- Zope - Zope lists

Re: [Zope] CoreSessionTracking: Brute-Forcing Web Application Session IDs
by Frank Tegtmeyer 27 Nov '01

27 Nov '01

"Chris McDonough" <chrism(a)zope.com> writes: > This is annoying, of course, but it's not too bad yet. Yes, it's annoying and because it can be made harder easily I recommend to do so. That's the thing I wanted to point out. > casually guess (19 characters, 8 of which are randomly generated), are > there mitigatable risks which have a solution that doesn't depend on > unchanging IP addresses that I'm overlooking? It's very cost effective to integrate a hash and a secret: It does cost nearly nothing for you, the maintainer of CoreSessions and it really costs nothing besides a few CPU cycles for the sites using it. But it makes it *much* harder for potential attackers to go for a session id. So I think it should be done:) Of course you are right to tell the people not to rely on sessions for sensitive data. For that there should be an integrated solution to require SSL for sensitive pages/views. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany

3 2

RE: [Zope] can I move my zope site off zope?
by sean.upton＠uniontrib.com 27 Nov '01

27 Nov '01

Ok, time to put on my advocacy hat... You have indicated you would be using PHP, so let me give you my personal opinion, for what it is worth: Mixing SQL/code/HTML in the same file/module is bad bad bad. After doing a big team-developer project in ASP a few years ago, I see the inherent lack of scalability of this sort of setup; with ZPT, ZSQL methods, etc in Zope, you get true separation of concerns, modularized code you can unit-test (without having to resort to functional software testing). For working with relational data, here's my personal opinions: Fair: ASP/PHP/JSP Good: ASP+COM/PHP+MODULES/JSP+EJB Better: Zope with DA/ZSQL methods / TTW python scripts / ZPT uses the TTW Python scripts Best: Python API / abstracted framework for data access, used by Zope Python product; well documented with UML diagrams of class relationships and inheritance; ZPT for presentation. Persistent objects in ODB represent underlying relational data. Reuse of code and patterns on future products. I don't understand what you mean a DA is hard to set up... for me, "apt-get install zope-mysqlda" worked for me ;) Your app is "distributed?" Lots of PHP apps used shared memory for IPC, or make you broker things like session data and stuff normally done in memory into your RDB if you want to make them cluster-safe. ZEO with Zope is soooooo much easier, and very transparent - it makes the burden of clustering a sysadmin job and NOT a developer job. Use ZPT for the templating, and Python products for your code, and restricted TTW python scripts as glue when necessary. Since you are obviously concerned with application interoperability, why not consider that you are not likely to get stuff like XML-RPC working out of the box with PHP. Also, IHMO, there is a better way to do this in Zope and get the interoperability you desire: a hybrid persistent object+relational storage model. I have an application I'm building now that will store between half-a-million to a million records scattered over several databases and about a dozen tables in a MySQL InnoDB tablespace; all work is handled in an API I built from scratch for this project that maintains thread-safe connections to the database and an abstracted OO API to the data, which handles things like MySQL transactions, database integrity, and data access, bypassing the use of a DA/ZSQL methods altogether. The core API is done in Python using MySQLdb; you create a DB class designed to handle connections and basic operations, as well as a record class for each logical view of your underlying relational database. The key to getting the most out of this setup is that the API is used by a Zope product module that creates proxy objects (subclassed from the previously mentioned record API object, CatalogAware, and SimpleItem) for each of these logical views, and stores them in a container for each view (a container class subclassed from BTreeFolder). The proxy objects do nothing but provide an object-per-record in a view; making these proxy objects persistent allows a useful hybrid storage model, which you can then catalog the data using ZCatalog, and present things like full-text indexes through Zope for any relational data. The downside to this is that it makes you do more work than simply using a DA... but it buys flexibility... The upside to this is that the design pattern works, provides all the key components of a very object-oriented way of doing things; and once you do your first project for relational data this way, you can reuse the same design patterns on your next relational data integration project in a fraction of the time. Doing this really requires you to be able to know your underlying API, and the use of UML class diagrams of your API on your first project is very helpful as a reference for using this design pattern and to apply to later projects using similar techniques. My honest opinion: if you are willing to do things right, for big projects with multiple developers or a need for reusable code and/or patterns, Zope is a better platform than any light-weight template/code hybrid framework like PHP/ASP/JSP, etc. My company uses PHP for lightweight stuff, including some simple task automation, but for any heavy-duty tasks, we use Zope; and there is nothing to preclude using both, if you use relational data or an interoperability standard like XML-RPC. And to be honest, I think the best thing about Zope is this: 6 months from now, if you want to reuse - or for that matter re-read - your own code, Python is going to be far superior to any other language, especially if you have to fight your way through all the HTML in that same module/file with a machete! Sean -----Original Message----- From: Jacob Singh [mailto:jacob@prisonbooks.org] Sent: Tuesday, November 27, 2001 7:35 AM To: zope(a)zope.org Subject: [Zope] can I move my zope site off zope? So I'm considering doing a major product with zope, and I'd like to hear what people think about taking a site off of zope. I know it's a great framework to build in, but I'm really used to Database programming and ma inclined to use that. I know you can have SQL adapters in Zope, but for two reasons I don't want to use them, 1. They can be a hassle to set up and since this is a distributed app, this might be a problem. 2. It doesn't really take advantage of the object oriented nature of zope's content management. It basically then is just an excuse for a good templating engine. What I am worried about though is if I build my product without SQL(it is a task management/portal suite), it will forever live on Zope, and getting to that data from other programs will be next to impossible. Does anybody have any experience/advice on this, please let's hear from the zealots AND the skeptics. I know Zope is awesome, I just want to make sure it doesn't get me in a proprietary bind. Thanx J _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1

zclasses, method names with trailing '%20', ftp
by Chris Price 27 Nov '01

27 Nov '01

Hi, I'm attempting to develop a product using ZClasses, and have hit a slight snag. As most of you probably know, Zope appends a trailing space ('%20') to the names/ids of methods inside of a ZClass. I have read that this is done to prevent naming conflicts, and that it only occurs inside of the Products folder. So when you instantiate a ZClass somewhere in your zope tree, the '%20's are not required in URL's and such. My problem (more of an annoyance, really) is that I have been using Emacs to edit my zope python scripts and some of my dtml methods, via FTP. It had been working great until I tried to FTP into a nested ZClass, but now the '%20's are messing up my ftp access. This is not an emacs problem, I have tried to ftp from the command line and still I cannot get to the objects. Here is a simple example of how to reproduce this problem: 1) Create a new product called 'foo'. 2) Inside the product, add a ZClass, also called 'foo'. 3) Inside of that ZClass, create another ZClass called 'bar'. 4) Inside of 'bar' (in the propertysheets/methods), add a DTML doc or any other type of object, call it 'bunk'. 5) Try to ftp into your zserver and navigate to 'bunk'. I cannot figure out a way to do it. Here is one of my ftp sessions. It is interesting to note that the ftp server accepts either 'cd bar' or 'cd "bar "', and seems to think that either is a legitimate 'directory'. but then when I try to go into the 'methods' dir, it just won't work. And this only seems to happen on nested zclasses--if I try to do 'cd "foo "' I get a "no such directory" error, as I would expect/hope. I would really prefer to edit my objects with emacs, does anyone know of any other way to do this? Thanks in advance for any advice/opinions! Chris Price cprice(a)orbik.com ftp transcript: ****************************************************************************** 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> cd Control_Panel/Products/foo 250 CWD command successful. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list d--------- 1 Zope Zope 0 Nov 27 17:44 .. drwxrwx--- 1 cprice Zope 0 Nov 27 17:44 Help ---------- 1 cprice Zope 0 Nov 27 17:45 bar_add_permission drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 foo -rw-rw---- 1 cprice Zope 1463 Nov 27 17:45 foo_add -rw-rw---- 1 cprice Zope 311 Nov 27 17:45 foo_addForm ---------- 1 cprice Zope 0 Nov 27 17:45 foo_add_permission ---------- 1 cprice Zope 0 Nov 27 17:45 foo_factory 226 Transfer complete ftp> cd foo 250 CWD command successful. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list d--------- 1 cprice Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 propertysheets 226 Transfer complete ftp> cd propertysheets/methods 250 CWD command successful. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 bar -rw-rw---- 1 cprice Zope 1463 Nov 27 17:45 bar_add -rw-rw---- 1 cprice Zope 311 Nov 27 17:45 bar_addForm ---------- 1 cprice Zope 0 Nov 27 17:45 bar_factory 226 Transfer complete ftp> cd bar 250 CWD command successful. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 propertysheets 226 Transfer complete ftp> cd propertysheets 250 CWD command successful. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:46 methods 226 Transfer complete ftp> cd methods 550 No such directory. ftp> ls methods 200 PORT command successful. 550 Could not list directory. ftp> cd ../.. 250 CWD command successful. ftp> pwd 257 "/Control_Panel/Products/foo/foo/propertysheets/methods" is the current directory. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 bar -rw-rw---- 1 cprice Zope 1463 Nov 27 17:45 bar_add -rw-rw---- 1 cprice Zope 311 Nov 27 17:45 bar_addForm ---------- 1 cprice Zope 0 Nov 27 17:45 bar_factory 226 Transfer complete ftp> cd "bar " 250 CWD command successful. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 propertysheets 226 Transfer complete ftp> cd propertysheets/methods 550 No such directory. ftp> cd propertysheets 250 CWD command successful. ftp> cd methods 550 No such directory. ftp> ls methods 200 PORT command successful. 550 Could not list directory. ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list drwxrwx--- 1 Zope Zope 0 Nov 27 17:45 .. drwxrwx--- 1 Zope Zope 0 Nov 27 17:46 methods 226 Transfer complete

1 0

Re: [Zope] Multiple queries in a ZSQL method (MySQLda)
by H.de.Wit＠SFK.NL 27 Nov '01

27 Nov '01

>Is there a workaround to have those 2 SQL queries in one ZSQL method ? I use this thing: <dtml-var sql_delimiter> I see no other purpose for it than abstracting from ';', (but i don't know if this works in your configuration) Met vriendelijke groeten, Hans de Wit Stichting Farmaceutische Kengetallen Postbus 30460 2500 GL DEN HAAG Tel. 070-3737448 Fax 070-3737445

3 2

basis Zope/Python script question
by H.de.Wit＠SFK.NL 27 Nov '01

27 Nov '01

Hello, I write the following code repeatedly: if request.has_key('v1'): v1=request.v1 else: v1=-1 if request.has_key('v2'): v2=request.v2 else: v2=-1 etc. Is there a way to do this more efficient and clean, something like this: for reqvar in ['v1','v2','v3']: if request.haskey(reqvar): reqvar=request.reqvar #this doesn't work else reqvar=-1 # and this also not. Het vriendelijke groeten, Hans de Wit Stichting Farmaceutische Kengetallen Postbus 30460 2500 GL DEN HAAG Tel. 070-3737448 Fax 070-3737445

3 2

Generating thumbnails on the fly using PIL
by Pieter Claerhout 27 Nov '01

27 Nov '01

Hi all, I'm trying to make an external method that creates a thumbnail of an image on the fly. I want to give it the url of the image and return the image data. It should look something like: <dtml-var "MakeThumb('/path/to/my/image.jpg', (64, 32))"> I figured out already that I should use a StringIO object to store the raw image data in, so that PIL has an object to work with. The only two things I'm struggling with still are: - How do you get the data of the image in the StringIO object? - How do you return the thumbnail image? Hope that somebody can help with this. Cheers, Pieter

4 3

Zope port and provider
by James van der Veen 27 Nov '01

27 Nov '01

Hi all a friend of mine fired this question at me can someone help me give him a awnser? "There appears to be a serious flaw with zope: one needs a zope provider. and there aren't too many. apparently zope grabs port 80 and keeps it. is this true? are there workarounds so that any isp will do?" I know there are quite a few Providers. Hope someone can help me. Greetz, Jamez

4 3

Re: [Zope] CoreSessionTracking: Brute-Forcing Web Application Session IDs
by Frank Tegtmeyer 27 Nov '01

27 Nov '01

"Chris McDonough" <chrism(a)zope.com> writes: > OK, so do you recommend that I just use a shared secret string to > obfuscate the session id? Yes, I think that would be sufficient. The secret would be generated during creation of the SessionId manager, either by asking the user for some secret or by getting it from the system (/dev/random on Linux for example). When asking the user a long default value could provided so that the user only has to change it (seeing a good random example is easier than to create one from scratch). > I suppose I could just use the rotor module Yes, that's a possibility. > Or do you think I should use dates/times and IP addresses as part of > the string, rejecting session ids from machines that don't match the > IP address encoded into the sid and date/times that are too long > ago? I would avoid IP addresses because session users can come from different sources legally. Timestamping would be a good thing in case session Ids are kept somewhere in URLs (search engines, proxy-Logs, ...). > Note that I believe there will be some cost involved in terms of > documentation and support if this is the case. Sessions often just > won't work due to proxy server banks that prevent users from appearing > to come from the same IP address across requests. Exactly. > In any case, if anything like this goes in, this will be a feature of > a sessioning system after Zope 2.5 and will not ship with 2.5. Oh, don't feel any pressure ... it was only a suggestion, not a demand :) > Thanks Frank! Thanks too, Chris. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany

1 0

DLL Release
by Scheck, Herman 27 Nov '01

27 Nov '01

Hi all, My question is on releasing DLLs/threads used by external python methods in Zope (ver 2.4.1). Once a COM object (QuoteDB.dll in the following example) is accessed via an external python method (below) and the process is completed... ---------------------- import win32com.client import pythoncom def GetRFQNumbers(DSN, UID, PWD): # retrieves request for quote numbers # # arguments: DSN - data source name # UID - data source user id # PWD - data source password # returns : record tuple of rfqNumbers pythoncom.CoInitialize() QuoteDB = win32com.client.Dispatch("QuoteDB.BusinessRules") rfqNumbers = QuoteDB.GetRFQNumbers(DSN, UID, PWD) return rfqNumbers[0] ---------------------- ... the DLL becomes locked until the Zope service is shut down. Problem here is that I do not want to have to shut down the Zope service containing multiple applications just to replace/upgrade a single DLL used by a single application. Am I missing something in the python code to release the DLL/thread before returning? Or, is Zope maintaining the thread in some way? How do I programmatically kill/close the thread when it is no longer in use? Thanks, -Herman

1 0

Mods to Document Library.
by Jason C. Leach 27 Nov '01

27 Nov '01

hi, I'd like to make a small modification to Document Library: I have added a property 'document_id' to the documents. In the now I would like that property to display when I list the items (document_list, document_idem_list). Any ideas? Thanks, j. -- ...................... ..... Jason C. Leach .. PGP/GPG Public key at http://www.keyserver.net/ Key ID: 157BD48C

2 1