- Zope - Zope lists

More regular expressions security
by Tue Wennerberg 20 Jan '03

20 Jan '03

Regular expressions should be allowed by default. I've spent some time trying to find out why regular expressions are not allowed in Zope throught-the-web development. The answer I hear is: "Because it's a security issue". Digging a little deeper, it turns out to be because TTW script developers can cause a Denial of Service from Zope by writing a particular nasty regular expression in a script, causing Zope to use 100% cpu time. So it's a question of trust. But surely a script developer can be trusted not to cause a DoS on the site he's working on! Script developers should be empowered, not crippled! Some common objections: "People can just write an external scripts instead." - True, but it also makes everyday work much more cumbersome. And some script developers don't have access to the file system. Surely, TTW scripts exist to make life easier for site developers. "The administrator can allow the 're' module." Also true, but some people won't do that because they think it will expose their site to all kind of attacks from anonymous users. This isn't the case (or is it?). So there it is. I'm writing this because I think that Zope is missing out on a great feature, and because I haven't gotten any answers indicating that there are other (worse) reasons why regular expressions are banned. Am I wrong? Am I being silly here? Sincerely, Tue Wennerberg Civilingeniør og Freelance Udvikler http://tuewennerberg.dk/ - tue(a)wennerberg.dk - (+45) 4043 6735

5 7

simple counter?
by Sungmook Kim 19 Jan '03

19 Jan '03

Hi, how can i add a simple counter within zope? of course it should prevent the reload of the same user or ip. thanks & cheers, sungmook __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Bis zu 100 MB Speicher bei http://premiummail.yahoo.de

3 4

Re: [Zope] Re Re: Regular expressions insecurity?
by Dennis Allison 19 Jan '03

19 Jan '03

According to an earlier post, re is not available n Python Scripts because they can be the source of a DOS attack. In my systems, I've decided that such attacks are an acceptable risk. I have enable re for Python Scripts in my system(s). Apparently this is a common practice. Follow the instructions in the PythonScript sources. Of course, you need source code access.

2 1

Emacs, TRAMP, and frustration
by Tom Emerson 19 Jan '03

19 Jan '03

Recent versions of GNU Emacs have replaced ange-ftp with tramp, and I cannot get this to work. Various Google searches have yet to show a simple explanation of how to make this work. For example, from my FreeBSD machine (running Emacs 21.2.1 and no tramp) I can get the listing of the top-level of a Zope development server with the path: /admin@luxor 8021:/ and it works great. On my laptop (Mac OS X 10.2.3, GNU Emacs 20.3.5.1) this doesn't work: I cannot connect to a Zope server running locally. Specifying /admin@localhost 8021:/ yields an error, "Not a tramp file name: /admin@localhost 8021:/" If I use instead /ftp:admin@localhost 8021:/ I get a message "tramp: Waiting 60s for prompt from remote shell" followed by "Login failed" about a minute later. I can see how tramp can be a really nice improvement for many tasks, but the lossage with using it to attach to ftp sites on non-standard parts is a Royal PITA. Has anyone been able to get this to work? Thanks in advance, -tree -- Tom Emerson Basis Technology Corp. Software Architect http://www.basistech.com "Beware the lollipop of mediocrity: lick it once and you suck forever"

1 0

Re: [Zope] using apache as proxy for file downloads
by Asad Quraishi 18 Jan '03

18 Jan '03

Thanks Jimi, Unfortunately I need to serve this from apache on port 80. I am using a rewrite rule to direct traffic to the zope Zserver on port 8080 locally. Regards, Asad Jimi Thompson wrote: > I haven't tried this, but I suspect that it would work and it wouldn't > required the proxy config. Install apache and set the port to > something that Zope (and all the other services you have) isn't > using. I'm going to guess at 8181. Link the file in Zope back to the > URL at port 8181. <a > href="http://www.mydomain.com:8181/myfile.pdf">download here</a> > > This would link the file back to your apache instance who would serve > the file. > > HTH, > > Jimi > >> Zope handles the downloads of large files pretty poorly - at least >> that's my experience in its standard config. Someone had mentioned >> using apache as a proxy for file downloads. Can anyone point me in >> the right direction for accomplishing this? >> >> Regards, >> >> Asad >> >> >> _______________________________________________ >> Zope maillist - Zope(a)zope.org >> http://lists.zope.org/mailman/listinfo/zope >> ** No cross posts or HTML encoding! ** >> (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce >> http://lists.zope.org/mailman/listinfo/zope-dev ) > > >

1 0

ExternalEditor and refresh ?
by Joachim Schmitz 18 Jan '03

18 Jan '03

I wanted to play around a little bit with ExternalEditor, and enabled refresh for the product, but after refreshing it once without having made any changes, I get this Error when clicking on any folder: Error Type: AttributeError Error Value: 'None' object has no attribute 'aq_base' ..... File <string>, line 0, in ? File /usr/local/ZopePark/lzope.aixtraware.de/ZInstanceHome/Products/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEdit or/ExternalEditor/ExternalEditor/ExternalEditor/ExternalEditor.py, line 142, in EditLink (Object: Admin) some kind of recursion seams to be going on. This is v 0.6 of EE. Mit freundlichen Grüßen Joachim Schmitz -------------------------------------------------------------------- AixtraWare Ingenieurbüro für Internetanwendungen Hüsgenstr. 33a, D-52457 Aldenhoven Telefon: +49-2464-8851, FAX: +49-2464-905163 -------------------------------------------------------------------- Key fingerprint = DA10 CC82 62F8 1DBB 39A1 1EDC 725B 3317 A8D7 C3A6 Keyserver: http://www.keyserver.net/en/

2 1

Re: manager can, proxy role manager cannot
by Geoff Horne 18 Jan '03

18 Jan '03

Dieter Maurer wrote : > An old bug (already in the collector): and several times discussed > in the mailing list (--> archives). > > "CopyContainer._verifyObjectPaste" makes its checks without > taking the execution context (i.e. Proxy Roles and Ovnership) > into account. > > Your only chance it to fix the bug. If this is such an old bug, there must be some sort of workaround ?? I want to give even Authenticated users the power to rename objects, but I don't want to give them manager access. Does anyone know why it hasn't been fixed ?? ---------------------------------------------------------------------------| Geoff Horne http://www.interop.com/interopnet Senior Network Engineer http://www.ilabs.interop.net ---------------------------------------------------------------------------| "Don't take life too seriously, you don't get out of it alive anyway" Burt Ward

2 1

using apache as proxy for file downloads
by Asad Quraishi 18 Jan '03

18 Jan '03

Zope handles the downloads of large files pretty poorly - at least that's my experience in its standard config. Someone had mentioned using apache as a proxy for file downloads. Can anyone point me in the right direction for accomplishing this? Regards, Asad

2 1

Acess zope with python
by Carlos Eduardo 18 Jan '03

18 Jan '03

I want to do a python method that import an object( Myapplication.zexp) to a folder in the zope server, but the method is in the file sytem, because i have to init the method with 'python installMyapplication.py'. The idea is to make a instalation script to a zope application. Anyone knows a method in python's API that can do it? Or a method that i can acess zope and pass as a parameter "manage_importObject('Myapplication.zexp')"? Or any other solution. PS: My OS is Linux. Thank you, Carlos Eduardo

2 1

Frame object??
by Chris Muldrow 18 Jan '03

18 Jan '03

This is a possibly dumb question, but here goes. When I go to a copy of my home page in debug mode, I see several messages that say <frame object at 0xb78be38> and various other frame object references. What's a frame object? Does this sound like one of my methods puking up junk that shouldn't be puking up?

2 1