- Zope - Zope lists

Re: [Zope] authentication problem
by Oliver Bleutgen 01 Sep '01

01 Sep '01

[SNIP] > I would GREATLY appreciate an explanation of where the authorization > information is coming from. I don't see the currently logged in user > in my CGI environment, including cookies. How does any server-side > program get the user authorization information from the browser after > the user has logged in and gone to a different frame or window? > -- I'm just talking about basic-auth here. The browser just resends (or should at least) the credentials in the request header (BASE64 encoded) for every request to the same server. Perhaps - I'm not sure - the browser respects URIs, i.e credentials which were asked at http://hostname/secure_area/ would not be sent to http://hostname/public_area/ but to http://hostname/secure_area/subfolder/ But I'm not sure. A nice way to see the dialog between browser and server is using Shanes nice tcpwatch, located at http://www.zope.org/Members/hathawsh/tcpwatch cheers, oliver

1 0

Re: [Zope] protecting users from hostile authors
by Oliver Bleutgen 01 Sep '01

01 Sep '01

> O.k., I've been mulling over the topic of > protecting users from lots of potentially > hostile authors. I've got some ideas > that could go a little way toward solving > the problem. > When writing a method that is going to do > something *really* privileged (like "drop > class"), there should be a second "Are > you sure you want to...?" step. > In order to enforce the desired use of > this step, there must be a way to > determine that the method is being called > directly from the Zope Publisher(???) - > not through an intermediate method. I > have worked with such problems extensively > under Apache, and the most secure solution > I developed was not pretty. I'm hoping > for better in Zope. This is IMO equivalent to the problem of determining if the manage_-method has been called by "legitimate" means, i.e. creating some kind of state - otherwise the attacker would just target the same methods as the "are you sure?" screen you propose. Btw. I wouldn't want to be asked for everything I do in the ZMI - and everything you can do there is potentially dangerous. > Is there a good un-fakeable way in Zope > to determine the caller of a method? I fear that's impossible when we look at what happens. (1)Hostile html-page -> (2)client -> (3)manage_method Between (1) and (3) there's always the client and looking at modern browsers I find it very unlikely that we can always trust (2). > (Another piece that is required for the > "extra step" solution I mention is the > generation of some cryptographic key to > the second step. I think I understand > how to do that.) If you know how to solve that, you can also stuff that key directly into the ZMI as we have them now, can't you? OTH, looking at techniques discussed here recently, like IIRC http://www.ashleyit.com/rs/ we see there are various possibilites to GET/POST pages on the users behalf in order to get at your cryptographic key. > Some other things to consider...if you > have a "Referer" header, you could use it > to insure that the user got to your > method through the "proper" path. Using > the "Accept" header *should* give a clue > if the request is coming as a result of a > tag like "img". These are not dependable > solutions, though. Some browsers do not > send the Referer, and MS browsers have a > long history of sending bogus Accept > values. Also, frames could be used > instead of images for "invisible" calls. I see no chance to defeat an attack against a browser which is to "open" w.r.t. scripting. But, without javascript, there's IMO an easy and compatible way to defeat almost any attack. I posted this also to the wicki, just make sure that possibly destructive methods can only be called from the web via POST. The http/1.1 rfc says about that: 9.1.1 Safe Methods Implementors should be aware that the software represents the user in their interactions over the Internet, and should be careful to allow the user to be aware of any actions they might take which may have an unexpected significance to themselves or others. In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested. Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the side-effects, so therefore cannot be held accountable for them. cheers, oliver

1 0

protecting users from hostile authors
by Kyler B. Laird 01 Sep '01

01 Sep '01

We're in the process of building a cluster (just installed 8 machines) for serving a bunch (tens of thousands) of users. Many/most of these people will also be authors. A single (X.500- based) authentication system will be used for most everything. I'm trying to get a handle on what policy I want to use in order to keep authors from doing Bad Things to authenticated users who visit their pages. Looking around on Zope.org, I realized that this might already be addressed. Is there anything that prevents me (as a Zope community member with authoring privileges on zope.org) from luring users who have already authenticated with Zope.org to come look at my pages, and then running arbitrary commands with their privileges? Anyone else grappling with this situation? I'm trying to decide how to set policy so that users are reasonably safe, but authors still have the freedom to create Cool Stuff. There will most certainly be multiple classes of authors - those who can act with the authenticated user's privileges and those who can not. I'm not quite sure how to implement that yet, though. I'm also concerned about links to Bad Things, like "delete your home directory" disguised as "Get porn here!". Any thoughts? Has this already been hashed out somewhere that I should have found? Thank you. --kyler

6 10

Drag and Drop in ZMI?
by Jon Edwards 01 Sep '01

01 Sep '01

I found another script for Targetted Drag and Drop in IE 4/5 (but couldn't find anything cross-browser) - http://www.siteexperts.com/tips/styles/ts35/page1.asp HTH ...if you get it working, I'd love a copy too! ;-) Cheers, Jon

1 0

Re: [Zope] Newbie
by Robert Rottermann 01 Sep '01

01 Sep '01

als tüütschschwiizer verstangeni natürlech nume Schwiizertüütsch oder änglisch bzw selbstverständlich! Robert ----- Original Message ----- From: "Frank Stephan" <frank_stephan(a)gmx.de> To: "Robert Rottermann" <robert(a)redcor.ch> Sent: Sunday, September 02, 2001 11:09 AM Subject: AW: [Zope] Newbie > Hi Robert, > > thank you very much for your help. > Seems that is exactly what I need. > I'd like to ask a few more questions. > May I ask in german, too? > > Thx > Frank > > > > -----Ursprüngliche Nachricht----- > > Von: Robert Rottermann [mailto:robert@redcor.ch] > > Gesendet: Freitag, 31. August 2001 22:36 > > An: Frank Stephan; zope(a)zope.org > > Betreff: Re: [Zope] Newbie > > > > > > Hi Frank, > > what you like to do is rather easy with zope. > > There are a couple of ways to do it. > > You can solve your problem either using CMF or plain zope. > > The difference is that CMF offers you things like user management, and > > uploading of "annotated" pdf files out of the box. > > > > The listing of files on the server and sending of information you > > have to do > > yourself with both approaches. > > > > I did something similar (without the sending of weekly emails) just > > recently. > > You find it under www.nasuko2001.ch > > Look at it. If there are parts you could use just tell me. > > > > Robert > > > >

1 0

Problem with ZCatalog and Virtual Host Monster
by Yuichiro Sugiura 01 Sep '01

01 Sep '01

Hi, I have a problem to get ZCatalog to work with Virtual Host Monster properly. A wrong path (Object Identifier) is stored when a catalog aware object get cataloged. For example, an object "/a/b/c/d_html" get cataloged as "/b/c/d_html" where "/a" is the root folder for the virtual host. However, correct paths ("/a/b/c/d_html") are stored when a catalog is built from "Find Objects" tab in ZCatalog, . Is this behavior a known bug of the ZCatalog, or could it be caused by misconfigurations of something? Any input would be greatly appreciated. I'm using Zope 2.4.0, by the way. Yuichiro Sugiura -- Yuichiro Sugiura Activewave Technologies Inc.<http://www.awavetech.com/> Serving cyber community and cyber business.

2 2

Re: [Zope] DTML Confusion?
by hamish＠allan.tc 01 Sep '01

01 Sep '01

JZ>I can also JZ> JZ><dtml-var "Util.utility_function(REQUEST=REQUEST)"> JZ> JZ>but that is also a little long-winded. OB>DTML objects are really callable instances of classess. dtml-with calls OB>them automagically, but when you use dtml-var "..." these quotes move you OB>from DTML to Python, and in Python there is no automagical call - you must OB>call the objects yourself. There is no way to avoid it. but <dtml-var "Util.utility_function()">, which is a little less long-winded, should also work. regards, hamish -- Get your firstname@lastname email for FREE at http://Nameplanet.com/?su

2 1

Good Use for Zope?
by Leland Myrick 31 Aug '01

31 Aug '01

I'm new to Zope but I'm excited by its possibilities. I'm going to be doing some contract work to setup a database for a high school resource center. The basic idea is that all the materials available for the teachers to checkout (book sets, vidoes, math materiels, etc.) would be on the database and would be set up with a barcode system and wand for quick checkout, much like any lending library. The nice part is that every teacher is already connected on an ethernet lan, so I want to set it up so that they can search the database from their classrooms without having to trudge across the campus only to find out that what they were looking for isn't in the system or has been checked out. The first ideas of the school personnel were filemaker or access. I definitely am not doing access. The point is, has anyone done a barcode checkout system on zope? Good idea? leland myrick

1 0

strange request
by Andy McKay 31 Aug '01

31 Aug '01

Im investigating a Zope installation that just hung for a while, and looking through the log I found this very strange request: 2001-08-31 01:26:29 151.197.229.183 - 192.168.2.165 80 Content-type: application/x-www-form-urlencoded - 404 265 - None - 0.015000 ie the and cs-method cs-uri-stem were: Content-type: application/x-www-form-urlencoded instead of for example: GET /manage Ughh. Im not sure if this caused the hang, but I was curious if anyone else has seen this...? Cheers. -- Andy McKay.

1 0

Re: OOP Suggestion: allow local roles to restrict and not only extend user's roles.
by Philipp Robbel 31 Aug '01

31 Aug '01

Hi Laurie, thanks for your quick reply. Yes, that is one option I just tried, but - in my case - it has a major drawback (see below). First, here's what i did: - I created a 'test' role with only the permissions to "access contents information" and "view". - I created the researchers in the root folder and gave them the "test" permission. - I protected the critical dtml and sql methods by making them only accessible to test & manager - assigned people. - Then in their specific subfolders I gave the researchers the *local_role* of a Manager. It works but there is one major drawback in my case. I only quickly checked but in my case the /database researcher was able to call the /bioinformatics/show_management_screen and while he couldn't add Documents in the /bioinformatics directory on that screen (a login box popped up) he could execute the database methods that inserted the various data under the /bioinformatics ID just fine. Did you encounter the same problem? PS.: the bioinformatics staff is working at the European Media Laboratory in Heidelberg, Germany (www.eml.org [careful, those pages are old :-) ]) Greetings, Philipp Robbel -----Original Message----- > Hi Philipp - I'm afraid that I don't think I can help you but am struggling > with the same kind of problem - I have different research groups who cannot > see each others data, but have shared information/methods that they need to > execute in context in their respective groups and projects (which also only > some people can see) > My method so far is to define a new role that when the user is created they > are added to 'LabLoggedIn'. Then this role has the appropriate permissions > in the root folder to run the methods that are needed. Then in their own > groups or projects they have the appropriate local roles granted (these are > defined at the root level). We are working on the assumption that the users > wont know enough to hack in but I am trying to do it as though they can. > I don't know if this has helped any, but I am struggling through myself! > Laurie > > PS where is the bioinformatics that you are working with based? I am in the > same kind of lab.

1 0