September 2001 - Zope

Re: [Zope] authentication problem
by Oliver Bleutgen 01 Sep '01

01 Sep '01

[SNIP] > I would GREATLY appreciate an explanation of where the authorization > information is coming from. I don't see the currently logged in user > in my CGI environment, including cookies. How does any server-side > program get the user authorization information from the browser after > the user has logged in and gone to a different frame or window? > -- I'm just talking about basic-auth here. The browser just resends (or should at least) the credentials in the request header (BASE64 encoded) for every request to the same server. Perhaps - I'm not sure - the browser respects URIs, i.e credentials which were asked at http://hostname/secure_area/ would not be sent to http://hostname/public_area/ but to http://hostname/secure_area/subfolder/ But I'm not sure. A nice way to see the dialog between browser and server is using Shanes nice tcpwatch, located at http://www.zope.org/Members/hathawsh/tcpwatch cheers, oliver

1 0

Re: [Zope] protecting users from hostile authors
by Oliver Bleutgen 01 Sep '01

01 Sep '01

> O.k., I've been mulling over the topic of > protecting users from lots of potentially > hostile authors. I've got some ideas > that could go a little way toward solving > the problem. > When writing a method that is going to do > something *really* privileged (like "drop > class"), there should be a second "Are > you sure you want to...?" step. > In order to enforce the desired use of > this step, there must be a way to > determine that the method is being called > directly from the Zope Publisher(???) - > not through an intermediate method. I > have worked with such problems extensively > under Apache, and the most secure solution > I developed was not pretty. I'm hoping > for better in Zope. This is IMO equivalent to the problem of determining if the manage_-method has been called by "legitimate" means, i.e. creating some kind of state - otherwise the attacker would just target the same methods as the "are you sure?" screen you propose. Btw. I wouldn't want to be asked for everything I do in the ZMI - and everything you can do there is potentially dangerous. > Is there a good un-fakeable way in Zope > to determine the caller of a method? I fear that's impossible when we look at what happens. (1)Hostile html-page -> (2)client -> (3)manage_method Between (1) and (3) there's always the client and looking at modern browsers I find it very unlikely that we can always trust (2). > (Another piece that is required for the > "extra step" solution I mention is the > generation of some cryptographic key to > the second step. I think I understand > how to do that.) If you know how to solve that, you can also stuff that key directly into the ZMI as we have them now, can't you? OTH, looking at techniques discussed here recently, like IIRC http://www.ashleyit.com/rs/ we see there are various possibilites to GET/POST pages on the users behalf in order to get at your cryptographic key. > Some other things to consider...if you > have a "Referer" header, you could use it > to insure that the user got to your > method through the "proper" path. Using > the "Accept" header *should* give a clue > if the request is coming as a result of a > tag like "img". These are not dependable > solutions, though. Some browsers do not > send the Referer, and MS browsers have a > long history of sending bogus Accept > values. Also, frames could be used > instead of images for "invisible" calls. I see no chance to defeat an attack against a browser which is to "open" w.r.t. scripting. But, without javascript, there's IMO an easy and compatible way to defeat almost any attack. I posted this also to the wicki, just make sure that possibly destructive methods can only be called from the web via POST. The http/1.1 rfc says about that: 9.1.1 Safe Methods Implementors should be aware that the software represents the user in their interactions over the Internet, and should be careful to allow the user to be aware of any actions they might take which may have an unexpected significance to themselves or others. In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested. Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the side-effects, so therefore cannot be held accountable for them. cheers, oliver

1 0

protecting users from hostile authors
by Kyler B. Laird 01 Sep '01

01 Sep '01

We're in the process of building a cluster (just installed 8 machines) for serving a bunch (tens of thousands) of users. Many/most of these people will also be authors. A single (X.500- based) authentication system will be used for most everything. I'm trying to get a handle on what policy I want to use in order to keep authors from doing Bad Things to authenticated users who visit their pages. Looking around on Zope.org, I realized that this might already be addressed. Is there anything that prevents me (as a Zope community member with authoring privileges on zope.org) from luring users who have already authenticated with Zope.org to come look at my pages, and then running arbitrary commands with their privileges? Anyone else grappling with this situation? I'm trying to decide how to set policy so that users are reasonably safe, but authors still have the freedom to create Cool Stuff. There will most certainly be multiple classes of authors - those who can act with the authenticated user's privileges and those who can not. I'm not quite sure how to implement that yet, though. I'm also concerned about links to Bad Things, like "delete your home directory" disguised as "Get porn here!". Any thoughts? Has this already been hashed out somewhere that I should have found? Thank you. --kyler

6 10

Drag and Drop in ZMI?
by Jon Edwards 01 Sep '01

01 Sep '01

I found another script for Targetted Drag and Drop in IE 4/5 (but couldn't find anything cross-browser) - http://www.siteexperts.com/tips/styles/ts35/page1.asp HTH ...if you get it working, I'd love a copy too! ;-) Cheers, Jon

1 0

Re: [Zope] Newbie
by Robert Rottermann 01 Sep '01

01 Sep '01

als tüütschschwiizer verstangeni natürlech nume Schwiizertüütsch oder änglisch bzw selbstverständlich! Robert ----- Original Message ----- From: "Frank Stephan" <frank_stephan(a)gmx.de> To: "Robert Rottermann" <robert(a)redcor.ch> Sent: Sunday, September 02, 2001 11:09 AM Subject: AW: [Zope] Newbie > Hi Robert, > > thank you very much for your help. > Seems that is exactly what I need. > I'd like to ask a few more questions. > May I ask in german, too? > > Thx > Frank > > > > -----Ursprüngliche Nachricht----- > > Von: Robert Rottermann [mailto:robert@redcor.ch] > > Gesendet: Freitag, 31. August 2001 22:36 > > An: Frank Stephan; zope(a)zope.org > > Betreff: Re: [Zope] Newbie > > > > > > Hi Frank, > > what you like to do is rather easy with zope. > > There are a couple of ways to do it. > > You can solve your problem either using CMF or plain zope. > > The difference is that CMF offers you things like user management, and > > uploading of "annotated" pdf files out of the box. > > > > The listing of files on the server and sending of information you > > have to do > > yourself with both approaches. > > > > I did something similar (without the sending of weekly emails) just > > recently. > > You find it under www.nasuko2001.ch > > Look at it. If there are parts you could use just tell me. > > > > Robert > > > >

1 0

Problem with ZCatalog and Virtual Host Monster
by Yuichiro Sugiura 01 Sep '01

01 Sep '01

Hi, I have a problem to get ZCatalog to work with Virtual Host Monster properly. A wrong path (Object Identifier) is stored when a catalog aware object get cataloged. For example, an object "/a/b/c/d_html" get cataloged as "/b/c/d_html" where "/a" is the root folder for the virtual host. However, correct paths ("/a/b/c/d_html") are stored when a catalog is built from "Find Objects" tab in ZCatalog, . Is this behavior a known bug of the ZCatalog, or could it be caused by misconfigurations of something? Any input would be greatly appreciated. I'm using Zope 2.4.0, by the way. Yuichiro Sugiura -- Yuichiro Sugiura Activewave Technologies Inc.<http://www.awavetech.com/> Serving cyber community and cyber business.

2 2

Re: [Zope] DTML Confusion?
by hamish＠allan.tc 01 Sep '01

01 Sep '01

JZ>I can also JZ> JZ><dtml-var "Util.utility_function(REQUEST=REQUEST)"> JZ> JZ>but that is also a little long-winded. OB>DTML objects are really callable instances of classess. dtml-with calls OB>them automagically, but when you use dtml-var "..." these quotes move you OB>from DTML to Python, and in Python there is no automagical call - you must OB>call the objects yourself. There is no way to avoid it. but <dtml-var "Util.utility_function()">, which is a little less long-winded, should also work. regards, hamish -- Get your firstname@lastname email for FREE at http://Nameplanet.com/?su

2 1