November 2001 - Zope

Seperate Log Files
by Vid Bijelic 27 Nov '01

27 Nov '01

Hi, I have a two (for now) sites running on the same Zope. Is it possible to have Zope store log files separately for each site, so webalizer can easily generate site statistics for each site separately. Vid __________________________________________________ Do You Yahoo!? Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month. http://geocities.yahoo.com/ps/info1

3 2

RE: zope - webalizer
by Norman Khine 27 Nov '01

27 Nov '01

Vid, You can use webalizer or analog by creating a cron job in your root directory which will need to point to your zope log files -- which are based within your 'zope_home'/var/Z2.log For example 55 0 * * * /usr/local/bin/webalizer -n zope.domain.com -o /www/htdocs/zope/stats/ /usr/local/Zope/var/Z2.log ^- time ^--where your program is ^-- title on report ^--where to put your reports ^--where your zope logs are After you have defined the cron table entries in your cronjobs file, you will need to register your crontab with the system. This can be done by running the crontab command. For example, if you created your crontab file as cronjobs on your Server home directory then you would use the following command: % crontab cronjobs This will register your crontab file with the cron system daemon. If you ever need to review the current cron entries you have registered with the cron system daemon, you need simply use this command: % crontab -l hth Norman -----Original Message----- From: zoops4(a)yahoo.com [mailto:zoops4@yahoo.com] Sent: 27 November 2001 03:29 To: khine(a)btinternet.com Subject: zope - webalizer Hi, I have a couple of websites running on the same zope and I would like to use webalizer to analyze statistics for each separately. Is it possible somehow to tell zope to store log files separately for each site or is there any other way of getting these statistics separately. Thanks, Vid

1 0

WebDAV/Word readonly problem resolved
by Andreas Jung 27 Nov '01

27 Nov '01

The long outstanding problem that WinWord treated a .html file as read-only when it has been opened through WebDAV/webfolder is finally resolved. Joachim Schmitz gave the hint that WinWord depends on the HTTP ETAG header that Zope usually did not send. This behaviour is odd because HTTP 1.1 does not require that a server sends this header. The CVS trunk and Zope-2_4-branch contain a modified version of lib/python/OFS/DTMLMethod.py that solves that problem. Andreas --------------------------------------------------------------------- - Andreas Jung Zope Corporation - - EMail: andreas(a)zope.com http://www.zope.com - - "Python Powered" http://www.python.org - - "Makers of Zope" http://www.zope.org - - "Life is a fulltime occupation" - ---------------------------------------------------------------------

3 4

what is the difference between the enctypes
by Robert Rottermann 27 Nov '01

27 Nov '01

Good morning, By experience I learned that I have to use an enctype of "multipart/form-data" when sending a file. "Normal" forms use an enctype of "x-www-form-urlencoded" (which is the default) Now my question: is there a reason NOT to use always multipart/form-data? In http://www.ietf.org/rfc/rfc2388.txt I did read that the effect of using the same field-name more than once is not defined. Would that hinder Zope to create a records out of a set of actually named fields?? Robert

2 2

LocalFS w/ large files.
by Jason C. Leach 27 Nov '01

27 Nov '01

hi, Has anyone had success uploading large files (45MB+) to Zope with the LocalFS product? I can't seem to. Thanks, j. -- ...................... ..... Jason C. Leach .. PGP/GPG Public key at http://www.keyserver.net/ Key ID: 157BD48C

2 1

Re: [Zope] Seperate Log Files
by Danny William Adair 27 Nov '01

27 Nov '01

On Tuesday 27 November 2001 17:33, Vid Bijelic wrote: > Hi, > > It sounds very reasonable. > > Can you give me some quick how, before I start digging > trough webalizer documentations. > I think a simple -n hostname as a command line parameter will do the trick... hth, Danny > Vid > > --- Danny William Adair <danny(a)adair.net> wrote: > > On Tuesday 27 November 2001 17:10, you wrote: > > > Hi, > > > > > > I have a two (for now) sites running on the same > > > > Zope. > > > > > Is it possible to have Zope store log files > > > separately for each site, so webalizer can easily > > > generate site statistics for each site separately. > > > > > > Vid > > > > Why not the other way around? > > Tell Webalizer to only count requests to specific > > hosts... > > > > hth, > > Danny > > __________________________________________________ > Do You Yahoo!? > Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month. > http://geocities.yahoo.com/ps/info1

1 1

Re: [Zope] Seperate Log Files
by Danny William Adair 27 Nov '01

27 Nov '01

On Tuesday 27 November 2001 17:10, Vid Bijelic wrote: > Hi, > > I have a two (for now) sites running on the same Zope. > Is it possible to have Zope store log files > separately for each site, so webalizer can easily > generate site statistics for each site separately. > > Vid Why not the other way around? Tell Webalizer to only count requests to specific hosts... hth, Danny

1 0

CoreSessionTracking: Brute-Forcing Web Application Session IDs
by Frank Tegtmeyer 27 Nov '01

27 Nov '01

The following article also applies to CoreSessionTracking. CST uses a timestamp and a value generated by the rhandom module. While this is sufficient to avoid collisions it's not enough to defend against brute force attacks like the ones describe in the appended message. Perhaps CoreSessionTracking should be switched to an algorithm that was mentioned by Florent Guillaume (Nuxeo): ------------------------------------------------------------------------ From: Florent Guillaume <fg(a)nuxeo.com> Subject: Re: [Zope] CoreSessionTracking-based LoginMethod for LoginManager Date: 15 Aug 2001 17:07:11 GMT > 1. Start with the data you want to store > 2. Append identifying information, eg the IPs of the client and > server, and the current date/time. > 3. Make a digest of this plus a secret string which only you know, > and append that as a fingerprint. I rewrite you 3. as computing as a fingerprint: H(known-string || password). This construction apparently still has some very slight cryptographic weaknesses. Lifted from bugtraq sometime ago: From: Michael Wojcik <Michael.Wojcik(a)merant.com> Date: Mon, 16 Jul 2001 10:45:48 -0700 Schneier cites a private communication with Bart Preneel (author of RIPE-MAC) on possible weaknesses of the obvious constructions H(known-string || password) H(password || known-string) H(password || known-string || password) H(password-1 || known-string || password-2) and suggests one of the following instead (rewritten as password hashes): H(password-1 || H(password-2 || known-string)) H(password || H(password || known-string)) [ie. pw-1 == pw-2] H(password || pad || known-string || password) [pad pw to full block] The simplest of these, in terms of retrofitting existing systems that use one of the constructions Ishikawa mentions, is H(password || H(password || known-string)) So I'd use that last one instead. Florent Guillaume Nuxeo ------------------------------------------------------------------------ The needed "secret" could be established by some means during the installation of CoreSessionTracking without even bothering the administrator. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany

4 4

Help with Zope news?
by Chris McDonough 27 Nov '01

27 Nov '01

Would anybody be willing to "do" the Zope News for the last few months (since it was last released, on Oct. 1, long ago)? If not, it's going to be a while before I'll be able to release another one. ---------- Chris McDonough Zope Corporation http://www.zope.org http://www.zope.com """ Killing hundreds of birds with thousands of stones """

1 0

Problem with std. user folder Authentication dialog
by vio 27 Nov '01

27 Nov '01

How do I get rid of the Login dialog sent by 'user folder'? I have a product which I want to allow public access to (without compromising my site's security), but I can't get rid of the std. Login dialog. I tried to use the calls from the Security chapter in ZopeDevGuide, but without apparent effect: calls to security.declarePublic('myMethod') don't seem to work, as far as I can tell. Any hints would be appreciated. Vio

1 0