December 2001 - Zope

Limitinng anon FTP access with Zope
by Jim Nicholson 02 Dec '01

02 Dec '01

I'm re-posting this, as my original post did not have a subject, and I have some things to add: I run Zope's FTP listener on the standard FTP port (port 21) on my Linux servers. I need it there because some of the authors for my site are behind packet-filter firewalls that only allow their outbound FTP traffic to target servers on the standard port. It works well, except that I'm getting occasionally hammered by FTP scanners that connect as anonymous and start CWD'ing to varous directories (/cgi-bin, /home, /etc, etc.) looking for security holes. There's no security problem, because those locations don't exist, and anyway Zope denies access to them by anonymous. But it does busy my system a bit, especially when I get three or four anonymous connections all looping through 100+ possible directories with CWD. Is it possible to disable anonymous connections to the Zope FTP listener entirely? Just refuse the connections? I still might get DOSed, but it's less likely then having them actually connect. I've tried setting anon_limit (in ZServer/FTPServer.py) to 0, but it still allows anonymous connections. Any hints? - Jim

1 0

NFGnav and Images / Icons question
by Vion, Nicolas 02 Dec '01

02 Dec '01

Could anybody please provide me with detailed instructions on how to change the icons used for NFGnav sitemaps? Despite numerous tries using the readme file I still can't understand what I need to do... Thanks in advance for any help, Nicolas

2 1

RE: [Zope] Passing a Variable from PHP
by Ben Ocean 02 Dec '01

02 Dec '01

At 11:04 AM 12/2/01 +0100, you wrote: >Sorry I overlooked your mail. > >But the answer is easy. If you send a querystring like that to zope, Zope >automatically knows the value, and you can get to it like <dtml-var somevar> Cool! Should have known... Thanks! BenO >Or any of the otyer ways mentioned in the dtml Zope book. > >regards Max M > >Max M. W. Rasmussen, Denmark. New Media Director >private: maxmcorp(a)worldonline.dk work: maxm(a)normik.dk >----------------------------------------------------- >Shipping software is an unnatural act > > > -----Original Message----- > > From: Ben Ocean [mailto:zope@thewebsons.com] > > Sent: Thursday, November 29, 2001 12:36 PM > > To: Max M > > Subject: RE: [Zope] Passing a Variable from PHP > > > > > > At 09:45 PM 11/28/01 +0100, you wrote: > > > > the script as it doesn't generate any html. This is a > > randomly generated > > > > variable. How do I communicate it?Y > > > > > >You just put it in your querystring and then do a: > > > > > > response.redirect('zopeurl?somevar=qh35wq3453jwqk') > > > > Oh, sure, it's easy enough to write the URL/query string in PHP, > > but how do > > I get Zope to capture the value of the variable? How do I get > > Zope to know > > that somevar=qh35wq3453jwqk? > > TIA, > > BenO > > > > > >

1 0

Re: [Zope] A Couple of Questions
by Oliver Bleutgen 02 Dec '01

02 Dec '01

Hi Ben, > Hi; > 1. If I have a string with characters that are illegal to pass into an > URL, > such as whitespace, how do I encode them? <dtml-var variable url_quote> or <dtml-var variable url_quote_plus> search the ZMI-help > 2. How do I decode them? doesn't this happen automaticly? > 3. How do I capture a variable that is sent to me from another Web site > that is appended to the URL after a question mark? > TIA, > BenO the variable should be contained in REQUEST, as this is the normal GET method for forms. You can try all of the abouve by making a simple dtml-method which just prints REQUEST. Look at what you get.... cheers, oliver

1 0

UrlEncode
by Ben Ocean 02 Dec '01

02 Dec '01

Hi; I have a number of DTML Methods (the only objects in a folder) that have whitespace, need to be encoded and tagged on to an URL to be sent to another Web server. It appears this is beyond the scope of Zope and requires a python script. However, I'm at a loss as to how to call the DTML Methods in my script! Please advise. BenO

1 0

A Couple of Questions
by Ben Ocean 02 Dec '01

02 Dec '01

Hi; 1. If I have a string with characters that are illegal to pass into an URL, such as whitespace, how do I encode them? 2. How do I decode them? 3. How do I capture a variable that is sent to me from another Web site that is appended to the URL after a question mark? TIA, BenO

2 2

logging users
by Erik Myllymaki 02 Dec '01

02 Dec '01

Any easy way to add AUTHENTICATED_USER to Z2.log?

3 2

Re: [Zope] Fetching the title of object whose id is passed in query string
by Ben Gustafson 02 Dec '01

02 Dec '01

Thanks, Danny. You not only showed me a much more elegant way to display the image object's title, but I learned some new syntax as well! --Ben > Subject: Re: [Zope] Fetching the title of object whose id is passed in query string > Date: Thu, 29 Nov 2001 16:44:50 +1300 > > I'm working on my first Zope project, an on-line photo galley, now > > located at http://localhost:8080/gallery/ . The image objects are stored > > in a subfolder called "imgs". The page at the above URL has a nav bar > > with links that have the id of the image object to display in a query > > string, like so: http://localhost:8080/gallery/?imgID=doorway. What I > > want to do is display below the image the title of the image object > > whose id is passed in the query string, sort of like a caption. For some > > reason, though, I can't figure out how to ask for the image object's > > title directly. What I'm doing now (and which works, but is ugly), is > > this: > > > > <dtml-if imgID> > > <dtml-in expr="imgs.objectValues()"> > > <dtml-if "imgID==_['id']"> > > <IMG SRC="imgs/<dtml-var imgID>" width=<dtml-var width> > > height=<dtml-var height>> > > <P align="center"><dtml-var title></P> > > </dtml-if> > > </dtml-in> > > </dtml-if> > > > > How do I just do <dtml-var expr="imgs.title_or_id(imgID)"> > > (or something like that) and make it work? > > <dtml-var "imgs[imgID].title_or_id()"> > > > hth, > Danny

1 0

XML-RPC over HTTPS size limit
by Nuno Maltez 01 Dec '01

01 Dec '01

Hello, I'm not sure which mailing list this topic is more suitable in, so I'm sending it to the general list. We found a problem while using M2crypto 0.06 with Zope-2.4.2. We're calling a Zope extrenal method on another matchine (same configuration) through XML-RPC and we noticed that once the content-lenght of the HTTP request gets larger than 4096 bytes the calling function hangs (Zope hangs; the server Zope still works fine). Below is the printout generated by the client Zope: reply: 'HTTP/1.0 200 OK\r\n' header: Server: Zope/(Zope 2.4.2 (binary release, 2.1.0, win32) ZServerSSL/0.06 header: Date: Fri, 30 Nov 2001 13:16:22 GMT header: Connection: close header: Content-Type: text/xml header: Content-Length: 127 3932 send: 'POST /RPC2 HTTP/1.0\r\n' send: 'Host: 192.168.1.4\r\n' send: 'User-Agent: xmlrpc_ssl.py/0.06 - xmlrpclib. m)\r\n' send: 'Content-Type: text/xml\r\n' send: 'Content-Length: 4097\r\n' send: 'Authorization: Basic c29uaWE6c29uaWE=\r\n' The function's only argument is a string and we tested it by calling the method in a for loop until it hung: for i in range(3910,4000,1): stringXml = "X"*i print i rs = x.recepcaoActualizacao(stringXml) Everything works fine by HTTP (not secure) even for 200Kb strings. Has anyone faced this problem before? Anyone knows of a cure? Thanks in advance, Nuno

2 1

How can my Zope site be accessed outside
by Jin Chen 01 Dec '01

01 Dec '01

Hi, I set up the zope on my machine where my IIS server works. When I created the new homepage on zope(http://www.nautilus.org:8080/) and changed the security property that this page can be viewed anonymous, I can only view this page inside my work place but cannot view it from outside place such as at home. I know our IIS server use port 8000. So can any one help me to figure out this problem? Many thanks..... Jin _______________________________________ Jin Chen The Nautilus Institute 125 University Avenue Berkeley, CA 94710-1616 USA (510) 295-6121 * Fax: (510) 295-6130 jchen(a)nautilus.org http://www.nautilus.org

3 2