participants (10)
-
Brian Lloyd -
Chris McDonough -
Dieter Maurer -
Eron Lloyd -
kapil thangavelu -
Lennart Regebro -
Martijn Pieters -
R. David Murray -
Rossen Raykov -
Shane Hathaway