- Zope - Zope lists

RE: [Zope] defacement/crack statistics
by sean.upton＠uniontrib.com 04 Jun '01

04 Jun '01

Typo - that's 'rm -rf /' (or if an attacker is feeling a little more benign, they'll just deface your site)... My primary security rule: you need to be root, and you need to be informed (alerts, mailing lists - set a reminder in your PIM software to check security bulletins on lwn.net every thursday afternoon, you get the idea), if you are going to manage these things... Sean -----Original Message----- From: sean.upton(a)uniontrib.com [mailto:sean.upton@uniontrib.com] Sent: Monday, June 04, 2001 12:20 PM To: jleach(a)mail.ocis.net; zope(a)zope.org Subject: RE: [Zope] defacement/crack statistics I agree: I would be nice to write a hotfix for Zope that permits a remote 'rf -rf /' command to be executed. I I could install that hotfix through-the-web, that would be even better. ;) Kidding aside, the very reasons hotfixes exist precludes the idea of TTW implementation of hotfixes in the firstplace. The only way I would think this would be acceptable is if there was a way to hard-code it only so that localhost could do this, if even that... Sean -----Original Message----- From: Jason C. Leach [mailto:jleach@mail.ocis.net] Sent: Monday, June 04, 2001 10:35 AM To: zope(a)zope.org Subject: Re: [Zope] defacement/crack statistics hi, An automated 'hotfix' management system would be a really good tool to implement in Zope. Perhaps a simple button in the Control Panel to fetch and install the latest hotfixes. j. ...................... ..... Jason C. Leach ... University College of the Cariboo. .. On Mon, 4 Jun 2001, Michel Pelletier wrote: > On Sun, 3 Jun 2001 kosh(a)aesaeion.com wrote: > > > Does anyone have any statistics on how often zope servers tend to get > > cracked? I have been looking on line and so far I have found no data on > > that. Either there has not been one which is unlikely or they are > > extremely rare which is more likely considering the ACL system. > > > > Need some information for customers and these kinds of numbers would be > > very useful. > > I've been around since the pre-Zope, and I also help do commercial support > for DC. I have never once heard from the community, or from a customer, > of any successful or unsuccessful crack of Zope. I, like you, would be > very interested to hear of one. > > Of course it can happen, there are well known exploits for older versions > of Zope, three major ones in the last year and a half, if memory serves > right. All of those exploits were fixed the same day they were reported, > often within hours, and new versions and security updates for older > versions were released, so even if there is an older version and the > maintainer patched it with a hotfix, it's safe (from the known exploit). > > Most explits (as far as I know) are discovered by community members in the > course of their experimentation with Zope. This is one of the greatest > strengths of open source. Of course, there's nothing like a full blown > security audit, but them again, there's nothing like roasting hot > dogs over large piles of burning money either. > > -Michel > > > > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev ) _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

RE: [Zope] defacement/crack statistics
by sean.upton＠uniontrib.com 04 Jun '01

04 Jun '01

I agree: I would be nice to write a hotfix for Zope that permits a remote 'rf -rf /' command to be executed. I I could install that hotfix through-the-web, that would be even better. ;) Kidding aside, the very reasons hotfixes exist precludes the idea of TTW implementation of hotfixes in the firstplace. The only way I would think this would be acceptable is if there was a way to hard-code it only so that localhost could do this, if even that... Sean -----Original Message----- From: Jason C. Leach [mailto:jleach@mail.ocis.net] Sent: Monday, June 04, 2001 10:35 AM To: zope(a)zope.org Subject: Re: [Zope] defacement/crack statistics hi, An automated 'hotfix' management system would be a really good tool to implement in Zope. Perhaps a simple button in the Control Panel to fetch and install the latest hotfixes. j. ...................... ..... Jason C. Leach ... University College of the Cariboo. .. On Mon, 4 Jun 2001, Michel Pelletier wrote: > On Sun, 3 Jun 2001 kosh(a)aesaeion.com wrote: > > > Does anyone have any statistics on how often zope servers tend to get > > cracked? I have been looking on line and so far I have found no data on > > that. Either there has not been one which is unlikely or they are > > extremely rare which is more likely considering the ACL system. > > > > Need some information for customers and these kinds of numbers would be > > very useful. > > I've been around since the pre-Zope, and I also help do commercial support > for DC. I have never once heard from the community, or from a customer, > of any successful or unsuccessful crack of Zope. I, like you, would be > very interested to hear of one. > > Of course it can happen, there are well known exploits for older versions > of Zope, three major ones in the last year and a half, if memory serves > right. All of those exploits were fixed the same day they were reported, > often within hours, and new versions and security updates for older > versions were released, so even if there is an older version and the > maintainer patched it with a hotfix, it's safe (from the known exploit). > > Most explits (as far as I know) are discovered by community members in the > course of their experimentation with Zope. This is one of the greatest > strengths of open source. Of course, there's nothing like a full blown > security audit, but them again, there's nothing like roasting hot > dogs over large piles of burning money either. > > -Michel > > > > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Re: [Zope] Dreamweaver
by dave＠kovach.com 04 Jun '01

04 Jun '01

Hi David, After some work with it and frustration I opted for using HomeSite 4.5 and the Zope extensions product and ftp access into the ZODB. Its a more flawless solution that will leave you less frustrated and getting more done - rather than trying to deal with Dreamweavers issues. Sincerely, David Kovach On Mon, 04 June 2001, CURTIS David wrote: > > Hi, > > I want to use dreamweaver to create a web site. How does one combine this product to zope? Having looked through the help files, it seems the extension .jpg can be a problem due to dhtml object code. I found some web pages that say it is currently being developed. Anyone doing this and what are your results? > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

[ANN] ZShell 1.2
by Jerome Alet 04 Jun '01

04 Jun '01

Hi, I'm pleased to announce the availability of ZShell 1.2 ZShell is an external Zope method which allows you to manipulate the ZODB using standard unix shell's commands from within Zope's Management Interface in your web browser. ZShell is the Swiss Army's Knife of the Zope Manager. ZShell is licensed under the GNU General Public Licence, with some clarifications of my own concerning it's use with Zope. You can download it from: http://cortex.unice.fr/~jerome/zshell/ New features are: ================= Some options may now be specified multiple times, and option arguments may use wildcards too, for examples look at grep's or find's documentation, or at this one: find / --id "*html" --id "!index_*" --type "DTML*" --type File --exec "catalog {}" (all on a single line): this will recursively catalog all objects which meta type begins with "DTML" or is File, which id ends in "html" but not those which id begins with "index_" This is just the sort of things you'll be able to do, but I'm confident that your own imagination can invent very complex commands to solve your particular problems. find's --user option was renamed to --owner find's --name option was renamed to --id Some options, actually --type and --owner in grep and find, and --id in find, now accept NOTarguments of the form: !arg, which can contain wildcards too. Bug fix with regard to special meta types handling (ZClasses) Better error handling in cp/mv/cut/copy/paste. Better output in cp/mv/paste. history now accepts a --clear option to empty the .zshell_history DTML Document, if allowed. history accepts multiple --user arguments to list only those commands run by the specified users (NOTarguments are allowed too). grep now accepts a --maxdepth option to be optionally used when the --recurse option is given. grep now accepts --owner, --mmin, --mtime, and --newer options, just like find. Both find and grep now accept a --older option, which works just like --newer. Overflow error fixed. What's cool ? ============= What you'll probably find very useful is the possibility to use NOTarguments in some commands arguments and some command options arguments. a NOTargument is a normal argument prefixed with a '!' character, meaning NOT. Read find and grep help for examples on how to use them: you'll like it ! Another interesting option is the new --older option for both grep and find, which will allow you, used with --newer, to search (in) and/or modify objects modified between the modification times of two other objects The third interesting thing is that now it will be easier for me to make other powerful commands like grep and find, since now they both use the same matching methods internally. The near future: ================ I'll probably add lots of options to the ls command, just to complete the find/grep duo, but I think the other commands finally may not need all this bunch of options, since you can use the find's --exec option to do very complicated things. Credits: ======== Thanks to Peter Bengtsson for his help. Hoping you'll find it more useful than ever. feel free to send me any feedback. bye, Jerome Alet

2 2

RE: [Zope] OS Error 24: Too many files open
by Astheimer, David (GXS) 04 Jun '01

04 Jun '01

Hi... Thanks for the reply. Actually, I'm using the most simple and streamline "vanilla" installation right out-of-the-box. I've not installed any additional products. I've not created any catalogs. Just simple document storage and retrieval. Regards, Dave -----Original Message----- From: Erik Enge [mailto:erik@thingamy.net] Sent: Monday, June 04, 2001 11:08 AM To: Astheimer, David (GXS) Cc: zope(a)zope.org Subject: Re: [Zope] OS Error 24: Too many files open On Mon, 4 Jun 2001, Astheimer, David (GXS) wrote: > Are long-standing temporary files a typical Zope signature? Not long-standing. Are you running any custom products? (Maybe something like ThreadSafeCounter?) Are you indexing a lot of stuff? I just saw Chris Withers mention that Zope writes big indexes to files so not to hog much memory... could be something like that?

1 0

Re: [Zope] Dreamweaver
by Tim Cook 04 Jun '01

04 Jun '01

CURTIS David wrote: > > Hi, > > I want to use dreamweaver to create a web site. How does one combine this product to zope? Having looked through the help files, it seems the extension .jpg can be a problem due to dhtml object code. I found some web pages that say it is currently being developed. Anyone doing this and what are your results? > Try here: http://zope.nipltd.com/public/lists/zope-archive.nsf/Main?SearchView=++&Que… -- Tim Cook, President - FreePM,Inc. http://www.FreePM.com Office: (731) 884-4126 ONLINE DEMO: http://www.freepm.org:8080/FreePM

1 0

Dreamweaver
by CURTIS David 04 Jun '01

04 Jun '01

Hi, I want to use dreamweaver to create a web site. How does one combine this product to zope? Having looked through the help files, it seems the extension .jpg can be a problem due to dhtml object code. I found some web pages that say it is currently being developed. Anyone doing this and what are your results?

1 0

ZODB for many-to-many relation
by Milos Prudek 04 Jun '01

04 Jun '01

I wonder if ZODB is suitable for the following problem, which I'll describe in relational terms: There are articles and writers (authors). Each article has at least one writer, but it can have more than one writer. I need to list all articles of a given writer, and all writers of a given article. A pure relation database solution would be as follows: To escape putting list of writers in 'articles' table, there is an 'article-writer' table, called 'aw'. It contains valid combination of writers & articles. aw table has these columns: a, w. articles table has these columns: a,other-data writers table has these columns: w,other-data To list all articles of a writer No.1 : SELECT aw.a, articles.other-data FROM aw, articles, writers WHERE aw.w=1 AND writers.w=1 AND articles.a=aw.a To list all writers of article No.2: SELECT FROM aw,articles,writers WHERE aw.a=2 AND article.a=2 AND writers.w=aw.w Is there an OO solution to this situation? -- Milos Prudek, confused ZODB newbie

2 1

Trouble installing the mySQL drivers
by Jakub Kasprzycki 04 Jun '01

04 Jun '01

Hello, Previously I had no problems installing the MySQL-python and mySQLDA on my RH6.2 but after totally reinstalling everything (now - RH6.2, python 2.1, mySQL 3.23.37, mySQL-python-3.0.5.1, mySQLDA 2.0.6) all compiled from sources... I get: Import Traceback Traceback (most recent call last): File "/usr/local/zope/lib/python/OFS/Application.py", line 528, in import_products product=__import__(pname, global_dict, global_dict, silly) File "/usr/local/zope/lib/python/Products/ZMySQLDA/__init__.py", line 91, in ? import DA File "/usr/local/zope/lib/python/Products/ZMySQLDA/DA.py", line 91, in ? from db import DB File "/usr/local/zope/lib/python/Products/ZMySQLDA/db.py", line 89, in ? import _mysql ImportError: libmysqlclient.so.10: cannot open shared object file: No such file or directory indicating that the _mysql module couldn't locate the libmysqlclient.so.10 am I right??? What should has gone wrong? Please help as I am to put this server in production really soon. :-) ******************************************************** * Jakub Kasprzycki - jkasprzycki(a)czestochowa.um.gov.pl * * Urz±d Miasta Czêstochowy - www.czestochowa.um.gov.pl * ********************************************************

2 1

RE: [Zope] Core Dump on ./start after system power out
by Farrell, Troy 04 Jun '01

04 Jun '01

Does python load to an interactive prompt all right? Can we have the traceback? try starting zope with the -D option to see if that dumps more information. Troy -----Original Message----- From: Gerrie Roos [mailto:gerrie@trispen.com] Sent: Monday, June 04, 2001 7:47 AM To: zope(a)zope.org Subject: [Zope] Core Dump on ./start after system power out Hello Recently a guy with an pick-axe dug through the mains supply outside our office block. Our server went down cold. After splicing, the server booted up fine. Only now, starting up zope (./start) results in a python core dump : Bad system call. As time is of the essence, I decided to scream for help while I'm trying to fix things myself. I'm about to delete all the .pid files in zopepath/var...can't really imagine it would help...any other bright ideas appreciated. Zope-2.3.0 Python 2.0 FreeBSD 3.5 _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0