- Zope - Zope lists

[ZGotW] Issue #3 (Open)
by Zope Guru of the Week 03 Feb '00

03 Feb '00

A new issue of "Zope Guru of the Week" is available: =================================================================== Issue #3 -- Acquiring Permissions =================================================================== Status: Open Zen Level: Master (5/8) Keywords: Acquisition Security / Permissions Submitted by: Tres Seaver tseaver(a)palladion.com ------------------------------------------------------------------- When assembling a site using custom-defined ZClasses, I find that I often have to go back into the classes and assign Proxies to particular methods, giving them Manager rights, in order to allow anonymous users to browse the site or submit content. * Is this a security hole? (think setuid/setgid scrips in a Unix filesystem) * Should I be doing something else? - mapping permissions on my ZClasses? - creating special "default" users in an acl_users folder? - what else? ------------------------------------------------------------------- To reply and win undying glory and mondo guru points: http://zope.palladion.com/demos/ZGotW/3

1 0

[ZGotW] Issue #2 (Closed)
by Zope Guru of the Week 03 Feb '00

03 Feb '00

The current issue of "Zope Guru of the Week" has closed: =================================================================== Issue #2 -- How to Import a Static Web Site into Zope =================================================================== Status: Closed Zen Level: Novice (1/8) Keywords: Management Interface Submitted by: ithomas christmas(a)mail.sd70.bc.ca ------------------------------------------------------------------- How can one most easily (with the least typing) import an existing static website into Zope? The site contains: * image files * multiple HTML/JavaScript files including internal and external links After doing it by hand for a small site I decided there had to be better way. ------------------------------------------------------------------- Reviewed by: Tres Seaver tseaver(a)palladion.com ------------------------------------------------------------------- Summary I'm going to close this one out without a "perfect" answer. * K.S. Lee's "highly compressed" reply is essentially correct: the load_site.py script does a decent job of loading "static" content into a Zope server *from the local hard drive*. * The original question specifically called out issues with images and with JavaScript and external/internal links. Pam Crosby reports loading images successfully with load_site; Pam also notes difficulty with loading "compressed" files. Full points to both of them. Issues Unresolved * load_site uses a very limited heuristic to detect the type of the file being loaded: it uses the file extension to look up a handler function: - 'foo.jpg' loads as an image, as does 'foo.gif' - 'foo.jpeg' loads as a File object (ouch!) - 'foo.dtml' loads as a DTML Document - 'foo.html' gets loaded as a DTML Document with its headers/footers stripped, id and title properties created from the headers, and gets a text property added, 'loadsite-head', containing the original headers; Probably the simplest way to address to add command line parameters to load_site to allow the user to override the heuristic, something like:: python load_site -u zopemeister:zpass --image foo.jpeg --file bar.zip * I had difficulties trying to load images, but they could be due to pilot error and / or Netscape's stupid image caching. * load_site opens all files without passing the "mode" parameter, which could be gnarly on non-Unix platforms with binary files (this might explain my difficulties loading images, and Pam's with compressed files). -------------------------------------------------------------------

1 0

Again rc
by Tom Deprez 03 Feb '00

03 Feb '00

Hi all, Found the problem! I forgot to give the path to the pid file! Dumb, dumb, dumb! Regards, Tom

1 0

Logic-defying bug with LDAP method
by Dennis Moore 03 Feb '00

03 Feb '00

I've got an LDAP method called 'getuser' which simply returns all the information for a particular userid. This part seems to work ok. I am having a really weird problem with trying to use the information I get from it, though: <dtml-call "REQUEST.set('userid', 'someone')"> <dtml-in getuser> <dtml-call "REQUEST.set('foo', departmentnumber)"> </dtml-in> <dtml-if "foo == 'RU168'"> match! <dtml-else> foo .<dtml-var foo>. <p><dtml-var REQUEST> </dtml-if> This prints: foo .RU168. So foo is RU168, but the conditional still fails for some reason. Now, if I do virtually the same thing with an SQL method, it works fine (prints "match!"). I can get the results, print them, and compare them. The weird behavior only happens with the data from an LDAP method. I've tried with the conditional inside the dtml-in. I've tried comparing departmentnumber instead of foo. Always the same result. Printing <dtml-var departmentnumber> gives me RU168. Can anyone shed some light on this or offer some debugging hints? Thanks -- <BLINK> ;for (74,1970500640,1634627444,1751478816,1348825708,543711587, 1801810465){for($x=1<<1^1;$x>=1>>1;$x--) {$q=hex ff,$r=oct($x=~s,\d,$&* 10,e,$x),$x/=1/.1,$q<<=$r,$s.=chr (($_&$q)>>$r),$t++}}while($= ||= !$|) {$o=$o?$?:$/;$|=1;print $o?$s:$"x$t if$;;print"\b"x$t;sleep 1} </BLINK>

4 3

ZSQL Methods User's guide Error
by Joachim Schmitz 03 Feb '00

03 Feb '00

the example under "Database Methods Classes" class ComputerHardwareItem: def dollar_volume_backordered(self): return unit_price * backordered is not idended, but worse does not work, it must read like this: class ComputerHardwareItem: def dollar_volume_backordered(self): return self.unit_price * self.backordered It also should be mentioned, that the Extensions directory is the directory "Extensions" in the Zope-installationroot, with the same accessrights as the "var" directory. Mit freundlichen Grüßen Joachim Schmitz WWW-Consultant email: js(a)ac-copy.net tel: +49-241-89491-0 fax: +49-241-89491-29

1 0

Again rc
by Tom Deprez 03 Feb '00

03 Feb '00

Hi, I start Zope as daemon (-Z option) and now I've the following problem : http://localhost/Zope works (through Apache) but http://localhost:8080 doesn't work, it says that the server is down. While Zope is running (see with Apache) What am I doing wrong? Is there something I should know? Is there somewhere a port I've to activate in Linux? Thanks in advance! Regards, Tom.

1 0

Hotmail-like Zope Product?
by John Goerzen 03 Feb '00

03 Feb '00

Hi, I somehow recall reading of a Zope webmail product somewhere but couldn't find it on the website. Anyone have any tips on where it's hiding?

4 3

Re: CERT -- Malicious HTML Tags
by Squishdot 03 Feb '00

03 Feb '00

tres seaver <tseave-(a)palladion.com> wrote: > CERT has released a fairly dire advisory on the dangers of dynamic page > generation when coupled with untrusted content submission: > > http://www.cert.org/advisories/CA-2000-02.html > > Anyone care to comment on Zope's vunlerability here? For instance, the ZGotW > site allows submissions in structured text, plain text, and HTML -- but now I am > probably going to htmlquote() the last, which kills a lot of the point of it, > no? > > The key issue lies in embedding <SCRIPT>...</SCRIPT> chunks (or their immoral > equivalents, <OBJECT>, <EMBED>, and <APPLET>). Consider, for instance, those > nasty pop-up windows launched by some "free" webspace providers; then consider > what happens in Squishdot, ZGotW, or any other site which permits users to enter > arbitrary HTML as part of the feedback/collaboration process. Not a pretty Yes, I've been reading up on it as well. I'll be studying this issue as well WRT to Squishdot. I would probably need to add some validation to Squishdot to filter out these *malicious tags* -- if anyone in the Zope/Squishdot has ideas/code to fix this, please contact me ASAP. I've checked Squishdot so that all input fields are html-quoted, but the most vulnerable part seems to be the possible addition of javascript and other executable code -- If I build a validation mechanism that filters out <SCRIPT, <OBJECT, <APPLET and <EMBED html tags, would this solve the problem -- or is this only a partial solution? What other things would I need to filter out? I don't know about the Zope's cookie mechanism -- since we get the Cookie already as part of the namespace -- is this vulnerable too? Regards, Butch ===== Butch Landingin Squishdot maintainer http://squishdot.org squishdot(a)yahoo.com __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

3 3

Site access problem - inaccessible frpm admin screen
by chas 03 Feb '00

03 Feb '00

I'm adding virtual servers to Zope using siteaccess and the mod_proxy in Apache. I've set it up for one site and it works perfectly - thanks to Evan for a great product and to Anser for a superb How-to (http://www.zope.org/Members/anser/apache_zserver) However, creating a second folder with a SiteRoot is giving very strange problems. As soon as the SiteRoot is added, I can not access the folder within the management screens. Clicking on it causes Netscape's status bar to display "Host www.xxxx.com contacted. Waiting for reply...." repeatedly, flickering/twitching as if it's trying to do it repeatedly. I never succeeds. However, from the end user's perspective, the virtual host works perfectly - the site is accessible and the virtual server works. Has anybody else seen similar problems trying to access a folder with a SiteRoot in the admin interface ? This isn't a 'permission denied' problem ... I just don't get anything returned from the server. Thank you very much in advance, chas ps. configuration steps : 1. Set up apache's mod_proxy and create the proxy_pass directives for 2 domains : <VirtualHost xxx.xxx.xxx.xxx> ServerName www.domainA.com ProxyPass / http://xxx.xxx.xxx.xxx:8080/A/ ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/A/ </VirtualHost> <VirtualHost xxx.xxx.xxx.xxx> ServerName www.domainB.com ProxyPass / http://xxx.xxx.xxx.xxx:8080/B/ ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/B/ </VirtualHost> 2. create a folder : /A place a SiteRoot in /A base = http://www.domainA.com path = / Restart apache and this works fine. The site contained in the zope folder /A is viewable as www.domainA.com and it can be accessed via the administration interface. 3. create a folder : /B place a SiteRoot in /B base = http://www.domainB.com path = / After creating the SiteRoot, the folder /B is inaccessible via the admin screens though the virtual server IS acceseible from the web.

2 1

Re: [Zope] RE: zope/style sheets
by Sam Gendler 03 Feb '00

03 Feb '00

> > > That was my thought, set a cookie once on the browser and use that to > choose the style sheets and javascript files to load thereafter in > that session. > > But your jeremiad on cookies & cahes makes me wonder. Hobbling > people's squids for such a trivial matter seems inhospitable somehow. > Does Zope do anything special with cookies, like add a nocache tag to > headers on cookied pages? > What I tend to do is have the mystylesheet.css file actually be a dtml-method that can do the following. Check the cookie, decide the appropriate path Send a redirect to the client to a css file that DOES contain the correct data. This way, the html page gets cached, all html files can include the same stylesheet, and no caches get confused by caching the wrong object. It aso makes it very easy to add new options, etc. Alternatively, create a dtml method that contains just two lines. The first line would contain <dtml-call "RESPONSE.appendHeader('Cache-Control', 'proxy-revalidate')"> and the second line would contain the dtml code that includes the stylesheet based on the user agent. All pages that should contain the stylesheet code will then be served with a proxy-revalidate header. That header forces any network cache to send a if-modified-since request, which should cause things to work correctly. Some caches might not handle it well, but most should (the ones I have had my hands on do...) For industrial strength reliability, you could set cache-control: private, which allows the browser cache (a private cache) to store the object, while any public cache is not allowed to cache it. I would be VERY surprised if any caches didn't handle this correctly. Both of these solutions seem easy to implement and maintain to me. Let me know if you have any questions --sam -- Sam Gendler Chief Technology Officer - Impossible, Inc. 1222 State St. Suite 250 Santa Barbara CA. 93101 w: 805-560-0508 f: 805-560-0608 c: 805-689-1191 e: sgendler(a)impossible.com

1 0