February 2006 - Zope

Re: [Zope] restricting permissions for direct access only
by Chris Withers 17 Feb '06

17 Feb '06

Michael Shulman wrote: > Okay, I must be the most moronic user ever. The default text in a > newly created Python Script, which I did not bother to change for my > test case, accesses meta_type, but I did not notice this; thus I was > confused. (Just out of curiosity, what permissions are required to > access meta_type?) Depends, should be 'View', or most likely not protected at all, but I guess you found an object where it was protected with something else... > But... it's still not working for my real site. I think the issue is > this. If script1 has proxy role Manager, and script2 has view > permissions set only for Manager, then script1 can call script2, no > problem. But if script1 instead calls script3, which then calls > script2, it doesn't work unless script3 *also* has proxy role Manager. Yes, this was a deliberate change made a few major releases ago. I've never mich liked it myself for exactly the reason you describe. I wonder if anyone who knows could point out why this change was made, I'm sure the reasons were good... > Is there a way to make scripts inherit proxy roles from their > callers? Both I and you wish there was ;-) cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

4 7

Re: restricting permissions for direct access only
by Michael Shulman 17 Feb '06

17 Feb '06

I don't understand what inheriting proxy roles from callers has to do with allowing users to access protected resources above their user folders. They seem like totally different questions to me. Could you please explain? On 2/16/06, Tres Seaver <tseaver(a)palladion.com> wrote: > >>>But... it's still not working for my real site. I think the issue is > >>>this. If script1 has proxy role Manager, and script2 has view > >>>permissions set only for Manager, then script1 can call script2, no > >>>problem. But if script1 instead calls script3, which then calls > >>>script2, it doesn't work unless script3 *also* has proxy role Manager. > >> > >>Yes, this was a deliberate change made a few major releases ago. I've > >>never mich liked it myself for exactly the reason you describe. I wonder > >>if anyone who knows could point out why this change was made, I'm sure > >>the reasons were good... > > > > Even if the reasons were good, it would be nice to have an option to > > turn it on or off, even if the default is off. At the very least, it > > would be nice if this fact were documented. (Is it somewhere and I > > just missed it?) It surprised me very much, and it would have > > surprised and frustrated me even more if I'd written a site which > > worked and then later on decided to split off the functionality of > > some private script into a secondary one, unsuspecting that it would > > break the proxy roles setup. > > The prior behavior (allowing users to access protected resources "above" > the domain of their user folders) was a security hole caused by a bug, > and was never documented as allowable: correcting it was a matter for a > rather urgent fix, as it broke the explicitly-documented model. > > The fact that folks wrote applications which relied on the hole is > unfortunate; breaking them is better than leaving the sites built > around the defined model vulnerable to abuse.

2 1

SSL & Digest Auth
by Chris Withers 17 Feb '06

17 Feb '06

Hi All, Something from another thread which I forgot to ask about... Can you really not use digest auth with an ssl connection? cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

3 4

installing PIL on Window Zope
by Allen Huang 17 Feb '06

17 Feb '06

I want to install PIL into zope but I couldn't use the installation package since python that came with zope isn't register on windows. so I installed python 2.3 seperately and I found some artical on the zope website and it said to - decompress and PIL package and move - Copy the PIL folder and the pil.pth file from your Python folder into: YourZopeFolder/lib/python - Copy _imaging.pyd, _imagingtk.pyd, tk83.dll and tcl83.dll into YourZopeFolder/bin/DLLs - Copy PIL folder in Zope\lib\python\PIL I did all that but I'm not sure if PIL now work with zope or not... I started importing External Script using PIL but all I get is -- 'module' object has no attribute 'Image' Can someone tell me how I can check if PIL works? Does anyone have a simple PIL coding I could use? --------------------------------- What are the most popular cars? Find out at Yahoo! Autos

5 7

subscribe
by Khachatur Yengibaryan 17 Feb '06

17 Feb '06

zope-request(a)zope.org wrote: >Send Zope mailing list submissions to > zope(a)zope.org > >To subscribe or unsubscribe via the World Wide Web, visit > http://mail.zope.org/mailman/listinfo/zope >or, via email, send a message with subject or body 'help' to > zope-request(a)zope.org > >You can reach the person managing the list at > zope-owner(a)zope.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Zope digest..." > > >Today's Topics: > > 1. Re: Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' (Jens Vagelpohl) > 2. Re: Re: restricting permissions for direct access only > (Chris Withers) > 3. Re: Zope 2.9 and SSL (Chris Withers) > 4. Re: Granting access by reading http headers (Chris Withers) > 5. Re: Re: restricting permissions for direct access only > (Chris Withers) > 6. Re: installing PIL on Window Zope (Josef Meile) > 7. SSL & Digest Auth (Chris Withers) > 8. Re: Re: installing PIL on Window Zope (Tino Wildenhain) > 9. Re: Zope 2.9 and SSL (Janusz Zamecki) > 10. Re: Re: restricting permissions for direct access only > (Chris Withers) > 11. Re: Re: restricting permissions for direct access only > (Chris Withers) > 12. Re: Zope 2.9 and SSL (Michael Haubenwallner) > 13. Re: installing PIL on Window Zope (Allen Huang) > 14. Re: SSL & Digest Auth (michael nt milne) > 15. Re: Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' (Roman Klesel) > 16. Re: SSL & Digest Auth (Andrew Milton) > 17. Re: Re: Re: major problems placing authentication on an > extranet site-security flaw? (michael nt milne) > 18. Re: Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' (Stefan H. Holek) > 19. Re: SSL & Digest Auth (michael nt milne) > 20. Re: Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' (Roman Klesel) > 21. Re: installing PIL on Window Zope (Josef Meile) > 22. Re: Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' (Roman Klesel) > 23. Re: restricting permissions for direct access only > (Michael Shulman) > 24. Re: restricting permissions for direct access only (Tres Seaver) > 25. Re: Re: Re: major problems placing authentication on an > extranet site-security flaw? (Floyd May) > 26. Re: Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' (Roman Klesel) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 16 Feb 2006 09:59:58 +0000 >From: Jens Vagelpohl <jens(a)dataflake.org> >Subject: Re: [Zope] Error Value: 'File' object has no attribute > 'manage_fixupOwnershipAfterAdd' >To: zope list user <zope(a)zope.org> >Message-ID: <F7446EF5-44B9-42DE-BB5A-BF4EDDF4FB98(a)dataflake.org> >Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed > > >On 16 Feb 2006, at 09:33, Roman Klesel wrote: > > > >>Hello Bruno, >> >>bruno desthuilliers schrieb: >> >> >>>What's wrong with: >>> >>>container.manage_addProduct['OFSP'].manage_addFile(id, file='', >>>title='', precondition='', content_type='', REQUEST=None) >>> >>> >>Well, in a fs product I don't have container nor >>self.manage_addProduct or something (AFAIK). >> >>Therefore I use the ._setObject() method. >> >> > >Instead of "container" you substitute the object that you called >_setObject on before. No rocket science here. If that object >subclasses from the normal Zope Folder class (or is a Zope Folder) >you *will* have manage_addProduct. > >jens > > > >------------------------------ > >Message: 2 >Date: Thu, 16 Feb 2006 08:27:43 +0000 >From: Chris Withers <chris(a)simplistix.co.uk> >Subject: Re: [Zope] Re: restricting permissions for direct access only >To: Tres Seaver <tseaver(a)palladion.com> >Cc: public-zope-CWUwpEBWKX0(a)ciao.gmane.org, zope(a)zope.org >Message-ID: <43F4377F.5050503(a)simplistix.co.uk> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Tres Seaver wrote: > > >>The prior behavior (allowing users to access protected resources "above" >>the domain of their user folders) was a security hole caused by a bug, >>and was never documented as allowable: correcting it was a matter for a >>rather urgent fix, as it broke the explicitly-documented model. >> >> > >I don't think that's what Michael and I were commenting on... > >IIRC, if you had scripta calling scriptb, you used to be able to give >scripta a proxy role and scriptb would also execute with that role. >However, again IIRC, in current Zope releases, if you give scripta a >proxy role, when it calls scriptb, scriptb will just run with the roles >of the current user. > >Have I got this right? If so, I wonder why the change was made... > >Chris > > >

1 0

Re: [Zope] restricting permissions for direct access only
by Michael Shulman 16 Feb '06

16 Feb '06

Okay, I must be the most moronic user ever. The default text in a newly created Python Script, which I did not bother to change for my test case, accesses meta_type, but I did not notice this; thus I was confused. (Just out of curiosity, what permissions are required to access meta_type?) But... it's still not working for my real site. I think the issue is this. If script1 has proxy role Manager, and script2 has view permissions set only for Manager, then script1 can call script2, no problem. But if script1 instead calls script3, which then calls script2, it doesn't work unless script3 *also* has proxy role Manager. Is there a way to make scripts inherit proxy roles from their callers? Or am I confused once again? mike On 2/14/06, Chris Withers <chris(a)simplistix.co.uk> wrote: > Michael Shulman wrote: > > Thanks Lennart! Proxy roles do sound like the answer, but I cannot > > get them working. When I restrict my private script so that only > > Managers have View permissions and give my public script Manager proxy > > roles, I am still prompted for a login box when I try to view the > > public script. When I cancel, I get the following error: > > > > Error Type: Unauthorized > > Error Value: You are not allowed to access 'meta_type' in this context > > On what line in either of your scripts do you access meta_type? > > > What does it mean and how do I fix it? > > I means something tried to access an object's meta_type but didn't have > the necessary roles to do so. You may wish to look at the > verbose-security options in zope.conf... > > cheers, > > Chris > > -- > Simplistix - Content Management, Zope & Python Consulting > - http://www.simplistix.co.uk > > >

2 1

major problems placing authentication on an extranet site-security flaw?
by michael nt milne 16 Feb '06

16 Feb '06

Hi I have major problems here trying to set-up authentication over a whole Plone site using Zope. Using my superuser account I've navigated to the site root page in the ZMI where it lists all the site pages and objects etc. I've then gone into security, scrolled down to the bottom and for the 'View' option I have tried all combinations of 'Manager', 'Authenticated' and 'Aquire'. It simply won't work. I get a pop-up box but the superuser manager pass doesn't work. Then, even with 'authenticated' checked and using a different browser to the one I'm using for the management screen, clicking return on the login box over and over again eventually produces the front page sans CSS. It shouldn't do this and when the extranet is live, if the public were to be able to view it this would be a serious risk. I've set view to authenticated only but it still lets me in. I find the Zope security, permissions set-up hideously complex and unusable to be honest and it doesn't even seem to work. Very frustrated. -- Michael

20 67

Does Zope 3.2 need to use a separate instance of twisted?
by Mark, Jonathan (Integic) 16 Feb '06

16 Feb '06

My website already had an existing install of twisted. I then installed Zope 3.2, and it looks to me as if Zope 3.2 installed a second version of twisted. Does Zope 3.2 install a modified or hacked version of twisted? If not, how hard would it be to modify Zope 3.2 to use the existing version? I don't see any reason to have a current version of twisted that I use for everything else, and then an older version that Zope 3.2 uses.

1 0

Re: Zope Digest, Vol 21, Issue 24
by Michael Shulman 16 Feb '06

16 Feb '06

On 2/16/06, zope-request(a)zope.org <zope-request(a)zope.org> wrote: > The only change I recall to how proxy roles work is that proxy roles > used to *augment* a users' roles; now they *replace* them. > > I don't know that the case you are talking about (S1 has proxy roles, > calls protected S2 fine, but fails when calling PR-less S3 which calls > S2) ever worked under either scenario. Proxy roles have always only > been checked for the "topmost" object on the executable stack (S1 in the > first example, S2 in the second). Regardless of whether it used to work, I think it would be nice if it did. Is there a reason for it not to be made to work? E.g. do something like walk backwards through the call stack and as soon as you find something that has proxy roles, use those, while if you don't find any, use the user's roles. Mike

1 0

Re: [Zope] Zope 2.9 and SSL
by Janusz Zamecki 16 Feb '06

16 Feb '06

zope napisa?(a): > Hi, > > zhttps provides an HTTPS Zserver to Zope-2.9.0. This zope product uses > M2Crypto. I think this may give you a hint towards SSL and Zope-2.9.0 > > http://www.zope.org/Members/lerouxa/zopehttps > > Try it first with test certificates provided with > M2Crypto/demo/zope/{ca.pem,server.pem,dh1024.pem,randpool.dat} > > > Best regards > > Al > Hello, thank you. I've tried to install this software, but it doesn't work. First of all the downloaded package seems to be inclomplete. bunzip complains about garbage at the end of the file. Second, after copying files and patching __init__.py in the ZServer directory, zope doesn't start anymore. It complains about missing HTTPS_Server package. If I borrow this one from m2crypto 0.15, then it complains about missing asyncore, then missing FCNTL. I'm stuck. What else can I do? Best regards, Janusz

2 1