- Zope - Zope lists

Re: [Zope] Seperate Log Files
by Danny William Adair 27 Nov '01

27 Nov '01

On Tuesday 27 November 2001 17:10, Vid Bijelic wrote: > Hi, > > I have a two (for now) sites running on the same Zope. > Is it possible to have Zope store log files > separately for each site, so webalizer can easily > generate site statistics for each site separately. > > Vid Why not the other way around? Tell Webalizer to only count requests to specific hosts... hth, Danny

1 0

CoreSessionTracking: Brute-Forcing Web Application Session IDs
by Frank Tegtmeyer 27 Nov '01

27 Nov '01

The following article also applies to CoreSessionTracking. CST uses a timestamp and a value generated by the rhandom module. While this is sufficient to avoid collisions it's not enough to defend against brute force attacks like the ones describe in the appended message. Perhaps CoreSessionTracking should be switched to an algorithm that was mentioned by Florent Guillaume (Nuxeo): ------------------------------------------------------------------------ From: Florent Guillaume <fg(a)nuxeo.com> Subject: Re: [Zope] CoreSessionTracking-based LoginMethod for LoginManager Date: 15 Aug 2001 17:07:11 GMT > 1. Start with the data you want to store > 2. Append identifying information, eg the IPs of the client and > server, and the current date/time. > 3. Make a digest of this plus a secret string which only you know, > and append that as a fingerprint. I rewrite you 3. as computing as a fingerprint: H(known-string || password). This construction apparently still has some very slight cryptographic weaknesses. Lifted from bugtraq sometime ago: From: Michael Wojcik <Michael.Wojcik(a)merant.com> Date: Mon, 16 Jul 2001 10:45:48 -0700 Schneier cites a private communication with Bart Preneel (author of RIPE-MAC) on possible weaknesses of the obvious constructions H(known-string || password) H(password || known-string) H(password || known-string || password) H(password-1 || known-string || password-2) and suggests one of the following instead (rewritten as password hashes): H(password-1 || H(password-2 || known-string)) H(password || H(password || known-string)) [ie. pw-1 == pw-2] H(password || pad || known-string || password) [pad pw to full block] The simplest of these, in terms of retrofitting existing systems that use one of the constructions Ishikawa mentions, is H(password || H(password || known-string)) So I'd use that last one instead. Florent Guillaume Nuxeo ------------------------------------------------------------------------ The needed "secret" could be established by some means during the installation of CoreSessionTracking without even bothering the administrator. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany

4 4

Help with Zope news?
by Chris McDonough 27 Nov '01

27 Nov '01

Would anybody be willing to "do" the Zope News for the last few months (since it was last released, on Oct. 1, long ago)? If not, it's going to be a while before I'll be able to release another one. ---------- Chris McDonough Zope Corporation http://www.zope.org http://www.zope.com """ Killing hundreds of birds with thousands of stones """

1 0

Problem with std. user folder Authentication dialog
by vio 27 Nov '01

27 Nov '01

How do I get rid of the Login dialog sent by 'user folder'? I have a product which I want to allow public access to (without compromising my site's security), but I can't get rid of the std. Login dialog. I tried to use the calls from the Security chapter in ZopeDevGuide, but without apparent effect: calls to security.declarePublic('myMethod') don't seem to work, as far as I can tell. Any hints would be appreciated. Vio

1 0

Re: [Zope] Problem!!!.............Please Help
by complaw＠hal-pc.org 27 Nov '01

27 Nov '01

Is your index_html object a DTML Document or a DTML Method? (Hint, it should be a DTML Method). Note, the Zope interface will give you the option to create a user interface, but it does so by creating a DTML Document. The Zope Book example instead uses a DTML Method for the index_html object. Hope that helps. Ron > Recently I downloaded Zope and am in the process of learning it. > I am working out the Zope book. > Here is what I have installed: > Zope 2.4.3 (binary release, win 32) > Python 2.1 (MSC 32 bit Intel) > System win 32 (Win 98 Second Edition) > Problem I Face: > I am currently working with Chapter 5 of the Zope Book (Creating Basic Zope > Applications). > In it for navigation I created the DTML method navigation in the ZopeZoo > folder. > That called all the folders properly. > I have a link for navigation (using dtml-var) in the standard-html-header. > Then I created the index_html file in the ZopeZoo folder. In it I called > standard-html-header. > Now the links of the navigation are not shown. If I include a line like > <p>This is a trial</p> in the navigation object that will be shown, but not > the navigation panel. > Then I created another DTML document called html_header in the ZopeZoo > folder with dtml-var navigation. It works. Then when I call that in my > index_html again no nagivation bar. > Can anyone let me know what the problem is or if I am doing anything wrong. > Thank you. > Pravin > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

ZCatalog and Mac OS X
by Jochen Haeberle 27 Nov '01

27 Nov '01

Hi, after some time of absence from active Zope, I just downloaded and successfully installed Zope 2.4.3 on Mac OS X. I am just playing around a bit to get up to date, but... I can't get a ZCatalog to index anything. From the docs I found it works like the (new) find tab. I can find objects with no problem, but nothing gets into the catalog, whatever I do. Am I so dumb or is it a problem someone else found on OS X 10.1.1??? My Setup: Root: Some DTML-Methods a Photo-Folder with some Photos, I would like to catalog a ZCatalog I think for a start I should not need to change anything to the settings of the ZCatalog. I go to the Find Objects Tab and select Photo as a type (nothing changes when I try all objects) and start the find - with no result. Sorry, but I could not find any ocumentation concerning the present version of ZCatalog to cover my problem, all the How-Tos cover older versions... Could anyone please give me a hint? Is there a place where bugs/hints for Zope on OS X can be found? Regards Jochen

4 8

Problem!!!.............Please Help
by Pravin Raj Joshi 26 Nov '01

26 Nov '01

Recently I downloaded Zope and am in the process of learning it. I am working out the Zope book. Here is what I have installed: Zope 2.4.3 (binary release, win 32) Python 2.1 (MSC 32 bit Intel) System win 32 (Win 98 Second Edition) Problem I Face: I am currently working with Chapter 5 of the Zope Book (Creating Basic Zope Applications). In it for navigation I created the DTML method navigation in the ZopeZoo folder. That called all the folders properly. I have a link for navigation (using dtml-var) in the standard-html-header. Then I created the index_html file in the ZopeZoo folder. In it I called standard-html-header. Now the links of the navigation are not shown. If I include a line like <p>This is a trial</p> in the navigation object that will be shown, but not the navigation panel. Then I created another DTML document called html_header in the ZopeZoo folder with dtml-var navigation. It works. Then when I call that in my index_html again no nagivation bar. Can anyone let me know what the problem is or if I am doing anything wrong. Thank you. Pravin

1 0

Missing producst
by Matt Goodall 26 Nov '01

26 Nov '01

Hi, Some home grown products that I imported into a clean installation of Zope v2.4.2 have gone missing from the "Add" dropdown. The products are listed in /Control_Panel/Products and instances of those products that were also imported work fine. The only problem is that I cannot create new ones :( Has anyone seen this behaviour before and does anyone know what I can do to get them back? Thanks for your help. Cheers, Matt

1 0

Transactions in Zope?
by Bruce Eckel 26 Nov '01

26 Nov '01

I am creating an external method that makes a folder, creates a dtml method in that folder, and then sends an email message. If any of these operations fail, I'd like to "roll back" to the state before the method was called. I think I heard that zope has transactions of some kind, and I'm making mods to the ZODB in my external method, so is there a magic piece of code that would roll everything back? Thanks!

7 14

skip_unauthorized not working in dtml-in
by Kevin Worth 26 Nov '01

26 Nov '01

Zope 2.4.3, Mac OS X. This code: <dtml-in expr="PARENTS[0].objectValues(['Folder', 'RSTX_Document', 'DTML Document', 'STX Document'])" skip_unauthorized=1 sort=id> <a href="&dtml-absolute_url;/"><dtml-var title_or_id></a> </dtml-in> Does not work in my setup. I know the permissions are fine, because skip_unauthorized is working as expected in a dtml-tree for the same objects. The Zope Book mentions another way of doing it -by assigning a property for those items to appear in the list and checking to see if it is true - but that doesn't work well for me because the public/private nature of many items will change often based on the time of year. thanks Kevin

2 1