- Zope - Zope lists

Virtual hosting changes
by Terry Hancock 29 Mar '06

29 Mar '06

I've been for some time using a "hacked" version of virtual host monster that was maintained by my hosting company, and I've just moved to a new hosting service with just the "stock" version. My impression was that the hack was mostly cosmetic (just sweetened the interface a little by giving you separate form-fields etc). But what bothers me is this note on the VHM page: """ You should only use the "Mappings" tab for simple virtual hosting, in a Zope that is serving requests directly. Each mapping line is a host name followed by a path to a Folder. The VHM checks the host specified in each incoming request to see if it is in the list. If it is, then the corresponding path is inserted at the start of the path, followed by "VirtualHostRoot". """ WHAT!? Why? I hate messing with anything under /etc/apache2, and I strongly hope to mess with it now, get it right, and then forget about it (last time I left it for about 5 years). But I used to reconfigure VHM quite frequently (say every 4-6 months) to manage new sub-domains, etc, and VHM made it easy. Is this warning just because the author expects me to like the Apache interface better or is there some deeper security or performance reason why I wouldn't want to use VHM more or less as I have been? The real downside of course, is that if using VHM to manage sub-domains behind an Apache proxy is "deprecated" then I'm going to have a hard time finding the right documentation to set Apache up right (so far, I'm just trying to port my old settings -- but the old machine was FreeBSD and the new one is Debian Linux, so Apache's config files are laid out quite differently as are the filesystem paths I need to use and the default settings for Apache (and in general, I trust Debian's choices better, so I'm trying to keep this fairly minimal if I can). Thanks for any comments. Cheers, Terry

1 0

verbose-security
by Jeremy Cook 29 Mar '06

29 Mar '06

I have tried using the verbose-security option in Zope 2.8.6. I cannot see that it is actually doing anything different from the standard security. I have previously used VerboseSecurity and know what the error log should look like. in my zope.conf security-policy-implementation PYTHON verbose-security on I am sure that zope.conf is being read, because if I type in invalid values, I see error messages on startup. I am using Plone 2.1.2. When I access an object that I do not have permission I get the following error message: Time 2006/03/24 12:32:51.623 GMT+1 User Name (User Id) jc (jc) Request URL http://bla.bla/Bla/folder_listing Exception Type Unauthorized Exception Value Not authorized to access binding: context Traceback... I somehow expected a little more. I expected to be told what permissions I needed, and what permissions I had. Can anyone tell me if I am doing anything wrong? Jeremy -- Jeremy.Cook(a)bccs.uib.no tlf: +47 55 58 40 65 Parallab Bergen Centre for Computational Science

4 4

SSL over Multiple Zope/Plone sites?
by michael nt milne 29 Mar '06

29 Mar '06

Hi I've got a few Plone sites set-up using Apache through Zope. The question is, I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address. What would be the way round this? I know I could set-up SSL on Zope only using the following documentation: http://www.zope.org/Members/Ioan/ZopeSSL but if I can't carry this through to Apache then I'd have to run Zope as the web server as well as the application server. Thanks Michael

9 28

Virtual Hosting is confusing
by Vishal Kashyap 28 Mar '06

28 Mar '06

Hi , Zope virtual hosting in Zope is confusing to me. Would anyone make me understand that with a apache equivalent. I have a website as http://myserver.com:8080/myprod I want to host it as http://myprod.com:80 I would give a DNS entry for http://myprod.com:80. I want to call the website from browser as http://myprod.com Would anyone please help me with this. Thanks in advance -- With Best Regards, Vishal Kashyap. http://www.vishal.net.in

3 3

Tutorial
by Vishal Kashyap 28 Mar '06

28 Mar '06

Hi , Can anyone me point to a tutorial which relates to apache+php . Thanks in advance -- With Best Regards, Vishal Kashyap. http://www.vishal.net.in

3 4

kupu drawers
by Garito 28 Mar '06

28 Mar '06

Hi! I try to create a image library for the image drawer but when I click on the drawer button an error is raise: this.shared.xmldata.setProperty is not a function I supouse that the error is raised because the xml is incorrect but I can't see where Can you help me? This is the XML: <?xml version="1.0" ?> <libraries> <library id="Galeria"> <uri>http://yanged:9180/EspaciosYanged/Huete/huete.cc/Carpeta Imagenes/Ver/Galeria</uri> <title>Galeria de fotos</title> <src>http://yanged:9180/EspaciosYanged/Huete/huete.cc/Carpeta Imagenes/Ver/Galeria</src> <icon>http://yanged:9180/EspaciosYanged/Huete/huete.cc/Imagenes/CarpetaImagenes.p…</icon> </library><library id="Imagenes"> <uri>http://yanged:9180/EspaciosYanged/Huete/huete.cc/Carpeta Imagenes/Ver/Imagenes</uri> <title>Imagenes de la web</title> <src>http://yanged:9180/EspaciosYanged/Huete/huete.cc/Carpeta Imagenes/Ver/Imagenes</src> <icon>http://yanged:9180/EspaciosYanged/Huete/huete.cc/Imagenes/CarpetaImagenes.p…</icon> </library> </libraries> Thanks a lot! -- Mis Cosas http://blogs.sistes.net/Garito/

2 2

ZStylesheet, Whoops, hold that problem!
by John Huttley 28 Mar '06

28 Mar '06

I've just realised it was a bit of TAL that ZSS had put in there. sorry about that--

1 0

Keyerror removing ZStylesheet
by John Huttley 28 Mar '06

28 Mar '06

I've shot my self in the foot removing ZStylesheet from my app. When ever I try and view it, i get a key error. I've tried reloading ZStylesheet and various imports and exports but its sticking with me. Is there any easy way of fixing this sort of thing? --john

1 0

How to do this trick..
by Jason C. Leach 28 Mar '06

28 Mar '06

Hi, I'm wondering how I can do this little trick (sp_info is a globaly devide var, it's a dictionary obj): <option tal:repeat="group groups/existing/high" tal:content="group" tal:attributes="onmouseover string:doTooltip(event, '${sp_info/${group}/common_name}')" onmouseout="hideTip()"> </option> So based on my the value of 'group' from my repeat, I want to use the value to look up another value in a different dictionary. It works if I do this: (event, '${sp_info/whatever/common_name}') but does not like me using the embedded ${group}. Thanks, Jason. -- ........................................ .... Jason C. Leach .... PGP Key: 0x62DDDF75 .... Keyserver: gpg.mit.edu

6 5

OWASP Top Ten Most Critical Web Application Security Vulnerabilities
by Stacy.Ladnier＠noaa.gov 28 Mar '06

28 Mar '06

The Web Development Group at our office is currently trying to compose a white paper addressing the steps Zope, Plone and Python take to ensure secure web applications, as well as additional steps developers should take to keep it that way. Current documentation existing on the web does not seem to specifically address the concerns many of our customers express. We often find ourselves spending more time defending the technology and its security than we spend on development itself. We decided it is time to write a paper to put all concerns and questions to rest. The goal we are aiming for is to dig deeper than the current documentation and work on explaining the intricate details of what makes each of these technologies secure from attacks and security weaknesses. As a starting point, we are looking at the top ten critical web application security vulnerabilities put out by The Open Web Application Security Project (http://www.owasp.org/documentation/topten.html) We are far from being the experts on this subject matter, even though we try to get a bit closer every day. Any help from the mastermind developers themselves would be greatly appreciated and only add to the validity of the white paper. Once the paper is complete, we are willing to publish it for the communities to use for their own purposes. Please provide any input or suggestions you have. The more people help, the better the resulting paper will become. Stacy Ladnier Software Engineer/Web Developer Anteon Corporation

1 0