- Zope - Zope lists

what products to use?
by Owen Smith 31 Jul '00

31 Jul '00

Hi all I am trying to implement a site which needs the following- A forum/discussion a database of members (400+) who can access certain parts of the site not available to anonymous users the ability for members to change their details online the ability for new members to sign up online which products or methods should I look at using with Zope anyone running a similar setup? (I am confused by choice what works whats current etc etc!) Owen (newbie!)

3 2

connection problem
by vance 31 Jul '00

31 Jul '00

Hi, I'm running Zope 2.1.6 on Redhat 6.2 Intel based system. It appear to start and when I go to manage page and enter username and password I get the following error: Traceback (innermost last): File /usr/lib/python1.5/site-packages/ZPublisher/Publish.py, line 214, in publish_module File /usr/lib/python1.5/site-packages/ZPublisher/Publish.py, line 179, in publish File /usr/lib/python1.5/site-packages/ZPublisher/Publish.py, line 151, in publish File /usr/share/zope/lib/python/Products/SiteAccess/ChangeBehaviors.py, line 244, in traverse File /usr/lib/python1.5/site-packages/ZPublisher/HTTPResponse.py, line 551, in unauthorized Unauthorized: i have used zpasswd.py and set a username and password but can't get any further. I have read and re-read docs to no avail. Please help! Best regards, Vance Stith Boplicity - http://www.boplicity.com webmaster(a)boplicity.com 610.807.9724 (phone) - 610.867.4291 (fax)

2 1

Re: [Zope] How to start developing in zope
by Firestar 31 Jul '00

31 Jul '00

------Original Message------ From: Kapil Thangavelu <kvthan(a)wm.edu> To: Firestar <theebh(a)mail.com> Sent: July 30, 2000 3:21:54 PM GMT Subject: Re: [Zope] How to start developing in zope acquistion is an integral part of zope and is pretty powerful for simplifying design and implementation. Kapil ------------------------------- Hi, thanks for your reply. Is acquisition similar to the concept of 'inheritance' in OOP? (or more?) I heard of this 'algebra of acquisition' written by someone...is it essential and where can i find it? TIA. regards, firestar ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup

2 1

Calender Tag & SQL caching
by Arjan Scherpenisse 31 Jul '00

31 Jul '00

Hi everybody, This is my first posting to this list. I have a website which will make use of a calender, with events on it stored in a MySQL database. Now, i wondered how to efficiently show this data from the database in the calender. I mean, not in a way that a sql query is made for each day on the calender (which would make up to 31 queries in the Calender Tag 'month' view...) So i wondered, is there some way to 'cache' the result of the SQL method, so that i can use just one query to fill up an entire month, for instance? regards, -- Arjan Scherpenisse acscherp(a)wins.uva.nl may the source be with you === http://www.gnu.org ===

3 3

Python/Zope API
by Alexandre A. Rodioukov 31 Jul '00

31 Jul '00

Hello folks. I want to be able to render Zope objects from my python external method/product. Idea is to use it to render parent object. Here is code I came up so far with: def view(self, REQUEST): if self.meta_type == 'Folder': doc = self.aq_base.index_html(self, self.REQUEST) else: doc = self.aq_base(self, self.REQUEST) return doc It does return rendered parent object, but I have some questions and probably request for improvement ideas :) 1. The whole thing becomes broken with SiteAccess. Complains about premissions/PhysicalRoot (AFAIR) 2. Are there ways to improve it? For example I would love to know how you can check if you can actually render an object. (For example you can not render Control_Panel). Possible use for it (to make the whole idea a bit clearer) /index_html (some stuff in it) /view (above code in external method) /index_html/view returns rendered index_html doing some magic with HTML/whatever is in it (for example encrypts it with public key, strips down carriage returns/tabs/spaces etc...) In other words acts as a filter. Thanks for any advice, Regards, Simuran.

2 1

RE: [Zope] Interbase DA compiled for Windows?
by R. Herold 31 Jul '00

31 Jul '00

Sorry, > connect to Interbase (kinterbasdb-0.2.1.tar.gz and InterbaseStorage098.tgz), this was meant to be kinterbasdb-0.2.1.tar.gz and _ gvibDA-0.1.tar.gz _ Thanks again, -- Ralf Herold | mailto:ralf.herold@charite.de, PGP mailto:ralf.herold@gmx.net

3 2

Announce: StarRave0.0.16
by ed colmar 30 Jul '00

30 Jul '00

StarRave-0.0.16 .. product announce [ a bow to the high zope council ] [ a bow to the zope mailing list ] StarRave is a zope/python product that manages information related to djs, events, and promoters. Specifically, this product is built for the Rave scene, where there are hundreds of similar websites that do not share any information. StarRave allows these sites to transparently access information stored on any remote StarRave server. A few attempts have been made to house all the data related to raving, but the abundance of overlapping ideas, names, and resources, creates a maintenance bottleneck. StarRave is designed to let each server maintian information related to it's region, or it's record label, or it's event schedule. Currently StarRave is set up in two parts, a "server" and a "host" . The server is the primary interface that most will see. It enters, edits, and displays data, while providing a rich interface. The "host" collects data from server sites, and organizes it all into a tidy xml package. StarRave is compatible with 2.1.x versions of zope with some bugs. starRave is compatible with 2.2.0 versions of zope with some catalog inconsistancies This product still needs work, but runs quite well. Of course all contributions are encouraged. To download StarRave: http://www.zope.org/Members/element/StarRave or http://www.starrave.org:8080/sr/webdav/ StarRave sites in use: http://www.starrave.org:8080/sr/demo/ http://www.trustcrew.org/trustcrew/

1 0

password
by Jonathan Desp 30 Jul '00

30 Jul '00

Hi, the program zpasswd prompt. they said: If this program is called without command-line options, it will prompt for all necessary information. The available options are: -u / --username= Set the username to be used for the superuser -p / --password= Set the password -e / --encoding= Set the encryption/encoding rules. Defaults to SHA-1. OPTIONAL -d / --domains= Set the domain names that the user user can log in from. Defaults to any. OPTIONAL. Filename is not option, and should be the name of the file to store the information in. __________________ What I should write in this source code from zpasswd ? --> """Zope password change system""" __version__='$Revision: 1.8 $ '[11:-2] import sys, string, sha, binascii, whrandom, getopt, getpass, os try: from crypt import crypt except ImportError: crypt = None def generate_salt(): """Generate a salt value for the crypt function.""" salt_choices = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ "abcdefghijklmnopqrstuvwxyz" \ "0123456789./" return whrandom.choice(salt_choices)+whrandom.choice(salt_choices) def generate_passwd(password, encoding): encoding=string.upper(encoding) if encoding == 'SHA': pw = '{SHA}' + binascii.b2a_base64(sha.new(password).digest())[:-1] elif encoding == 'CRYPT': pw = '{CRYPT}' + crypt(password, generate_salt()) elif encoding == 'CLEARTEXT': pw = password return pw def write_access(home, user='', group=''): import whrandom pw_choices = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ "abcdefghijklmnopqrstuvwxyz" \ "0123456789!" ac_path=os.path.join(home, 'access') if not os.path.exists(ac_path): print '-'*78 print 'creating default access file' acfile=open(ac_path, 'w') pw = '' for i in range(8): pw = pw + whrandom.choice(pw_choices) acfile.write('superuser:' + generate_passwd(pw, 'SHA')) acfile.close() os.system('chmod 644 access') print """Note: The super user name and password are 'superuser' and '%s'. You can change the superuser name and password with the zpasswd script. To find out more, type: %s zpasswd.py """ % (pw, sys.executable) import do; do.ch(ac_path, user, group) def main(argv): short_options = ':u:p:e:d:' long_options = ['username=', 'password=', 'encoding=', 'domains='] usage = """%s [options] filename If this program is called without command-line options, it will prompt for all necessary information. The available options are: -u / --username= Set the username to be used for the superuser -p / --password= Set the password -e / --encoding= Set the encryption/encoding rules. Defaults to SHA-1. OPTIONAL -d / --domains= Set the domain names that the user user can log in from. Defaults to any. OPTIONAL. Filename is not option, and should be the name of the file to store the information in. Copyright (C) 1999 Digital Creations, Inc. """ % argv[0] try: if len(argv) < 2: raise "CommandLineError" optlist, args = getopt.getopt(sys.argv[1:], short_options, long_options) if len(args) != 1: raise "CommandLineError" access_file = open(args[0], 'w') if len(optlist) > 0: # Set the sane defaults username = 'superuser' encoding = 'SHA' domains = '' for opt in optlist: if (opt[0] == '-u') or (opt[0] == '--username'): username = opt[1] elif (opt[0] == '-p') or (opt[0] == '--password'): password = opt[1] elif (opt[0] == '-e') or (opt[0] == '--encoding'): encoding = opt[1] elif (opt[0] == '-d') or (opt[0] == '--domains'): domains = ":" + opt[1] # Verify that we got what we need if not username or not password: raise "CommandLineError" access_file.write(username + ':' + generate_passwd(password, encoding) + domains) else: # Run through the prompts while 1: username = raw_input("Username: ") if username != '': break while 1: password = getpass.getpass("Password: ") verify = getpass.getpass("Vefify password: ") if verify == password: break else: password = verify = '' print "Password mismatch, please try again..." while 1: print """ Please choose a format from: SHA - SHA-1 hashed password CRYPT - UNIX-style crypt password CLEARTEXT - no protection. """ encoding = raw_input("Encoding: ") if encoding != '': break domains = raw_input("Domain restrictions: ") if domains: domains = ":" + domains access_file.write(username + ":" + generate_passwd(password, encoding) + domains) except "CommandLineError": sys.stderr.write(usage) sys.exit(1) # If called from the command line if __name__=='__main__': main(sys.argv) Very truly yours, <><><><><><><><><><><><><><> Jonathan Desp Chairman and CEO, Atomasoft Inc. Matter will become software http://www.atomasoft.com <><><><><><><><><><><><><><>

4 3

RE: [Zope] Starting Zope
by Chris McDonough 30 Jul '00

30 Jul '00

Not to continue offtopic for too much longer, but IMHO, the "only root can bind to ports under 1025" was, and continues to be, a terrible UNIX hack that was possibly reasonable at its time of inception, but that has since *caused* more security holes than it ever helped to prevent. The argument for the hack is backwards compatibility, any other explanation usually ends up as rationalization or circular logic. My $.02. > -----Original Message----- > From: Bill Anderson [mailto:bill@libc.org] > Sent: Sunday, July 30, 2000 5:04 PM > To: zope(a)zope.org > Subject: Re: [Zope] Starting Zope > > > > (Quoting reversed for sake of continuity. > > > On Sun, 30 Jul 2000, Cary O'Brien wrote: > > > > > > Cary O'Brien wrote: > > > > > > > > > Well... > > > > > > > > > > If you are running on Linux you could simply edit the > kernel code to > > > > > elimitate the check on being root to bind to low > ports. That's what > > > > > we did. > > > > > > > > Which is an even worse idea. > > > > > > > > > > Why? On a sufficiently firewalled off box, where the few > logins are > > > completly trusted, what's the diff? If you were worried > about people > > > cracking a user account and getting underneath telnet, > than limit the > > > lifting of the restriction to port 80. If you are concerned that > > > non-root users could launch attacks from low ports at > other machines, > > > assuming that only good guys can come from low ports is > pretty naive. > > > > > > The whole business about not letting anyone but root bind > to low ports > > > makes sense for a public access machine where all the first year > > > engineering students have an account, but for a dedicated > application > > > server it is kind of misdirected. You ought to be running next to > > > nothing but the application, and you had better trust > everyone that > > > you give a login to, and you out to have the thing locked > > > down/firewalled well. So the tiny bit of possible > protection may not > > > be worth the hassle/risks of writing your own suid-wrapper, or the > > > complexity of having a redirect and messing with > site-access so that > > > the port numbers in the zope -- what it is that parameter > -- base or > > > whatever, comes out write. > > > > > > Just for fun - does NT have the same restriction? > > Nitesh Dhanjani wrote: > > > > Interesting argument. However, consider this: if you > completely trust your > > 'firewalled' box, then why not run the web server as root? > One response, > > in your case is the fact that you mention your trust on > users(humans are > > the most easy to compromise, however that argument is a bit > OT). However, > > do you trust all of your webserver code? Do you trust your cgi-bin > > scripts and applications? And by trust I not only mean > harmful intent by > > the authors of software, but unintentional bugs which can > be exploited, > > and will be given the privilege to bind to <1024 ports even > when they run > > as a user with least privileges. > > > Exactly. In addition, relying solely on a firewall is a bad > idea from a security > standpoint. Firewalls can. and do get breached. > > I don't run many services on _any_ of my machines for > security reasons. I certainly don't > want Joe Random User to fire them up either. Consider tftpd, > or telnetd, or rlogin, > rusers, rwho, ruptime, etc.. There are many ways a user can > compromise, not only the > machine he is on, but other machines by having the capability > to bind to ports under 1024. > > Nearly all of them are off topic for this list; thus I would > recommend a number of the > security resources available on the web, such as: > > http://www.rootshell.com > http://www.securityfocus.com > > Just a quick example: A user can upload a custom compiled > version of (insert servie such > as DNS, NIS, telnetd, httpd, etc> that uses his/her local > libraries, bypass /etc/services. > since they can bind to ports under 1025, they can be started > by the user. Whereas, for > example, on other systems, their app would fail. Now, > consider that if they used a version > of, say ftpd, or fingerd, or named, that has known security > openings, they can then > exploit this to get root accounts; the firewall being > bypassed by being local to the > machine. > > Remember, Cary, if you don't think like a cracker/hacker, you > can't stop them. If you > can't see why allowing users (and users' programs) can be a > problem, doing so is an > violaiton of the basic premise of good security: > That which is not specifically allowed, is denied. > > And, BTW, for the record, I handle Unix/Network security for > a company known as > Hewlett-Packard, so I think I have a good idea of the risks > and potnetial exploits ;) > > > > -- > Do not meddle in the affairs of sysadmins, for they are easy to annoy, > and have the root password. > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

problems with the export
by Fabio Akita 30 Jul '00

30 Jul '00

Something strange happened when I tried to export a site. I tried many times but none worked. Anyone knows what could this be? Here follows the Zope error message: Zope Error Zope has encountered an error while publishing this resource. Error Type: AttributeError Error Value: Astral ---------------------------------------------------------------------------- ---- Troubleshooting Suggestions The URL may be incorrect. The parameters passed to this resource may be incorrect. A resource that this resource relies on may be encountering an error. For more detailed information about the error, please refer to the HTML source for this page. If the error persists please contact the site maintainer. Thank you for your patience. Traceback (innermost last): File D:\Zope\lib\python\ZPublisher\Publish.py, line 214, in publish_module File D:\Zope\lib\python\ZPublisher\Publish.py, line 179, in publish File D:\Zope\lib\python\Zope\__init__.py, line 202, in zpublisher_exception_hook (Object: ElementWithAttributes) File D:\Zope\lib\python\ZPublisher\Publish.py, line 165, in publish File D:\Zope\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: manage_exportObject) File D:\Zope\lib\python\ZPublisher\Publish.py, line 102, in call_object (Object: manage_exportObject) File D:\Zope\lib\python\OFS\ObjectManager.py, line 450, in manage_exportObject (Object: ElementWithAttributes) File D:\Zope\lib\python\OFS\ObjectManager.py, line 226, in _getOb (Object: ElementWithAttributes) AttributeError: (see above) Regards Fabio Akita - Developer F/Nazca S&S / Adversiting akita(a)fnazca.com.br

1 0