- Zope - Zope lists

RE: [Zope] is WebDAV a security hole?
by Brian Lloyd 05 Jun '00

05 Jun '00

> Been playing around with WebDAV from IE5 connecting to a RedHat 6.1 > +Zope 2.1.6 > > And it seems that quite a bit of the stuff that propably shouldn't be > visible can be seen, > for example acl_users What other things are you referring to? (see answer for acl_users below) > > Without being logged in I can start a download of it, eventually IE5 > fails, but I get this uncomfortable feeling that this is more > due to IE5 > not handling this document type than anything else... > > If I used some other WebDAV client, could I then download > acl_users, and > if so, would this expose usernames/passwords? It would not expose passwords - I believe that what you are seeing is a sort of non-obvious but basically harmless thing. User folders (acl_users) do not have an index_html method (by design). When a DAV client tries to "download" acl_users, it is actually acquiring the closest index_html from above and downloading that :^) One could argue that this is lame and that attempting to GET .../acl_users/ should raise an error (404?). I'm interested in other viewpoints on this - if there is some consensus, a proposed change should be put in the Collector. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

2 1

tree state cookie
by Ragnar Beer 05 Jun '00

05 Jun '00

Howdy! I just recently got complaints from people visiting my web site. They have activated the "website wants to set cookie" alarm and they got lots of alarms when visiting my website. Since I never use any cookies it wasn't hard to find the cause: I wasn't aware that trees use cookies to store their state. Is there an option to disable this? (Cuz I don't want no cookies;) --Ragnar

2 1

ZClass and class variable
by Francois-Regis CHALAOUX 05 Jun '00

05 Jun '00

Hi all, Is it possible to declare a class variable in a Zclass? And if yes, how to call this variable in class ZClass methodes? Bye, FR.

2 1

How do you call the string?
by Martin Seehuusen 05 Jun '00

05 Jun '00

Hi! I would like to look up the properties on an html file that I've made. I've made a string on my html file, but I'm not sure how to call it! I've understood that a <dtml-in> is to be used, but I don't know what the string is called. Could someone help me with that!? /Martin S.

2 1

Copy/Paste cookie problem
by Oleg Broytmann 05 Jun '00

05 Jun '00

Hello! I constantly have cookie problem (at least I think it's cookie problem). I cannot copy/paste. What is worse, the behaviour is a bit inconsistent. I have two almost identical installations on two different computers. On one of them I can do copy/paste almost always. (Sometimes Zope doesn't show Paste button). On the other computer Zope dosn't show Paste almost always. When I reboot Netscape, I can do copy/paste for some short time, and then Zope again stops showing Paste button. To trace the problem I've add cookie module to filtering proxy that I'm using (http://theory.stanford.edu/~amitp/proxy.html) and can see the whole cookie sent/received log. Nothing suspicious in th log - browser sends and receives __cp cookie (along with other cookies). Example: (I do copy:) |<--!-- Cookie Received __cp="x%da%d3%60b%60%60%c8%04b%86hF%20%a1%01%e2%16%83%b9,%20%16%07%03%1c0%21q%98%85%909%12%c8%9c%2a%00%c6%0e%04%87"; Path=/pcgi (I switched to different folder:) |--!--> Cookie Sent tree-s="eJyLjlZ3hANPW/XYWAAtiQTP"; __cp="x%da%d3%60b%60%60%c8%04b%86hF%20%a1%01%e2%16%83%b9,%20%16%07%03%1c0%21q%98%85%909%12%c8%9c%2a%00%c6%0e%04%87"; dtpref_cols="55"; dtpref_rows="15" Browser sends all cookies; but Zope doesn't allow Patse :( Details, if this can help: Server1: sun.med.ru; SPARC, Solaris 2.5.1; Zope 2.1.4 (2.1.3 had the problem, too) Server2: phd.russ.ru; Pentium, Debian GNU/Linux; Zope 2.1.4. Both servers have Zope with additional components: SQL adapters, SiteAccess, ZNavigator, etc. The problem manifests itself whether I use Netscape for Linux or for Solaris; whether I use proxies or swith to "no proxy - direct connection". Few of my freiends here reported the same problem with different hardware, OSes, browsers, etc. Oleg. (All opinions are mine and not of my employer) ---- Oleg Broytmann Foundation for Effective Policies phd(a)phd.russ.ru Programmers don't die, they just GOSUB without RETURN.

1 0

Zope must be restarted often
by Josh Glover 05 Jun '00

05 Jun '00

Here is the problem, and forgive me if this is a known issue and I just could not find it in the mailing list archive. I am running Zope 2.1.6 under FreeBSD 4-STABLE (May 15). I am running Apache 1.3.12 with mod_ssl/2.6.4 and OpenSSL/0.9.4. Also, I am running Python 1.5.2. What happens is: Zope just stops responding to a browser lookup. I try to browse to it, and Netscape just shows that the server has been contacted and it says "Waiting for reply..." until it times out. If I killall the Python processes and then run the Zope.sh start script, everything is fine again. I have been unable to tie the failure to a time or specific event as of yet. Any help would be appreciated. Thanks, Josh Glover

2 1

ping
by ethan mindlace fremen 05 Jun '00

05 Jun '00

ping

2 1

Zope and Python 1.6
by Ivan Raikov 05 Jun '00

05 Jun '00

Hi all, Does Zope run under Python 1.6? If not, is anybody working on a port? Thanks, Ivan Raikov

2 1

Zope/Apache/NT
by Paul Smith 05 Jun '00

05 Jun '00

Has anyone managed/bothered to get Zope working with Apache on NT yet? If they have, could you point me at any documentation? This is intended as a quick fix until I can get round to installing Linux on my machine.. Any help would be greatly appreciated! Thanks, Paul ------------------------------------------------------------- Paul Smith : paul.smith(a)bristol.ac.uk http://www.ilrt.bris.ac.uk/ Institute for Learning and Research Technology University of Bristol, BS8 1HH, UK Tel: 0117 928 7192 Fax: 0117 928 7112

3 3

Q: Link status/checking -
by Jørgen Skogstad 05 Jun '00

05 Jun '00

Kindest, I was wondering about a few points I havn't seen any references to. Are there any implementations in Zope that can verify the validity of an url? That is; 1) A link database is generated .. and should be maintained. 2) A process should be run at least once a week to check the validity of links in the database. 3) If the link is not "valid" .. it sets a tag in the db which says it's untrusted .. which again could show that in the link listed on the web through Zope. 4) .. and if it's untrusted for N runs .. it is removed. .. have anyone looked into that? .. and anyone made any conclusions as to how one can solve that? I am not that familiar with Python .. but I might be interested in generating such an engine.. based on Zope / mySql of some sorts. .. Perl support would really make me happy right now! Have a real nice day. Kindest, Jørgen Skogstad

4 4