February 2000 - Zope

Malicious HTML in (Squishdot) postings
by Squishdot 05 Feb '00

05 Feb '00

Hi all, CERT has issued a security advisory regarding improperly checked output from dynamic pages. The CERT advisory can be found at: http://www.cert.org/advisories/CA-2000-02.html. Unfortunately, Squishdot is vulnerable to such problems. However, I (and others in the Zope community) am trying to find a permanent solution to this. Of course, your help is also welcome (code patches accepted :^)) While each site (e.g. depending on the audience, accessibility, amount of traffic) is vulnerable in varying degrees to these types of problems, I would urge each administrator to evaluate their own security policies regarding these problems and take steps appropriate for their own circumstances. In the meantime -- temporarily -- the best way to deal with the problem is to turn moderation on for everything, and then properly check each posting manually. Regards, Butch ===== Butch Landingin Squishdot maintainer http://squishdot.org squishdot(a)yahoo.com __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

1 0

acquisition in the Product hierarchy?
by Darran Edmundson 05 Feb '00

05 Feb '00

Consider the following. I have 2 ZClasses (n1 and n2) nested within a container Zclass (c) created within a product (p). My addForms for n1 and n2 (call them a1 and a2) are quite complicated but share a lot of code. The obvious solution? Move this duplicated code to a single DTML method (call it shared) and use acquisition to give a1 and a2 access to this code snippet. Just to make sure we have the same mental picture, here's the hierarchy (where indentation implies what children are visible when "clicking" on the parent): Zope Root Control Panel Products p c n1 n2 a1 a2 shared If c was a folder outside the Product hierarchy, then adding shared in the location shown *would* give a1 and a2 access via acquisition. However, within the Product hierarchy, it doesn't. a1 and a2 only acquire shared if I move it up to the level of "c". Why is this? Am I missing something obvious? Just when I think I am coming to grips with Zope ... Cheers, Darran.

1 0

where to find help on manage_clone, etc
by danny shevitz 04 Feb '00

04 Feb '00

I'm as big a newbie as you'll find. I'm working through the tutorial and have come across manage_clone. I also notice in my web browser, there are lots of manage_...'s. How or where do I find help on these functions? I've searched the documentation but have come up blank. I'd sure like to see a help document these functions. thanks, Danny __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

2 1

MORE Big things at Digital Creations
by Rob Page 04 Feb '00

04 Feb '00

Hello everybody! Good things continue to happen in the Zope community at large and at Digital Creations in particular. The latest COOL thing is a new office in Rochester, NY. The Rochester office will be staffed initially by: o John Platten (mailto:jplatten@digicool.com) o Robert Mead (Rob) (mailto:rbmead@digicool.com) o Bob Shaw (mailto:bshaw@digicool.com) These gentlemen are software professionals in every meaning of the word and we are lucky to have them aboard! Our Rochester office will contribute to both consulting and infrastrucure projects. Naturally, the the Rochester office is well positioned to provide ongoing service and support to our customers in Rochester, NY and throughout the northeastern US. Here's some background on these guys: John Platten -------- John is the Official Rochester Cat Herder. John is a huge fan of both Python and Zope and recently worked on a markup translator for a well-known information services company using Python, C, and C++.. Rob Mead -------- Rob's been doing software development for about 10 years -- mostly in humongous companies. Rob's frustration factor pegged out one day late last year. Instead of "Going Postal" :^) he decided he'd had enough and decided to join the Digital Creations team to achieve world domination. Rob is also a Python Person and was on the same "markup translator" team as John Platten. Bob Shaw -------- Bob has been doing software for almost 20 years. His expertise is primarily in Unix, C and real-time systems. Most recently he was involved in the development of a commercial natural language processing query engine for an Internet company. Please join me in welcoming John, Rob and Bob to the Digital Creations team!!! --Rob P.S. - Our team now boasts: John P, John O, Rob P, Rob M, Bob S, Mike P, and Mike P What's up with that!? We're going to need AOL-style email addresses soon! :^) -- Rob Page V: 540.371.6909 Digital Creations, Inc. F: 703.995.0412 -- ... The Leader in Open Source Web Development ... ... Don't miss Zope! http://www.zope.org ...

2 1

RE: [Zope] Re: newbie questions about security
by Chris McDonough 04 Feb '00

04 Feb '00

Well, in any case, welcome to Zope! > -----Original Message----- > From: danny shevitz [mailto:danny_shevitz@yahoo.com] > Sent: Friday, February 04, 2000 3:51 PM > To: zope > Subject: RE: [Zope] Re: newbie questions about security > > > no, you aren't misunderstanding. You answered my question. I'm a > newbie, not just to zope but to web authoring as well. So I have and > answer to my question, and realistically, if a user can view the image > directly it's no big deal. > > It just seems a little weird that by definition you can > directly view a > company logo if it appears on a homepage. After this > discussion I guess > the question could be rephrased simpler as: is it possible to view an > image in another document, but not directly? > > thanks, > Danny > __________________________________________________ > Do You Yahoo!? > Talk to your friends online with Yahoo! Messenger. > http://im.yahoo.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

Sybase and DateTime.py: _validTime()
by Hung Jung Lu 04 Feb '00

04 Feb '00

Hi, There is a bug in \lib\DateTime\DateTime.py, this particularly concerns Sybase database users. In the lines: def _validTime(self,h,m,s): return h>=0 and h<=23 and m>=0 and m<=59 and s>=0 and s<=59 Please change s<=59 to s<60. This bug is causing Sybase to crash whenever a table contains a date value with s>59, e.g: s=59.23 regards, Hung Jung (I have submitted to the Zope bug collector) ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Zope HTML Quality
by Jacob Gorm Hansen 04 Feb '00

04 Feb '00

Hi, I noticed that the HTML generated by the Zope management interface is rather low quality, with lots of color,align, etc. attributes (which are deprecated in favor of CSS), and unclosed option tags etc. Of course I can fix this myself in my local Zope, but are there any plans to aim for, say, XHTML compliance? Keeping up with standards makes more sense than staying 100% compatible with obsolete browsers IMHO. Best regards, Jacob

4 4

RE: [Zope] Re: newbie questions about security
by Chris McDonough 04 Feb '00

04 Feb '00

It's not possible to do this with Zope permissions (or any other HTTP-based package permissions, AFAIK). In Zope, either a user can view the image or they can't based on their role memberships. Zope has no concept of where in the tree the user "is" when he calls an image. This is reasonable because an image isn't associated in any way with an HTML file in a request. When a user calls a for page in their browser, the HTML representing a page gets fed into the browser, and the browser calls the images up one-by-one independent of the HTML. A new session is established for each image brought up. Each session must either authenticate itself anew to the server or it must be allowed to access files on the web server without requiring credentials. Therefore, you have no way of determining whether the request to an image is associated with an earlier call to the HTML page or not (unless you use some sort of heuristics to determine timing between hits or something, which we don't). Am I misunderstanding the question? > -----Original Message----- > From: danny shevitz [mailto:danny_shevitz@yahoo.com] > Sent: Friday, February 04, 2000 2:11 PM > To: zope > Subject: [Zope] Re: newbie questions about security > > > Thanks for the response. You were correct about the > permission of /Root > versus /Home. After making /Root hidden to Anonymouse I > couldn't access > /Home because standard_html_header and footer were being > acquired. This > again shows that permissions are determined by the permission of the > parent in acquisition, not the child. > > I still have a question about setting up an /Home/img folder for > images. > I want to access the images from /Home but to not have them > be directly > viewable via a URL, e.g. /Home/img/image1. Is this possible? > > So far any combination of permissions that I have been able to come up > with between /Home/img, /Home/img/image1, and /Home/img/index_html has > the side effect that if /Home can access the image, so can the > Anonymous URL /Home/img/image1. I can independently set the permission > of /Home/img, just not the subimages. > > thanks, > Danny > __________________________________________________ > Do You Yahoo!? > Talk to your friends online with Yahoo! Messenger. > http://im.yahoo.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] Re: newbie questions about security
by danny shevitz 04 Feb '00

04 Feb '00

no, you aren't misunderstanding. You answered my question. I'm a newbie, not just to zope but to web authoring as well. So I have and answer to my question, and realistically, if a user can view the image directly it's no big deal. It just seems a little weird that by definition you can directly view a company logo if it appears on a homepage. After this discussion I guess the question could be rephrased simpler as: is it possible to view an image in another document, but not directly? thanks, Danny __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

1 0

Re: [Zope] SybaseDA-2.0b2-src.tgz
by Hung Jung Lu 04 Feb '00

04 Feb '00

>From: Christopher Petrilli <petrilli(a)digicool.com> > >Can you please specify what the exact behaviour problem IS? We treat any >NUMBER data type with DECIMAL(10,0) or greater as a python long because it >can not be represented accurately in a 32-bit integer. The option (as was >treated before) is to return a float, but this is losing accuracy. ---------------------------------------------------------------- :) Sure enough, the DECIMAL data type problem persists in SybaseDA-2.0b2. ---------------------------------------------------------------- :) I nagged quite a bit in the zope mailing list about the SybaseDA DECIMAL data type problem, even posted a patch for it. Chris McDonough was kind enough to send everything to the Collector, too. The relevant threads can be views at Egroups.com under http://www.egroups.com/group/zope/showthread.html?start=21025 http://www.egroups.com/group/zope/showthread.html?start=21108 ---------------------------------------------------------------- It is very easy to cause the crash. Install your SybaseDAv2, restart Zope, create (add) an instance of "Sybase DataBase Connection", click on it, make sure that is it connected. Now, go to the "Test" tab, issue the SQL command: create table test (id decimal(10)) Hit "Submit Query". Good. The table is created. Now, go to the "Test" tab again, issue the SQL command: select * from test Voila, crash. Error Type: sy_occ.error Error Value: Invalid buffer element type ... File /usr/local/bs_zope/lib/python/Products/SybaseDAv2/db.py, line 239, in query sy_occ.error: (see above) The error does not happen when you have 9 or fewer digits in your DECIMAL data type declaration. ---------------------------------------------------------------- How to fix it? Simply follow the instructions given in my posting (the message number 21108 with the URL provided above.) Of course, I don't know what other data type problems the adapter might have, nor whether my patch was done properly or not. But at least for now, it works for me. :) regards! Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0