- Zope - Zope lists

LoginManager, Cookies, etc.
by Andrew Hughes Chatham 12 May '00

12 May '00

I've been working on LoginManager plugins this week, and I thought things were going very well. They are not going quite as well as I thought. I need to authenticate people using kerberos. Right now my plan is to just see if kinit fails using expect and maybe write python-kerberos bindings later. As a result, authenticating people is quite expensive, or at least it will be once it works :) But it's not our kerberos setup, so we need to protect the passwords or we'll get in trouble. So we need to initially authorize the person over a secure connection and then give them a cookie to authenticate them later over insecure connections. The BasicCookieLogin plugin just stores the password in the cookie, which is not good for us, so I wrote a RandomCookieLogin which puts a random number in the cookie and changes it every time they reauthenticate (load a page). It's not perfect security, but it's better than nothing. It all seems to work fine on my local machine, but then I realized that I'm going to need to be doing a move between port 80 and 81 with the cookies, which might complicate things. So I started testing cookies when I changed Zope's port, and it wasn't good. Shouldn't cookies work on all ports of the same machine? That was my understanding from skimming the RFC (why are those things so long?!) But they do not. If I authenticate while Zope is on port 80, restart Zope on port 81, the cookie is not reused. Of course it's conceivable that restarting the server killed the cookies (they don't work when I restart it on 80). If someone will just say "It's ok, Andrew, cookies will still work on the real setup; we've moved them from 80 to 81 and back all the time" I would be very happy. Is this something people have dealt with successfully? On a related note, I have experienced other forms of weirdness using cookies in Zope. I put "raise 'CookieError'" into _cookie_list in HTTPResponse.py to see when it was getting called. The traceback generated has a line something like this: File "lib/python/ZPublisher/HTTPResponse.py", line 213, in __str__ headersl=headersl+self._cookie_list() which seems just fine, as that is the way it gets called. But that text is on line 723. Line 213 has absolutely nothing to do with cookies. This certainly seems like more a Python bug than a Zope bug, but it's confusing (may not even be a bug, though I have trouble seeing how this would not be one). Also... (sorry!) if I try to add a domain field to a cookie, netscape does not take the cookie (I have warn before accepting cookies, so I can tell what's going on). Lynx seems to take it, but I'm not too worried about supporting thte lynx market. The header information that Zope's generating seems to be well-formed, but Netscape won't make the cookie. Has anyone used the domain field on cookies successfully? Andrew

2 1

Ann: ZWiki Web 0.1 Released
by Chris Withers 12 May '00

12 May '00

This is my first attempt at bundling up Simon's excellent ZWiki product with all its methods in such a way that you can create a whole WikiWeb folder by selecting a ZWikiWeb from the "Available Objects" dropdown. It's available from: http://www.zope.org/Members/chrisw/ZWikiWeb ZWiki can be found at: http://www.zope.org/Members/simon/ZWiki cheers, Chris

1 0

dynamically defined size attribute in a dtml-var tag?
by josh on 12 May '00

12 May '00

Hi, is it possible to have a dynamically defined size attribute in a dtml-var tag? <dtml-var position size=_.int(_['leng']) etc=""> <dtml-var position size=leng etc=""> zope keeps telling me my size attribute is a string this is in a sql_method than you josh oN

3 3

dtml-sendmail, dtml-boundary
by Christopher J. Kucera 12 May '00

12 May '00

Greetings! We're using the dtml-sendmail tag to send attachments. The filename that gets sent is basically unknown until the file is about to get sent off. Actually sending the file isn't a problem, but having the correct filename appear in the received email is hanging us up. There's a "name" argument to the dtml-boundary tag, but it doesn't seem to be able to parse any variables. Is there some easy way to hack MIMETag.py to make the dtml-boundary tag actually parse the arguments as python? ie: <dtml-boundary type="'application/blahblah'" name="REQUEST['filename']"> We'd also use it to make sure that the correct MIME type gets sent. Thanks! -CJ

2 2

wanted: RPM for dual install of Zope & Python
by tommy_b＠my-deja.com 12 May '00

12 May '00

I admit, I'm an utter Linux newbie! For some reason, I can't get the Zope 2.1.6 RPM to find my Python installation. Perhaps I didn't install Python correctly the 1st time, since there is no RPM for it anymore. So, I figure I'll pay $15 for what I'm guessing is 30-60 minutes of work. Full request at: http://www.cosource.com/cgi-bin/cos.pl/wish/info/323 --== Sent via Deja.com http://www.deja.com/ ==-- Before you buy.

3 3

fmt in DTML vars- or, grouping Documents
by dillera＠isc.upenn.edu 12 May '00

12 May '00

Hi: I'm trying to create a DTML Document that displays a bunch of DTML Methods or Documents which contain HTML. When I view the 'master' page I see the raw HTML. I know it must be something with the fmt= , but I can't find it. Here is what I have: ------------------------- <h2>Section 1: Applications</h2> <dtml-var "apps.draft_1_dave" fmt="html"> <hr> <h2>Section 2: Network Access Devices</h2> <dtml-var "nad.draft_1_acd" fmt=html> ------------ what do I need to set fmt to so that the master Document reders the sub-methods/documents not as raw html, but as html text? when I set fmt to something, that is the text I see!! -andy diller

3 2

does this exist: rating/survey system?
by Jerry Spicklemire 12 May '00

12 May '00

Shane Renee Landrum wrote: >I want a generic rating/survey/comment system for a series of >websites I'm building. They all need to have similar features for >rating different kinds of things (books, movies, restaurants, >doctors...) Take a look at the contributed (BSD license) Survey Product, from Zope.org http://www.zope.org/Members/sleeper/PMPSurvey Hope it helps, Jerry S.

1 0

Simple way to alter sort ASC / DESC?
by Andy McKay 12 May '00

12 May '00

Hi, I have a <dtml-in ... sort=date> which gives the lowest date first. Is there a simple way to reverse this and get the sort in highest date first? Or do I have to get a little more complicated? Thanks in advance.

2 1

scary security questions
by Paul Abrams 12 May '00

12 May '00

We are putting our site up and have some questions about Zope security relating to one of Zope's biggest benefits...remote administration. If some kid obtained access to the manage screens he could...well you know :( 1) What prevents someone from getting into the manage screens by cracking the admin username:password? Are failed login attempts logged anywhere? If not, is there any way to log them short of hacking the zope python code? 2) Is there any way to turn off the manage screens, or set them so that they can only be run locally? 5 er...3) Is there any way to run the manage screens on a different port than the rest of Zope? (i.e. not port 80) This would allow us to open/close that port in our firewall whenever we needed to access the manage screens remotely, or run it over a VPN. What are other people doing to protect themselves? Thanks in advance, -Paul __________________________________________________ Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. http://im.yahoo.com/

5 5

Re: [Zope] scary security questions
by Dieter Maurer 12 May '00

12 May '00

Paul Abrams writes: > 2) Is there any way to turn off the manage screens, or set > them so that they can only be run locally? You can add a "domain" restriction to your "access" file. Then the admin can only connect from this domain. A domain can be a single host (given by hostname or internet address) or a real domain. - Dieter

1 0