- Zope - Zope lists

CBSNewYork.com using ZUBB!?!
by BZ 03 Apr '02

03 Apr '02

Oh yes, they are. http://cbsnewyork.com/message/ground/ Tee hee. Now I am regretting the open source idea.. (Just kidding). ZUBB's new home: http://www.bluewildfire.com/products/zubb/ BZ

3 2

Re: [Zope-dev] Re: [Zope] isecure XML-RPC handling.
by Oliver Bleutgen 03 Apr '02

03 Apr '02

R. David Murray wrote: > On Tue, 2 Apr 2002, Eron Lloyd wrote: > >>The problem here seems to be that you are trying to do XML-RPC communication >>with a version of Zope that doesn't support XML-RPC out of the box. You >> > > I think most people missed the point here. I don't think Rossen > is asking for help on running zope or getting xml-rpc to work with > it. He's observed a "security" problem: he believes the fact that > a traceback including path names is included in the error response > is a security exposure. This has been discussed on zope-dev before, > but the fact remains that the security community *does* treat > exposure of filesystem path information as a security issue. > > I believe the addition of the variable to control what happens with > tracebacks addresses this issue from a security standpoint, which > is probably all that Rossen cares about with regards to letting > bugtraq know that "the security bug has been fixed". Just to add some weight to this point, let's search google: http://www.google.com/search?q=%22path+disclosure+vulnerability%22 I don't care too much about this bug (let's call it a bug), but it indeed has enough weight to get zope quite a bad reputation in the security community. Oh, and each and every instance of these "vulnerabilities" got patched by the vendors, so they seem to take it seriously also. cheers, oliver

1 0

RE: [Zope] unix security patch
by Dunigan, Craig 03 Apr '02

03 Apr '02

Toby's point still applies. In order to run on a privileged port, zope must be started as root. I have another question for you, though. Are you sure you installed zope with the -u switch to tell it that you would be running it as a non-privileged user? Something like './install -u zope -g zopegroup' for the binary version? That could account for what you're seeing. Even so, it still must be started as root in order to use port 80. There's just no way around that. > -----Original Message----- > From: notices name [mailto:notices@fiberfolk.com] > Sent: Wednesday, April 03, 2002 5:43 AM > To: tdickenson(a)geminidataloggers.com; notices(a)fiberfolk.com > Cc: zope(a)zope.org > Subject: Re: [Zope] unix security patch > > > I believe I want -u zope because I don't have Apache, zope is > the web server. > So zope has to serve on port 80. Thanks, > Annie > > --- Toby Dickenson <tdickenson(a)devmail.geminidataloggers.co.uk> wrote: > >On Tue, 2 Apr 2002 09:43:42 -0800 (PST), notices name > ><notices(a)fiberfolk.com> wrote: > > > >>and then I edited start to add -u zope > > > >that means zope is going to *change* to the new user. It can only do > >that if started as root. This is a little more difficult to set up, > >but necessary if (and only if) you want zope to listen on a low > >numbered port (80, 21, etc) > > > >An alternative is to change to that new user before starting zope. > >Then you dont need any -u switch, but you have to use a high numbered > >port (such as 8080) > > > > > > > >Toby Dickenson > >tdickenson(a)geminidataloggers.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

Re: [Zope] xml-rpc with Java - binary data
by Bak ＠ kedai 03 Apr '02

03 Apr '02

>i have a little big Problem with the xml-rpc in Zope. Is it possible to >transport binary Data (e.g. Images) with xml-rpc to a Java-Client ? I have we cant marshall binaries with xml-rpc convert it to string first, methinks uuencode would convert bins to string, if i'm not mistaken hth

1 0

Re: [Zope] xmlrpclib and zope
by Bak ＠ kedai 03 Apr '02

03 Apr '02

>Ok, now I've done it -;^>= > >The weapons: >python (2.1.1) >xmlrpclib (0.9.9) >zope (2.5.0) >ParsedXML (1.2.1) > >First issue: >I also have the dreaded message: > > "objectIds has no docstring. Patch your ObjectManager.py so > that objectIds has a docstring and restart Zope" iirc, objectIds used to be public, until ZC (and the community) decided that they give out too much infos since anon users can browse it. have you looked at this howto? http://www.my-zope.org/HowtosRating/20020109152901 hth >Mitch Pirtle >Corporate Security Officer >Kühne & Nagel Management AG >Tel: +41 1 786 96 45 >Fax: +41 1 786 95 95 > > >_______________________________________________ >Zope maillist - Zope(a)zope.org >http://lists.zope.org/mailman/listinfo/zope >** No cross posts or HTML encoding! ** >(Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

Re: [Zope] Zope Mascot? :-)))
by oliver.erlewein＠sqs.de 03 Apr '02

03 Apr '02

Hi Rudi Take a plunge and dive your way through some Pyton and DTML! ;-) Maybe you'll see some Zope-fish! Oliver

1 0

Zope Mascot? :-)))
by oliver.erlewein＠sqs.de 03 Apr '02

03 Apr '02

Hi all Sometime ago there was a discussion on a Zope mascot. I've found something on the german site "wisse.de". It seems that Zope is some kind of carp (the fish!)... wissen.de Searchresult for "zope": Zope die; slawisch Abramis ballerus bis 30 cm langer, in den Süßwässern ostwärts des Rhein verbreiteter, dem Blei sehr ähnlicher Karpfenartiger Fisch; nährt sich von Zooplankton, überwintert in Gruben; Fleisch sehr grätenreich. Verwandte Artikel Blei (Zoologie) OR FOR OUR ENGLISH READERS: http://www.fishbase.org/Summary/SpeciesSummary.cfm?genusname=Abramis&specie… Regards Oliver Erlewein ;-)))

4 6

FIND AND REPLACE
by Alejandro T. Singer 03 Apr '02

03 Apr '02

I have to change on more than 700 dtml pages the syntax of a link. There's any automatic way on ZOPE to find and replace those parts of code ? Thanks Alejandro

4 3

xmlrpclib and zope
by Mitch Pirtle 03 Apr '02

03 Apr '02

Ok, now I've done it -;^>= The weapons: python (2.1.1) xmlrpclib (0.9.9) zope (2.5.0) ParsedXML (1.2.1) First issue: I also have the dreaded message: "objectIds has no docstring. Patch your ObjectManager.py so that objectIds has a docstring and restart Zope" It would be kewl if someone had some more information than this vague, Redmondish message. Second issue: >From python using xmlrpclib, I can call DTML Documents/Methods that do not reference directories. But if I include something like: <a href="&dtml.url-directory;">directory</a> Then Zope fails to fetch index_html from directory. ? Is this in my installation, a bug with Zope's xmlrpc implementation, or what? I would think that my dtml.url stuff is pretty generic and common... Third issue: I have a folder "xml", and in that folder is a Parsed XML Document "faq". I can successfully see the contents with the URLs like: http://localhost:8080/xml/faq/0/1 But from python and xmlrpclib to access Zope (already tested with simple stuff like "index_html"), I get: Traceback (most recent call last): File "<stdin>", line 1, in ? File "/usr/lib/python2.1/xmlrpclib.py", line 660, in __call__ return self.__send(self.__name, args) File "/usr/lib/python2.1/xmlrpclib.py", line 809, in __request verbose=self.__verbose File "/usr/lib/python2.1/xmlrpclib.py", line 692, in request return self.parse_response(h.getfile()) File "/usr/lib/python2.1/xmlrpclib.py", line 731, in parse_response return u.close() File "/usr/lib/python2.1/xmlrpclib.py", line 439, in close raise apply(Fault, (), self._stack[0]) xmlrpclib.Fault: <Fault -1: 'Unexpected Zope exception: cannot marshal <extension class Acquisition.ImplicitAcquirerWrapper at 402f1f00> objects'> So who's "Fault" is it, and how can I get on with my life using xml-rpc? The only HOWTO I can find is from January 2000! -- Mitch Pirtle Corporate Security Officer Kühne & Nagel Management AG Tel: +41 1 786 96 45 Fax: +41 1 786 95 95

3 2

��Ŭ�� ٸ�� տ� �� !! [��]
by �� 03 Apr '02

03 Apr '02

1 0