- Zope - Zope lists

RE: [ZCommerce] Secure storage of credit card info
by Meilicke, Scott 09 Jun '00

09 Jun '00

Hi there, I know your post indicates you've thought about this, but you may want to reconsider storing CC info at all. It's a trade off on convenience for the customer and security precautions on your site. If you don't have the numbers, that's one less thing an intruder could do with your information when they do break in. If you do store CC info, you should probably offer the option to not store the CC#. I know I don't like my CC info in a merchant database, encrypted or not. Scott -----Original Message----- From: R. David Murray [mailto:bitz@bitdance.com] Sent: Thursday, June 08, 2000 5:57 PM To: zope(a)zope.org Cc: zcommerce(a)codeit.com Subject: [ZCommerce] Secure storage of credit card info OK, any of you out there who have thought about ecommerce, cryptography, and zope, I've got a design question for you. Actually, this question is independent of zope, but I need to solve it in a zope context. You have a ZCommerce site. You accept credit cards, and securely communicate with a CC processor to verify the transacton. Now, you want to save the CC# and other info in case something needs to be done with it later, and probably store the CC# so this customer doesn't have to type it in again later. Regardless of whether you are storing this info in a relational database or in the ZODB, how do you secure that information? Ideally I'd like it to be encrypted on disk. Now, storing it in a database probably makes it pretty hard to grep out even if a hacker manages to snarf the database file, but I'd like to encrypt it. But if I encrypt it, I have to have a decryption key somewhere. Where do I store the decryption key so that the cracker who snarfs the database file can't get it (just in memory somewhere?), and yet have the system be able to boot itself, including having the key, without human intervention? It seems to me like this is a Hard Problem, but I'm not up on the current cyrptography practice. So if there is a well known general solution, I'd love to hear about it. Otherwise, does anyone know what current Best Practice is? --RDM _______________________________________________ ZCommerce Mailing List - ZCommerce(a)codeit.com http://lists.codeit.com/mailman/listinfo/zcommerce

1 0

ZDiscussions in classes?
by Alexander Limi 09 Jun '00

09 Jun '00

Hi, I have a problem with getting ZDiscussion working the way I want it to. First a little background, so it becomes easier for me to explain what I want to do: On my site I have several users (called "artists") that I have built a ZClass for. This Artist-ZClass contains a propertysheet with the properties of the artist, it also subclasses ObjectManager, so the artists can add their own pictures in their own object. This works excellent, and I am about to take the next step - adding a discussion forum on each artist, so people can discuss the artist's work directly on his pages. I then tried to add a ZDiscussion Topic ("discuss") in the ZClass. (I also regenerated the methods before proceeding, to get the default interface.) When I tried to access the discussion at: http://my.host/artists/testartist/discuss Zope asks me for a login, and not even the superuser can access it. Either my thinking is screwed up (it often is ;), or it is impossible to accomplish this with ZDiscussions. Could anyone offer me some insight as to what I'm doing wrong here? -- Alexander Limi alexander(a)limi.net

1 0

Install problem questions
by Eric Damien Berna 09 Jun '00

09 Jun '00

I'm trying to get Zope to work on my computer, but I'm having a problem that I can't seem to figure out how to fix. I'm installing it on a NetBSD system with the packages system. It seems to install correctly, and at least partially runs, since it does give me an error code. Yet all it does is give me this error code, and nothing else. I've looked through the Zope Web site, and searched the mailing list archives,but I can't find anything that mentions this problem. What am I doing wrong? How can I fix this? Thanks. This is the error in its entirety: Zope Error Zope has encountered an error while publishing this resource. Resource not found Sorry, the requested Zope resource does not exist. Check the URL and try again. Troubleshooting Suggestions The URL may be incorrect. The parameters passed to this resource may be incorrect. A resource that this resource relies on may be encountering an error. For more detailed information about the error, please refer to the HTML source for this page. If the error persists please contact the site maintainer. Thank you for your patience. Traceback (innermost last): File /usr/pkg/lib/zope/lib/python/ZPublisher/Publish.py, line 214, in publish_module File /usr/pkg/lib/zope/lib/python/ZPublisher/Publish.py, line 179, in publish File /usr/pkg/lib/zope/lib/python/Zope/__init__.py, line 202, in zpublisher_exception_hook (Object: ApplicationDefaultPermissions) File /usr/pkg/lib/zope/lib/python/ZPublisher/Publish.py, line 167, in publish File /usr/pkg/lib/zope/lib/python/ZPublisher/HTTPResponse.py, line 299, in setBody File /usr/pkg/lib/zope/lib/python/ZPublisher/HTTPResponse.py, line 511, in notFoundError NotFound: (see above) -- Eric Damien Berna Thiel Design Phone: 414.271.0775 Email: eric(a)thiel.com

1 0

RE: [Zope] Getting a specific user role
by Mabe, Brad 09 Jun '00

09 Jun '00

That did the trick. Someday I'm going to get the hang of this stuff. Thanks, Jason. -=Brad=- -----Original Message----- From: Jason Spisak To: Mabe, Brad Cc: 'zope(a)zope.org' Sent: 6/8/00 7:48 PM Subject: Re: [Zope] Getting a specific user role Mabe, Brad writes: > Forgive me if this has been covered before. There's no real great documentation on using the security API, and it's changing a bit anyway. > > I am implementing a login/security scheme through the use of GUF and SQL > methods. My user and role information is kept in a SQL database and a user > can have more than one role assigned to him/her. > > What I would like to do is check if a specific role has been assigned to the > current user, and then display some additional menu items if that role has > been assigned. I haven't been able to figure out how to get and check the > roles that have been assigned to the current user. > > As usual, any help will be greatly appreciated. > > -=Brad=- try: <dtml-if "AUTHENTICATED_USER.has_role('MyRole')"> My stuff </dtml-if> Jason Spisak CIO HireTechs.com 6151 West Century Boulevard Suite 900 Los Angeles, CA 90045 P. 310.665.3444 F. 310.665.3544 Under US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B) This email address may not be added to any commercial mail list with out my permission. Violation of my privacy with advertising or SPAM will result in a suit for a MINIMUM of $500 damages/incident, $1500 for repeats. _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1

Random line of Products
by Oleg Broytmann 09 Jun '00

09 Jun '00

Hello! I created and published three demo toy Products I named them "Random" Products, because each of them displays text, randomly selected from a list prepared by webmaster. These Products differ in how they store the text items. I learned a good deal of Zope internals while wrote it, and I hope that looking into it will help people to learn Product API. I also run a demo site for these Products. Source code: http://www.zope.org/Members/phd/Random/ Demo site : http://sun.med.ru/pcgi/Random/ DETAILS: The first Product, RandomLine was created from Boring Product - I just learned Product API. The product stores text (edited in a texarea), splits the text into a list of lines and when asked displays a random line. The second Product, RandomLine_v, is just a modified version of the first. The difference is volatile attributes. I found (in RandomLine) that I store both text and splitted list of strings in ZODB. I thought I need to learn volatile attributes and this version stores only text in ZODB. The splitted list stored in a volatile attribute and recomputed when neccessary. The third Product, RandomItem, implements the same idea, but with different implementation. The core class is ObjectManager-derived, and it stores a list of items. Every item in turn stores multiline text. Oleg. ---- Oleg Broytmann http://www.zope.org/Members/phd/ phd2(a)mail.com Programmers don't die, they just GOSUB without RETURN.

1 0

Re: [Zope] zodbc performance question
by Tino Wildenhain 09 Jun '00

09 Jun '00

Francisco José Esteban Risueño wrote: > > I think Zope creates itself a pool of connections to the database, extending it > when he need more performance. In our installation, we see initially seven > connection to Oracle (trough ODBC) generated by only one zodbc database conection > object Yes, but it uses a housekeeping to prevent deadlocks. If you use more connections in the same dtml-document it may lead into the problems. Imagine: connection1:update table connection2:select from table So connection1-object will never know there is an attempt to read from the table after the update. It will however "commit" the write when the document is fully generated. connection2-object will block therefore. HTH Tino Wildenhain

1 0

Re: FSSession newbie problem
by Hung Jung Lu 09 Jun '00

09 Jun '00

--- In zope(a)egroups.com, Marcello Lupo <lupo@a...> wrote: >and macically i obtain the same error. >this is the code i used: ><dtml-call FSSession> ><dtml-unless "FSSession.has_key('cart')"> ><dtml-call "FSSession.set('cart',{})"> ></dtml-unless> > ><dtml-call "FSSession['carrello'].update(REQUEST.form)"> I have tried your code with 'cart' everywhere, and it worked just fine. Can you print out the form variables? Are all the statements inside the same DTML file? It really works fine. Also, make sure that FSSession is in a parent folder of your DTML method. (Root folder is usually a good idea.) Is your machine cookie-enabled? ==================================================== <dtml-var standard_html_header> <dtml-call FSSession> <dtml-unless "FSSession.has_key('cart')"> <dtml-call "FSSession.set('cart',{})"> </dtml-unless> <dtml-call "FSSession['cart'].update(REQUEST.form)"> <dtml-var "FSSession['cart']"> <dtml-var standard_html_footer> ==================================================== If you still have problems, you can try SQLSession or HappySession. For beginners I would recommend HappySession so you don't need to worry about the details of FSSession or SQLSession. Download HappySession from http://www.zope.org/Members/hungjunglu/Products/HappySession Add an HappySession instance in your Zope hierarchy. Then try: ==================================================== <dtml-var standard_html_header> <dtml-unless "SESSION.has_key('cart')"> <dtml-call "SESSION.set('cart',{})"> </dtml-unless> <dtml-call "SESSION['cart'].update(REQUEST.form)"> <dtml-var "SESSION['cart']"> <dtml-var standard_html_footer> ==================================================== regards, Hung Jung ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

3 4

Zope logging with multilog (daemontools)
by Frank Tegtmeyer 09 Jun '00

09 Jun '00

I provided a document that describes a setup for logging that uses the external logger program multilog. multilog prevents filling the disk, provides filtering by patterns and exact TAI64N timestamps. It is designed to never loose any log data. multilog is part of Daniel J. Bernsteins dameontools package. You may find the article at http://www.lightwerk.de/zope/logging Regards, Frank

1 0

How to init the body of a ZClass herited of DTML Method Class?
by Fr�d�ric Quin 09 Jun '00

09 Jun '00

Hi all, I created a ZClass which herite of the DTML Method Class. Now, I want to init the body of all my objects of ZClass with the same script. How can I acess to this body ? Thanks Fred

1 0

Re: [Zope] Secure storage of credit card info
by Cary O'Brien 09 Jun '00

09 Jun '00

> OK, any of you out there who have thought about ecommerce, cryptography, > and zope, I've got a design question for you. Actually, this question > is independent of zope, but I need to solve it in a zope context. > > You have a ZCommerce site. You accept credit cards, and securely > communicate with a CC processor to verify the transacton. Now, > you want to save the CC# and other info in case something needs > to be done with it later, and probably store the CC# so this > customer doesn't have to type it in again later. Regardless > of whether you are storing this info in a relational database > or in the ZODB, how do you secure that information? Ideally > I'd like it to be encrypted on disk. Now, storing it in a database > probably makes it pretty hard to grep out even if a hacker > manages to snarf the database file, but I'd like to encrypt it. > But if I encrypt it, I have to have a decryption key somewhere. > Where do I store the decryption key so that the cracker who > snarfs the database file can't get it (just in memory somewhere?), > and yet have the system be able to boot itself, including having > the key, without human intervention? It seems to me like > this is a Hard Problem, but I'm not up on the current > cyrptography practice. So if there is a well known general > solution, I'd love to hear about it. Otherwise, does anyone > know what current Best Practice is? > Good question. I was just talking to someone about this a few days back. What they did was to a) create a public/private keypair. Don't leave the private key ANYWHERE except on the CC verification machine (described below) b) encrypt the data using the public key c) store the encrypted data d) ship the encrypted cc information through an internal firewall[1] with one hole to a CC verification back end. This back end is protected as much as possible, accessible by as few people as possible. It uses the private key to decrypt and verify. You are still vulnerable if someone can get in and snarf the CC information during b), but at least you don't have thousands of CC numbers hanging around on your frontend or database machines. The idea is that the CC verification machine is much less likely to be compromised. Best practice? I don't know. But it sounded like a good idea to me. Hope I got this right. (Hi Ramon!) -- cary [1] Which also needs to have limited access.

2 1