- Zope - Zope lists

serious security hole in manage users / Manage users permissions?
by Niels Dettenbach 24 Oct '11

24 Oct '11

Dear Zope 2.12/.13 (4.0) devels, as far as i can see i may have found a serious security hole within Zope 2.12 / 2.13 (4.0 not tested yet) - I'm still investigate here further... problem: ====== Even on fresh Installs of Zope and fresh created instances on it anonymous / remote users able to access acl_users/manage_users by the web WITHOUT AUTHENTICATION. They can edit / delete / create users and serving roles as they want. Other management screens (as manage_main or manage_access aso. are protected as usual). In manage_access Manage user is only allowed for Manager (as by default). I don't believe that is any new behaviour of newer Zope versions... I've tested this with (last public) 2.13.10 and last 2.12.20 with python2.6. If any of the devels want to have a test url pls contact me directly. Fresh installed zope instances was configured with defaults configs, except setting "user zope" (and/or port-base). Tried it with now owner or the admin user as owner of the acl_users too. Can anyone prove this here too? If so, any solution / security fix? many thanks, best regards. Niels. -- --- Niels Dettenbach Syndicat IT&Internet http://www.syndicat.com/

3 2

Urgent:utilsation of paybox with fora zope application
by Diana Lenar 20 Oct '11

20 Oct '11

Hello i am have created a zope application which needs to use paybox i have installed the paybox module in www/cgi-bin/ of the server where zope 2.9 is installed how do i acess the module from my application? pls respond me quickly its very urgent -- Diana.Lenar Analyste Programmeuse 01 41 13 14 48

3 2

Error migrating Zope Data.fs from 2.10 to 2.13: object.__new__(Args) is not safe
by Frank Kauff 14 Oct '11

14 Oct '11

Hi all, when trying to move from Zope 2.10 to 2.13, I ran into a problem. I successfully stripped versions out of my Data.fs (thanks to this mailing list). Now Zope starts up properly and displays the manage page, but when I try to access the various folders of the site, I get the error below. Any ideas about how to overcome this? Thanks, Frank Zope Error Zope has encountered an error while publishing this resource. *Error Type: TypeError* *Error Value: (', use Persistence.Persistent.__new__()', , ())* Traceback (innermost last): * Module ZPublisher.Publish, line 126, in publish * Module ZPublisher.mapply, line 77, in mapply * Module ZPublisher.Publish, line 46, in call_object * Module Shared.DC.Scripts.Bindings, line 322, in __call__ * Module Shared.DC.Scripts.Bindings, line 359, in _bindAndExec * Module App.special_dtml, line 185, in _exec * Module DocumentTemplate.DT_Let, line 77, in render * Module DocumentTemplate.DT_In, line 647, in renderwob * Module DocumentTemplate.DT_In, line 772, in sort_sequence * Module ZODB.Connection, line 860, in setstate * Module ZODB.Connection, line 914, in _setstate * Module ZODB.serialize, line 612, in setGhostState * Module ZODB.serialize, line 605, in getState * Module ZODB.broken, line 106, in __new__ TypeError: ('object.__new__(Args) is not safe, use Persistence.Persistent.__new__()', <class 'Shared.DC.ZRDB.Aqueduct.Args'>, ())

2 2

Urgend help needed: Error migrating Zope Data.fs from 2.10 to 2.13: object.__new__(Args) is not safe
by Frank Kauff 14 Oct '11

14 Oct '11

Sorry for the repost, but I'm lost, and really need to solve this problem... When trying to move Data.fs from Zope 2.10 to 2.13, I first ran into the "version problem", but I successfully stripped versions out of my Data.fs (thanks to this mailing list). Now Zope starts up properly and displays the manage page, but when I try to access the various folders of the site, I get the error below. Any ideas about how to overcome this? How have others convrted their data? Should I move Data.fs in small stepss from 2.10 to 2.11, then to 2.12, and then to 2.13? Is this a common compatibility issue, or some other error in Data.fs? Any help would be greatly appreciated! Thanks, Frank Zope Error Zope has encountered an error while publishing this resource. Error Type: TypeError Error Value: (', use Persistence.Persistent.__new__()', , ()) Traceback (innermost last): Module ZPublisher.Publish, line 126, in publish Module ZPublisher.mapply, line 77, in mapply Module ZPublisher.Publish, line 46, in call_object Module Shared.DC.Scripts.Bindings, line 322, in __call__ Module Shared.DC.Scripts.Bindings, line 359, in _bindAndExec Module App.special_dtml, line 185, in _exec Module DocumentTemplate.DT_Let, line 77, in render Module DocumentTemplate.DT_In, line 647, in renderwob Module DocumentTemplate.DT_In, line 772, in sort_sequence Module ZODB.Connection, line 860, in setstate Module ZODB.Connection, line 914, in _setstate Module ZODB.serialize, line 612, in setGhostState Module ZODB.serialize, line 605, in getState Module ZODB.broken, line 106, in __new__ TypeError: ('object.__new__(Args) is not safe, use Persistence.Persistent.__new__()', <class 'Shared.DC.ZRDB.Aqueduct.Args'>, ())

2 1

Conversion old.zope.org to static site
by Jens Vagelpohl 14 Oct '11

14 Oct '11

Hi all, Just as a heads-up: Jim Fulton and I have converted old.zope.org to a static website. This allows ZC to decommission the hardware and reduces the maintenance burden for everyone involved. We have tried to keep all URLs intact and the site navigation working at the same time, which required a little creative thinking. Some of you rely on resources from the old.zope.org site, such as release tarballs of older Zope versions and other products. Please test and ensure the files you need are still where you expect them. If you have problems, just contact me off-list and I'll take a look. jens

2 4

File upload again
by Jaroslav Lukesh 14 Oct '11

14 Oct '11

Hi all, I want upload csv file for direct processing into SQL only, not for save to ZODB nor LocalFS. Upload for LocalFS already worked for me. So I have form: <form method="POST" enctype="multipart/form-data"> <input type="file" name="fcsv" value="" size="50"><br> <input type="file" name="fcsv2" value="" size="50"><br> <input type="submit" name="fileupload" value="Upload"> </form> Diagnostic processing: <dtml-var "fcsv.filename">::<dtml-var "fcsv.headers['Content-Type'] ">::<dtml-var fcsv> And what it get: data_2011.CSV::application/vnd.ms-excel:: Su upload worked, but what I can access to data of the uploaded file? the dtml-in does not process anything, only displays NO DATA. <dtml-in "PyS_csvimport(fcsv)" prefix="pys"> <dtml-var pys_item><br> <dtml-else> NO DATA </dtml-in> PyS_csvimport parse CSV file by line and return array structure like this [['',''],['','']]. If I use TEXTAREA instead of file upload, dtml-in works. How to get CSV file content to processing? Many thanks, Jaroslav Lukesh PS: HTTP Request loks like that: http://myhost/csvimport/ POST /csvimport/ HTTP/1.1 Host: myhost (......) Content-Type: multipart/form-data; boundary=---------------------------30333176734664 Content-Length: 21822 -----------------------------30333176734664 Content-Disposition: form-data; name="fcsv"; filename="data_2011.CSV" Content-Type: application/vnd.ms-excel (....bulk od CSV data.....) -----------------------------30333176734664 Content-Disposition: form-data; name="fcsv2"; filename="data_2011_kd.CSV" Content-Type: application/vnd.ms-excel (....bulk od CSV data.....) -----------------------------30333176734664 Content-Disposition: form-data; name="fileupload" Upload -----------------------------30333176734664-- HTTP/1.1 200 OK Server: Zope/(Zope 2.10.13-final, python 2.4.6, linux2) ZServer/1.1 Date: Fri, 14 Oct 2011 09:21:48 GMT Content-Length: 2389 Content-Type: text/html; charset=cp1250

2 2

Error Migration Data.fs from Zope 2.10.4 to 2.13.8
by Frank Kauff 06 Oct '11

06 Oct '11

Hi all, I'm trying to update from Zope 2.10.4 to 2.13.8 and have problems to copy Data.fs. No matter whether I try to directly copy Data.fs or use repozo, both times zope gives me the error ValueError: Non-zero version length. Versions aren't supported. Searching the net, this seems to be a common problem. However, I couldn't find a solution for it. Is there a tool anywhere that can convert Data.fs from older to newer formats? Thanks, Frank

3 8

Security vulnerabiity 20110928: Arbitrary Code Execution (pre-announcement)
by Tres Seaver 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Zope security response team is pre-announcing a fix for a vulnerability in Zope 2.12.x and Zope 2.13.x that allows execution of arbitrary code by anonymous users. This is a severe vulnerability that allows an unauthenticated attacker to employ a carefully crafted web request to execute arbitrary commands with the privileges of the Zope service. Versions Affected: Zope 2.12.x and Zope 2.13.x. Versions Not Affected: Zope 2.9.x, Zope 2.10.x, Zope 2.11.x This is a pre-announcement. Due to the severity of this issue we are providing an advance warning of an upcoming patch, which will be released 2011-10-04 15:00 UTC. What you should do in advance of patch availability =================================================== Due to the nature of the vulnerability, the security team has decided to pre-announce that a fix is upcoming before disclosing the details. This is to ensure that concerned users can plan around the release. As the fix being published will make the details of the vulnerability public, we are recommending that all users plan a maintenance window for 30 minutes either side of the announcement where your site is completely inaccessible in which to install the fix. Meanwhile, we STRONGLY recommend that you take the following steps to protect your site: - - Make sure that the Zope service is running with with minimum privileges. Ideally, the Zope and ZEO services should be able to write only to log and data directories. - - Use an intrusion detection system that monitors key system resources for unauthorized changes. - - Monitor your Zope, reverse-proxy request and system logs for unusual activity. In this case, these are standard precautions that should be employed on any production system. Extra help ========== Should you not have in-house server administrators or a service agreement looking after your website you can find consultancy companies on plone.net. There is also free support available online via Zope mailing lists and the #zope IRC channels. Questions and Answers ===================== Q: When will the patch be made available? A: The Security Team will release the patch at 2011-10-04 15:00 UTC. Q. What will be involved in applying the patch? A. Patches are made available as tarball-style archives that may be unpacked into the “products” folder of a buildout installation and as Python packages that may be installed by editing a buildout configuration file and running buildout. Patching is generally easy and quick to accomplish. Q: How was this vulnerability found? A: This issue was found as part of a routine audit performed by the Plone Security team. Q: My site is highly visible and mission-critical. I hear the patch has already been developed. Can I get the fix before the release date? A: No. The patch will be made available to all users at the same time. There are no exceptions. Q: If the patch has been developed already, why isn't it already made available to the public? A: The Security Team is still testing the patch and running various scenarios thoroughly. The team is also making sure everybody has appropriate time to plan to patch their Zope installation(s). Some consultancy organizations have hundreds of sites to patch and need the extra time to coordinate their efforts with their clients. Q: How does one exploit the vulnerability? A: This information will not be made available until after the patch is made available. Q: Is there a CVE record for this vulnerability? A: Not yet. This information will be added when available. If you have specific questions about this vulnerability or its handling, contact the Zope Security Team, security-response(a)zope.org. To report potentially security-related issues, please send a mail to the Zope Security Team at security-response(a)zope.org. The security team is always happy to credit individuals and companies who make responsible disclosures. Information for vulnerability database maintainers ================================================== CVSS Base Score 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P/E:P/RL:O/RC:C) Impact Subscore 6.4 Exploitability Subscore 10 CVSS Temporal Score 5.9 Credit Alan Hoey Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6DlaMACgkQ+gerLs4ltQ7D+gCgz6WA6J44vxkhjnJGquBzCR33 nPgAn3cl0/do5VB+B6h9WmM22yIGOb7Z =/HcQ -----END PGP SIGNATURE-----

1 0

REST webservice on Zope 2
by Vimal 27 Sep '11

27 Sep '11

Hi all, We need to implement a webservice for our Zope 2 website. Among SOAP and REST, REST appears to be easier to implement for what we need - return json or xml based on the URLs accessed. Zope 3 supports REST (z3c.rest) but not Zope 2. Does somebody have experience implementing REST on Zope 2? Regards, Vimal

2 2

Caipirinha with Zope Sprint in Argentina and Brazil
by Roberto Allende 24 Sep '11

24 Sep '11

Hello Within PyCon Argentina, Plone Symposium South America and PyCon Brazil we will run the "Caipirinha with Zope Sprint" where we'll work on ZTK components migration to Python3 and to integrate webob with Zope. For more information about the sprint visit http://www.pythonbrasil.org.br/2011/programacao/sprints/sprints/zope-e-pyth… For more informatio about PyCon Argentina and PyCon Brazil visit: http://ar.pycon.org/2011 http://www.pythonbrasil.org.br/2011 Lastly i'd like to note that you can join us through irc at #caipirinha on irc.freenode.net You're invited, Cheers! Roberto Allende -- http://robertoallende.com

2 2