- Zope - Zope lists

issues of trust, why security via mod_rewrite fails
by Jamie Heilman 03 Jun '03

03 Jun '03

Since February I've been railing on about the importance of protecting your Zope installations and their Products with rewrite rules and URI filters. Well, unfortunately I was overlooking something rather obvious--Zope's built in magical type coercion gets around most URI matches entirely. The rewrite rules I've suggested in the past aren't enough. If this style of filtering is to be continued it must be augmented with filters that are capable of examining the request resource, the query parameters, and basically anything that can externally control Zope's traversal stack. Couple of brief examples; whereas before you may have desired to filter access to the HelpSys mechanism (a notorious leak of information[1] about what products your zope service has installed as well as a potential vector for other badness) by doing something like RewriteCond %{REQUEST_URI} /(Control_Panel|HelpSys)(/|$) RewriteRule .* - [F] in your Apache configuration, now I realize its not enough. Getting around that restriction is as easy as http://examplehost/?HelpSys:method= The type coercion hooks, :method, :action, :default_method, etc. evidently alter the traversal stack. Even stuff like http://examplehost/?_vh_foo:method= will work, bypassing the URI filters I've been extolling[2] for protecting Virtual Host Monsters. Dylan had good reason to voice suspicion about type coercion back in March[3], but the issue was skirted and ended up focusing on tainting application data (which, of course, is also important). So where do we go from here? Its becoming evident to me that while I can probably finagle a rewrite rule that looks for certain tainted names in the GET and POST query variables, Zope has more avenues of control than your typical web application. There's still things like WebDAV, XML-RPC, etc. to worry about, any of which may contain additional hooks which allow frobbing the traversal stack. Writing filters for all those is going to be seriously trying. I'll postulate that the path of least resistance is simply giving up any hope of filtering requests for sanity, and instead focusing on replacing the problem Products and establishing new, secure, paths of configuration. HelpSys should not allow non-authenticated access. VirtualHostMonsters should not obtain their rewriting information from the traversal stack, indeed the traversal stack should not be viewed as a source of trusted information, much like the the request URIs can't be viewed as trusted[4]. ... and so on. This should be fun. -- Jamie Heilman http://audible.transient.net/~jamie/ "We must be born with an intuition of mortality. Before we know the words for it, before we know there are words, out we come bloodied and squalling with the knowledge that for all the compasses in the world, there's only one direction, and time is its only measure." -Rosencrantz [1] http://marc.theaimsgroup.com/?l=zope-dev&m=103893600209090&w=2 [2] http://marc.theaimsgroup.com/?l=zope&m=104426779414836&w=2 [3] http://marc.theaimsgroup.com/?l=zope&m=104718222616059&w=2 [4] http://collector.zope.org/Zope/813 I should point out the VHM workarounds for bug 813 I mentioned are made moot by this latest realization, the only sane thing to do now is to patch, patch, and patch some more.

2 4

Function Reduce() Does Not Work in Python Scripts
by Edward Pollard 03 Jun '03

03 Jun '03

And it hasn't for a very long time: http://mail.zope.org/pipermail/zope-dev/2001-December/014461.html Any idea why? We're running 2.6/2.6.1 Ed

2 1

LDAPUserFolder configuration
by Anthony Busnel 03 Jun '03

03 Jun '03

Hello. Sorry if it's hard to read me, but I'm a french student, so ... Here's my problem : I have installed LDAPUserFolder product without too many difficulties. I can connect to the LDAP server, and read what is inside. But I can't add new users, maybe because of the rights. Into the configure panel of the acl_users directory (/Control_Panel/Products/LDAPUserFolder/acl_users), there's a 'Manager DN Usage' field with 3 choices : Never, Always, For login data lookup only. If I set 'Always' and Apply, Zope doesn't like and display something like that : Zope Error Zope has encountered an error while publishing this resource. Error Type: INVALID_DN_SYNTAX Error Value: {'desc': 'Invalid DN syntax', 'info': 'invalid DN'} What's the problem ? I'm learning how to use Ldap, so I'm a bit lost. Just for information, I'm working under Linux-Debian. Thanks a lot for your assistance. Anthony [One love, One peace] |Keep it real| _________________________________________________________________ MSN Messenger : dialoguez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

2 1

AttributeError __getslice__ from Zope Construction Kit book
by hpinson＠indepthl.com 03 Jun '03

03 Jun '03

Hello. I've been through the Zope "Web Application Construction Kit" book tutorial, chapter 5, "Building a Portal and Adding Serices" "Creating a Type with ZClasses", twice now. Each time, when attempting to add the new ZClass object in a user folder, this error is generated: Error Type AttributeError Error Value __getslice__ Does anyone have any sense of what this means and how to fix it? My Zope is 2.6.0 running on Redhat 8. Thanks. Harlow Pinson Indepth Learning Email: hpinson(a)indepthl.com Web: http://www.indepthl.com Voice: 505-994-2135 FAX: 208-475-7678

2 2

<dtml-var> and double quotes in variable name
by Derek Basch 03 Jun '03

03 Jun '03

Hello all, I am wondering if there is any way to include double quotes in a <dtml-var> name? For instance: <dtml-var /"Date/"> assuming / escapes the double quote. I ask because the variable is referencing an SQL field name that is also a Interbase/Firebird keyword. (Date, Time, etc...). Interbase requires a pair of double quotes in such a situation. Thanks Everyone, Derek Basch __________________________________ Do you Yahoo!? Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com

2 1

why this link is not working properly?
by Jianping Zhu 03 Jun '03

03 Jun '03

I have redhat 7.1 box with zope on it. I have a link to a microsoft .pdf file, http://coopunit.forestry.uga.edu/unit_homepage/Conroy/projects/pnwr_arm/new… in the lower part links: 2000 1999 1998 1997 1996 link 2000 works fine but when i click 1999 (WebBouser), the pdf file does not appear. how can i settle this problem? Thanks

2 1

Navision C/ODBC
by Alexandré Soumbatov 03 Jun '03

03 Jun '03

Hi *, Is anybody have successfuly access Navision from ZOPE via C/ODBC? By me it's working only if Navision installed localy. If I try to access Navision server via TCP allways came error: Invalid connection string I have tried Z ODBC DA (ZODBCDA-3.1.0b2-win32-py21.tgz) Thank you, _____________________________________ Internal Applications Dipl.-Inf. Alexandré Soumbatov Tel +49 30 55115-339 Fax +49 30 55115-143 alexandre.soumbatov(a)spmtechnologies.com SPM Technologies Deutschland GmbH An den Treptowers 1 12435 Berlin, Germany www.spmtechnologies.com

1 0

Backing up Data.fs
by jamesd＠mena.org.au 03 Jun '03

03 Jun '03

I'm currently trying to work out an effective backup solution for my zope servers. My current system involves shutting down the server, copying the zodb, and then starting the server again. This works, but leaves the site down for several minutes. Is it possible to do the equivilant of a sync and remount read-only? Or is it safe to just copy the ZODB from a live site? I'd also like to hear ideas on how others have setup their backup systems. exporting is not an option as my plone sites do not always correctly reimport. -James Davies (jamesd(a)mena.org.au)

6 8

Zope-2.5.0 stopped starting up
by Daniel Mahler 03 Jun '03

03 Jun '03

Hi, A Zope server that has been serving us faithfully for many months has stopped restarting. When it was brought down, Data.fs was hitting the Linux 2G file limit, but Zope was still operating correctly, but was refusing zwiki updates. I brought it down so I could back up Data.fs in a consistent state. When I try to bring it back up I get a continuous stream of error messages: /home/mahler/local/lib/python2.1/regsub.py:15: DeprecationWarning: the regsub module is deprecated; please use re.sub() DeprecationWarning) !k/usr/local/zope/lib/python/ts_regex.py:15: DeprecationWarning: the regex module is deprecated; please use the re module import regex, regsub #, Sync /home/mahler/local/lib/python2.1/regsub.py:15: DeprecationWarning: the regsub module is deprecated; please use re.sub() DeprecationWarning) /usr/local/zope/lib/python/ts_regex.py:15: DeprecationWarning: the regex module is deprecated; please use the re module import regex, regsub #, Sync /home/mahler/local/lib/python2.1/regsub.py:15: DeprecationWarning: the regsub module is deprecated; please use re.sub() DeprecationWarning) /usr/local/zope/lib/python/ts_regex.py:15: DeprecationWarning: the regex module is deprecated; please use the re module import regex, regsub #, Sync /home/mahler/local/lib/python2.1/regsub.py:15: DeprecationWarning: the regsub module is deprecated; please use re.sub() DeprecationWarning) /usr/local/zope/lib/python/ts_regex.py:15: DeprecationWarning: the regex module is deprecated; please use the re module import regex, regsub #, Sync /home/mahler/local/lib/python2.1/regsub.py:15: DeprecationWarning: the regsub module is deprecated; please use re.sub() DeprecationWarning) /usr/local/zope/lib/python/ts_regex.py:15: DeprecationWarning: the regex module is deprecated; please use the re module import regex, regsub #, Sync /home/mahler/local/lib/python2.1/regsub.py:15: DeprecationWarning: the regsub module is deprecated; please use re.sub() DeprecationWarning) As far as I know nothing was done to the installation, and it used to work just fine. Any ideas ?!? thanks D

6 9

Call for Participants for Zope 3 Sprint before Europython 2003 in Belgium (correction)
by Grégoire Weber 03 Jun '03

03 Jun '03

Hi everybody, As Guido van Rossum has noticed june 24 is a tuesday not a thursday :-) To avoid confusion below the corrected version of the Zope 3 sprint call for participants. -------------------- The Zope 3 sprint in Louvain-la-Neuve at the local university before the Europython conference is now definitive. When: Three days from june 22 to 24, 2003 (sunday to tuesday). Registration: If you decided to participate the sprint just drop me a e-mail and register your name and e-mail in the sprint wiki (see below). Accomodation: Take care to decide on participation as early as possible. Quick reservation is needed because there seems to be only little place to stay in Louvain-la-Neuve! If possible, plan to arrive on saturday evening/night. This way we don't lose time on sunday morning. Godefroid will help us moving from Louvain-la-Neuve to Charleroi Wednesday morning. So it would make sense to book the night in Louvain-la-Neuve from tuesday to wednesday also. Sprint Coaches and Topics: Experienced people like Steve Alexander, the codeworks people (Albertas Agejevas, Marius Gedminas, Viktorija Zaksiene), Martijn Faassen and possibly Godefroid Chapelle will act as Coaches. Topics will be determined definitively during the next weeks. Sprint Preparation: There is a good description about how to prepare for a sprint on <http://dev.zope.org/Wikis/DevSite/Projects/ComponentArchitecture/CMSprintPr…> Further information: <http://dev.zope.org/Wikis/DevSite/Projects/ComponentArchitecture/EuroPython…> More infos to come. Questions? gregoire.weber at switzerland.org regards, Godefroid Chapelle and Gregoire Weber _____________________________________ Grégoire Weber Rigistr. 31 CH-8006 Zürich Switzerland phone: +41-(0)1-361 66 11 mobile: +41-(0)79-44 11 457 mailto:gregoire.weber@switzerland.org

1 0