- Zope - Zope lists

RE: [Zope] Help: mod_proxy exploit on apache + zope
by Wayne Connolly 14 Mar '03

14 Mar '03

Dave and Jean, Thanks very much for your help... i tried first of all Jeans soln(http://groups.yahoo.com/group/zope/message/110797) which didnt work. Then i tried Daves (http://groups.yahoo.com/group/zope/message/110805)and this one worked. Thanks dave... my sites are back up and running.. and even the attacks ceased... luck me.. Thank-fully i captured enough pachets from the bastard... so i believe he will feel the wrath of wayne... lucky for me he's on DSL :-) Wow... stress free again... Regards, Wayne --- In zope(a)yahoogroups.com, Dave Hall <dave-zope@d...> wrote: > On Thu, Mar 13, 2003 at 03:01:01PM -0800, Wayne Connolly wrote: > > All, > > > > My server was used for hacking other servers by some > > morons. mod_proxy was set wide open - we were getting > > used as a relay for attacks on all sorts of servers. > > For the sake of people getting attacked, I've had to > > set it to Deny from all. > > Are you using it as a regular proxy or just to front-end Zope? > > If you're just front-ending Zope, then check to make sure "ProxyResuests" > is NOT set to On. This will enable the proxy service which you don't > need. > > You will need the proxy module loaded for rewrite to fetch the URL from > Zope but you shouldn't need the proxy service enabled. > > > This seems to have broken my zope sites, however. > > Yup. mod_rewrite uses parts of mod_proxy. > > -- > > Dave > > =============================================================== > | <- You must be smarter than this stick to ride > the Internet -Mike Handler > =============================================================== > > _______________________________________________ > Zope maillist - Zope@z... > http://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope-dev ) __________________________________________________ Do you Yahoo!? Yahoo! Web Hosting - establish your business online http://webhosting.yahoo.com

1 0

Help: mod_proxy exploit on apache + zope
by Wayne Connolly 13 Mar '03

13 Mar '03

All, My server was used for hacking other servers by some morons. mod_proxy was set wide open - we were getting used as a relay for attacks on all sorts of servers. For the sake of people getting attacked, I've had to set it to Deny from all. This seems to have broken my zope sites, however. I have a machine with virtual hosts with freebsd, apache2, and zope. Im using rewrite rules to make zope work. Both mod proxy and mod rewrite are enabled. Does anyone know of a fix? We need to only allow certain interactions with zope to take place(localhost) and that is from zope domains. I heard about the use of http://httpd.apache.org/docs-2.0/mod/mod_cgid.html with zope and apache2... can anyone help? If they can ill write up a full how-to on it as it is of a high importance for zope hosters i think... Panicing, Wayne. wayne(a)c-media.com.au __________________________________________________ Do you Yahoo!? Yahoo! Web Hosting - establish your business online http://webhosting.yahoo.com

2 1

Complex <dtml-in> query sorting
by Thierry FLORAC 13 Mar '03

13 Mar '03

Hi, I have to use a <dtml-in> code to handle a quite complex thing : - I have an SQL method, which retrieves an object OID ; this OID is a globally unique identifier, which is cataloged and used in all my objects. - I have a Zope method at my site root, called "getObject(oid)", which for a given OID retrieve the corresponding Zope object - each object also have a custom method called "getSortValue()" which retrieves a sort value !! My code (in a DTML method) is like : <dtml-in "[getObject(record['oid']) for record in sql_method(params)]" sort_expr="getSortValue()"> The <dtml-in> loop works well and retrieves my object, but the "sort_expr" attribute doesn't work and so results are not sorted ; it seems that "getSortValue()" is not called on the good object... What should I have to do for this to work ??? Thanks for any help, Thierry -- Linux every day, keeps Dr Watson away... http://gpc.sourceforge.net -- http://www.ulthar.net

3 2

RE: [Zope] Help: mod_proxy exploit on apache + zope
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 13 Mar '03

13 Mar '03

Wayne, Heh, I feel for you! I've had a server hacked in the past :) Yes, you can close down your mod_proxy by simply using: <LocationMatch "^[^/]"> Deny from all </LocationMatch> I actually got that off of the Zope website. It refuses requests that don't start with "/" ... This way only requests that are local are accepted, I even tested it and it worked fine, you get a nice Apache access denied error if you try to transparently use the proxy. Hope this helps! J.F. -----Original Message----- From: Wayne Connolly [mailto:wayne_connolly@yahoo.com] Sent: Thursday, March 13, 2003 6:01 PM To: zope(a)zope.org Subject: [Zope] Help: mod_proxy exploit on apache + zope All, My server was used for hacking other servers by some morons. mod_proxy was set wide open - we were getting used as a relay for attacks on all sorts of servers. For the sake of people getting attacked, I've had to set it to Deny from all. This seems to have broken my zope sites, however. I have a machine with virtual hosts with freebsd, apache2, and zope. Im using rewrite rules to make zope work. Both mod proxy and mod rewrite are enabled. Does anyone know of a fix? We need to only allow certain interactions with zope to take place(localhost) and that is from zope domains. I heard about the use of http://httpd.apache.org/docs-2.0/mod/mod_cgid.html with zope and apache2... can anyone help? If they can ill write up a full how-to on it as it is of a high importance for zope hosters i think... Panicing, Wayne. wayne(a)c-media.com.au __________________________________________________ Do you Yahoo!? Yahoo! Web Hosting - establish your business online http://webhosting.yahoo.com _______________________________________________ Zope maillist - Zope(a)zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )

1 0

Test variable data type
by Flavio 13 Mar '03

13 Mar '03

Hi, I wonder if someone knows how to test a variables data type. e.g. if <dtml-var a> is integer or string. Thanks, Flavio Maciel IT Development & Support Welke Customs Brokers Welke Global Logistics Tel : (416)674-7606 x.268 Fax: (416) 674-1635 mailto:flavio@welke.com --- Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.461 / Virus Database: 260 - Release Date: 3/10/2003

3 2

dump a wiki?
by Ricardo Anguiano 13 Mar '03

13 Mar '03

Hello, I have a wiki with some content I would like to dump to an external file, txt, pdf or html would be fine. How do I do this? This is what I have tried so far: - wget -r URL This didn't work. Wget gets the front page, but not the rest. -m didn't help either. I can see the "href=..." links to the other pages in the wiki, but wget ignores them. :( - wiki.org FAQ http://zwiki.org/UsageFAQ#I've%20organized%20my%20pages%20in%20a%20tree%20structure.%20What%20is%20the%20easiest%20way%20to%20print%20them%20all%20? This FAQ answer refers to a PrintMethod for wikis but I can't find this product. The link points off to "Create this Page". Any help is appreciated. Thanks, -- Ricardo Anguiano http://www.codesourcery.com

3 3

Re: [Zope] Is Zope unique? Books?
by Michael Long 13 Mar '03

13 Mar '03

I am currently reading the Zope Bible and finding it very useful. The Python Developers Handbook is also a good reference to have on hand. Cheers, Mike > Hi, > > After building sites with PHP and templating engines, including PHITE... I > finally saw the light and understood the advantage of using a tool that > provides an object database at its core, and the acquisition feature. > > For my personal knowledge... is Zope unique in providing those features? > What about commercial tools like ColdFusion or MS Content Management Server? > > Also, I asked the question a couple of months ago, but can't for the life > of me find the answers to books you would recommend besides "The Zope Book" > and "Zope Web Application Development and Content Management". > > For those interested, here are others I found @ Amazon: > - The Book of Zope by Beehive > - Zope Developer's Handbook by John D. Rowell > - Zope Bible by Michael Bernstein (Author), Scott Robertson (Author) > - Zope Power Tools: by Michael R Bernstein > - Zope Web Application Construction Kit by Martina Brockmann (Editor), et al > - Professional Zope: Pro Zope by Staff Wrox Press Inc. Availability: Out of > Print--Limited Availability > - Zope by Pierre Julien Grizel Availability: This item has not yet been > released. > - Programming Zope by Gold Availability: Out of Print--Limited Availability > > Thx > Fred. > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope-dev ) > >

2 1

Re: [Zope] Is Zope unique? Books?
by Michael Long 13 Mar '03

13 Mar '03

I am currently reading the Zope Bible and finding it very useful. The Python Developers Handbook is also a good reference to have on hand. Cheers, Mike > Hi, > > After building sites with PHP and templating engines, including PHITE... I > finally saw the light and understood the advantage of using a tool that > provides an object database at its core, and the acquisition feature. > > For my personal knowledge... is Zope unique in providing those features? > What about commercial tools like ColdFusion or MS Content Management Server? > > Also, I asked the question a couple of months ago, but can't for the life > of me find the answers to books you would recommend besides "The Zope Book" > and "Zope Web Application Development and Content Management". > > For those interested, here are others I found @ Amazon: > - The Book of Zope by Beehive > - Zope Developer's Handbook by John D. Rowell > - Zope Bible by Michael Bernstein (Author), Scott Robertson (Author) > - Zope Power Tools: by Michael R Bernstein > - Zope Web Application Construction Kit by Martina Brockmann (Editor), et al > - Professional Zope: Pro Zope by Staff Wrox Press Inc. Availability: Out of > Print--Limited Availability > - Zope by Pierre Julien Grizel Availability: This item has not yet been > released. > - Programming Zope by Gold Availability: Out of Print--Limited Availability > > Thx > Fred. > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope-dev ) > >

1 0

ZCatalog and phrase searching
by Chris Humphries 13 Mar '03

13 Mar '03

hello all, question is about how exactly zcatalog does phrase searching. from going thru the source, i am having a heck of a time trying to find where it actually does something with the search string (so i can tell how it uses it to search). the problem is that there is a requirement to be able to search for "string exactly like this", and we are using zcatalog to search over our zope content objects. now from how it is now, i am uncertian that if 1) zcatalog can do that and 2) if it can, how?. it seems to search for "string" AND "exactly" AND "like" AND "this" when that is not the desired behavior. we want it to be 4 words treated as one entity to search on, and not 4 seperate entities. if i have communicated well enough across, can you tell me if this is possible with zcatalog, and if so how do i do it? thanks, chris

2 2

ZCatalog and phrase searching
by Chris Humphries 13 Mar '03

13 Mar '03

hello all, question is about how exactly zcatalog does phrase searching. from going thru the source, i am having a heck of a time trying to find where it actually does something with the search string (so i can tell how it uses it to search). the problem is that there is a requirement to be able to search for "string exactly like this", and we are using zcatalog to search over our zope content objects. now from how it is now, i am uncertian that if 1) zcatalog can do that and 2) if it can, how?. it seems to search for "string" AND "exactly" AND "like" AND "this" when that is not the desired behavior. we want it to be 4 words treated as one entity to search on, and not 4 seperate entities. if i have communicated well enough across, can you tell me if this is possible with zcatalog, and if so how do it do it? thanks, chris

3 2