July 1999 - Zope - Zope lists

RE: [Zope] Re: [Zope-dev] Introspection, managing External Method s?
by Michel Pelletier 20 Jul '99

20 Jul '99

> -----Original Message----- > From: Andreas Kostyrka [mailto:andreas@mtg.co.at] > Sent: Tuesday, July 20, 1999 9:44 AM > To: Robin Becker > Cc: zope(a)zope.org > Subject: Re: [Zope] Re: [Zope-dev] Introspection, managing External > Methods? > > > ad 3) Ok, changing the standard superuser password is > natural. Perhaps it > should be random generated. For releases, it is. CVS checkouts get the standard password for our own sanity. > Again, Monitor access is equivalent with Unix login level access. The > shell just happens to be called python, not /bin/sh ;) > Also, for general knowledge, the monitor server by defalt only listens on the localhost interface, network access is disabled by default. Turning it on would be pretty dangerous. -Michel > Andreas > -- > Win95: n., A huge annoying boot virus that causes random > spontaneous system > crashes, usually just before saving a massive project. > Easily cured by > UNIX. See also MS-DOS, IBM-DOS, DR-DOS, Win 3.x, Win98. > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

2 1

Re: [Zope] Re: [Zope-dev] Introspection, managing External Methods?
by michel＠digicool.com 20 Jul '99

20 Jul '99

Robin Becker <robin(a)jessikat.demon.co.uk> writes: > In article <199907181357.XAA01659(a)mbuna.arbhome.com.au>, Anthony Baxter > <anthony(a)interlink.com.au> writes > > > >This has come up on a number of occasions - the problem is that an > >external method can subvert all the protections and access control > >that Zope provides. > > > >Having said that, there's nothing stopping you (or someone else) > >writing an external method that allows you to edit external methods. :) > > > >Anthony > > > Yes I know that external methods can do anything. But since the manager > can destroy the site what's wrong with allowing editing only for the > manager. I realise that malicious managers could wipe the hard disk if > the manager user could, but then so can the manager sitting at the > console. > The problem here is that Zope can have many concepts of a 'manager'. Someone you trust with managerial rights in /some/backwater/zope/folder is as much a 'manager' as a top level manager, only restricted in place, not permission. If you give a user the 'Manager' role, they will have the permission to 'Edit External Methods' unless you explicitly turn it off. Another reason is that HTTP is not the World's Most Secure Protocol. In fact, HTTP Basic authentication is downright scary. Remember, external methods can do more than just whack your site, they can do anything to the filesystem the Zope process owner can do. Including something more sinister than just mere deletion (which any sys admin worth her salt should be able to restore in minutes) such as password sniffing trojan horses and possibly even something kinda wild like XML-RPC worms (now THAT would be cool!). The last thing we want to see is a back orifice for Zope, which is exactly what I think could be developed if we ever provided a hole through Zope's security machinery. -Michel

4 5

Re: [Zope-dev] Introspection, managing External Methods?
by Anthony Baxter 20 Jul '99

20 Jul '99

This has come up on a number of occasions - the problem is that an external method can subvert all the protections and access control that Zope provides. Having said that, there's nothing stopping you (or someone else) writing an external method that allows you to edit external methods. :) Anthony >>> Robin Becker wrote > Are there any plans to upgrade the External Methods product to allow > remote management ie creation/deletion/modification of the file texts? I > ask because a major advantage of Zope is the ability to manage at a > distance and this is not possible for External Methods. I can see easy > fudges using a hack of fsimport, but something based on the existing > external methods would be better. > > More generally how can one upgrade a Zope product remotely; assuming > this were possible it would be nice to be able to remotely shut down > Zope and get it to restart. > -- > Robin Becker > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://www.zope.org/mailman/listinfo/zope-dev > > (For non-developer, user-level issues, use the companion list, > zope(a)zope.org, http://www.zope.org/mailman/listinfo/zope ) -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

3 2

semipersistent
by Robin Becker 20 Jul '99

20 Jul '99

I'm using various external methods to create GIF files in my current server. These are expensive to produce, but are created on a per user basis eg as the results of a user input. How can I make these temporary in the sense that they live until the connection is dropped. -- Robin Becker

2 1

cgi and zope
by Peter Oliver Monz 20 Jul '99

20 Jul '99

Hello! Can I include cgi-output like in SSI (Apache) in Zope templates? Y.S. peter o. monz

2 1

RE: [Zope] manage_changeProperties
by Alex.Thomas＠dresdnerkb.com 20 Jul '99

20 Jul '99

I get this too. Drat! With the earlier alpha releases one had to explicitly assign the permission to the method, but now it looks like it does it for you, except that it doesn't...!? cheers Alex > -----Original Message----- > From: Jason Spisak [mailto:webmaster@mtear.com] > Sent: 19 July 1999 20:43 > To: zope(a)zope.org > Subject: [Zope] manage_changeProperties > > > Zopists, > > What permissions does a user have to have to use > manage_changeProperties. And it is not "Mange Properties" because a > user with that permission gets an unauthorized traceback to > manage_changeProperties. Actually even with all permissions a user > can't access manage_changeProperties unless the DTML is > proxied with the > Manager Role. Anyone have a thought as to why this is? > > Jason Spisak > webmaster(a)mtear.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) > ########################################## This email, its content and any files transmitted with it are intended solely for the addressee(s) and may be legally privileged and/or confidential. Access by any other party is unauthorised without the express written permission of the sender. If you have received this email in error you may not copy or use the contents, attachments or information in any way. Please destroy it and contact the sender on the number printed above, via the Dresdner Kleinwort Benson switchboard on +44 171 623 8000 or via e-mail return. Internet communications are not secure unless protected using strong cryptography. This email has been prepared using information believed by the author to be reliable and accurate, but Dresdner Kleinwort Benson makes no warranty as to accuracy or completeness. In particular Dresdner Kleinwort Benson does not accept responsibility for changes made to this email after it was sent. Any opinions expressed in this document are those of the author and do not necessarily reflect the opinions of the Bank or its affiliates. They may be subject to change without notice. ##########################################

1 0

Bugfix: Navigation-0.0.4 Product released.
by Andreas Kostyrka 20 Jul '99

20 Jul '99

Hi! I've released Navigation-0.0.4.tar.gz, it's available at the Zope contribution area (http://www.zope.org/Download/Contrib/) This fixes a pretty weird bug when navigate_filter is called with acquire=0 (meaning ``ignore Aquisition'') with previous versions, which resulted in wrong results because deactivated objects were not taken in account. As a result, it now activates all potential objects, which should not be a big problem, as the tree tag has to do this with the result also. Andreas -- Win95: n., A huge annoying boot virus that causes random spontaneous system crashes, usually just before saving a massive project. Easily cured by UNIX. See also MS-DOS, IBM-DOS, DR-DOS, Win 3.x, Win98.

1 0

RE: [Zope] please help test this site
by Alexander Staubo 20 Jul '99

20 Jul '99

>-----Original Message----- >From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of >Anthony Pfrunder >Sent: 20. juli 1999 11:20 >To: bruce(a)perens.com >Cc: zope(a)zope.org >Subject: Re: [Zope] please help test this site > > >Hi, > >Great site! > >I'm using IE 4.0 on Win95 and don't have problems with images or text. >However, I cannot submit comments to articles. Due to IE's great >feedback system it is hard for me to tell where the problem >is. [stuck in >a Microsoft only environ :(] If by "feedback system" you mean how it replaces HTTP error messages with its own inane DHTML pages, you can turn this off. Go Tools, Internet Options, Advanced, disable "Show friendly HTTP error messages". >Otherwise, great! > >PS Why not add links to comp.risks, privacy digest and >www.ntsecurity.com > >Cheers, > >Anthony Pfrunder >CS, HCI Engineer -- Alexander Staubo http://www.mop.no/~alex/ "Reality is that which, when you stop believing in it, doesn't go away." --Philip K. Dick

1 0

RE: [Zope] Zope v Enhydra v NAS v ASP?
by Paul Everitt 20 Jul '99

20 Jul '99

danda wrote: > Hmm... what amount of support does it have for XML besides > XML-RPC? Is there > pre-built Zope functionality for dealing with XML, or is it > more like, plug in > your favorite XML parser and roll your own? > For example, Enhydra supplies XMLC, which is a HTML/XML to > Java compiler. Look for an email within the next day or so from us with the full monty on this subject. --Paul Paul Everitt Digital Creations paul(a)digicool.com 540.371.6909 ----------------------------------------- The Open Source Zope application server http://www.zope.org/ -----------------------------------------

1 0

RE: [Zope] ODBC DA for unix coming?
by Alexander Staubo 20 Jul '99

20 Jul '99

>-----Original Message----- >From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of >Christopher Petrilli >Sent: 20. juli 1999 11:19 >To: Roman Milner >Cc: zope(a)zope.org >Subject: Re: [Zope] ODBC DA for unix coming? > > >> Well, I know that mxODBC >> (http://starship.python.net/crew/lemburg/mxODBC.html) is a python DB >> API 2.0 interface that works on top of the free IODBC >> (http://www.iodbc.org) >> >> I don't really know what I'm talking about - but it would be >> really nice to have an ODBC interface. The Cold Fusion guys at work >> seem to be able to get Cold Fusion to work with any DB ("OH, we'll >> just use the ODBC driver.") Some day, I hope to sell them Zope. > >There are three levels really to ODBC: > > 1. The "ODBC adapter" (such as mxODBC, etc) > 2. The manager (such as iODBC) > 3. The database driver (such as Oracle, etc.) > >At least this has been my understanding I've been operating >under. Don't confuse this will conformance levels, though, which is the meaning most common used for word "level" in respect to ODBC. ODBC defines three levels of API conformance (different features supported): Core, Level 1 and Level 2. Transaction support and asynchronous execution of functions, for example, are required of a level 1-conformant driver. >I just >looked at iODBC, and I don't see anything in it to let it talk to say, >Microsoft SQL Server (an ODBC only database, unless you know that it's >really only Sybase underneath :-). How would I do this? You would use a driver that supports the TDS protocol (which what the FreeTDS project tries to emulate) used by Sybase and Microsoft. Since MS 6.5 and Sybase was essentially the same product until version 4.2, they share much of the same innards, and you should be able to use a Sybase ODBC driver with MS, and vice versa. It may be the only known case of cross-platform product interopability in Microsoft's history. ;-) SQL Server is not an ODBC-only database. Its native API used to be the DB-Library. This API has been partly deprecated by MSSQL 7.0 -- if you want any of the new features of 7.0, you're forced to use any of the newer APIs such as ODBC, OLE DB, ADO (ActiveX Database Objects), or RDO (Remote Data Objects; a VB thing). >Chris >-- >| Christopher Petrilli Python Powered Digital >Creations, Inc. >| petrilli(a)digicool.com http://www.digicool.com -- Alexander Staubo http://www.mop.no/~alex/ "Reality is that which, when you stop believing in it, doesn't go away." --Philip K. Dick

1 0