- Zope - Zope lists

RE: [Zope] IE5 form entry horror.
by Michel Pelletier 12 May '99

12 May '99

> -----Original Message----- > From: Anthony Baxter [mailto:anthony@interlink.com.au] > Sent: Wednesday, May 12, 1999 3:48 AM > To: zope(a)zope.org > Subject: [Zope] IE5 form entry horror. > > > one of the customer service people here just pointed out something of > a horror problem (a week before go-live, yay). > > IE5 appears to have a client-side cache of form entry values - so if > someone returns to a page, they get a drop-box of previously entered > values for this form field - this occurs even on a form > accessed by https. > To say that I'm somewhat unimpressed by this utter misfeature > is something > of an understatement. Imagine a kiosk setup, with a > registration screen > prompting for (amongst other things) a credit card number. Gee, let's > use one someone entered earlier - pull down a little scrolly box. oooooooooo. > > aiieieieie. One thought that comes to mind is to make the form field > name be a name with a random bit on the end. (Another thought > that came > to mind was to do a drive-by on the local MS office.) Anyway, > the reason > for the zope-post is that I'm thinking of hacking the field > name converting > so that you can do fieldname:type:end:anything and just finish looking > for the type name after it hits the 'end' tag. > > This is a 3 line patch to ZPublisher/HTTPRequest.py - would it offend > anyone if it was added? > Not unless you're offending yourself. You can patch ZPublisher anyway you want, the question is if it will get into the official product. This will require much thought on our part, on the one hand it solves your specific problem and possible solves problems for lots of other people using that browser, on the other hand, it would be a step of obfuscation. Perhaps it could be made a modular solution? Go ahead and send the patch to the list, I'd be curious to look at it. -Michel > Anthony > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

IE5 form entry horror.
by Anthony Baxter 12 May '99

12 May '99

one of the customer service people here just pointed out something of a horror problem (a week before go-live, yay). IE5 appears to have a client-side cache of form entry values - so if someone returns to a page, they get a drop-box of previously entered values for this form field - this occurs even on a form accessed by https. To say that I'm somewhat unimpressed by this utter misfeature is something of an understatement. Imagine a kiosk setup, with a registration screen prompting for (amongst other things) a credit card number. Gee, let's use one someone entered earlier - pull down a little scrolly box. aiieieieie. One thought that comes to mind is to make the form field name be a name with a random bit on the end. (Another thought that came to mind was to do a drive-by on the local MS office.) Anyway, the reason for the zope-post is that I'm thinking of hacking the field name converting so that you can do fieldname:type:end:anything and just finish looking for the type name after it hits the 'end' tag. This is a 3 line patch to ZPublisher/HTTPRequest.py - would it offend anyone if it was added? Anthony

3 3

Object references
by Robert Leftwich 12 May '99

12 May '99

What is the Zope way of holding references to objects in another object. Using the following ordering entry system as an example : Catalog contains zero or more CatalogItems CatalogItems are structured as CatalogItemNo, Description, UnitPrice, ... Order contains OrderNo, OrderDate, zero or more OrderItems, ... OrderItems are structured as CatalogItem, Quantity, ... What should the link between OrderItems and CatalogItems be ? In relational databases you would store the CatalogItemNo and in object databases a CatalogItem object reference. Given that I am using the Zope object database, how do I store a reference to a Zope CatalogItem object ? If it is possible to store the object reference, this gives rise to another question, how do you maintain the referential integrity of such a system, e.g. what do you do if someone deletes a CatalogItem that is used by some orders ? Thanks in advance Robert Leftwich

1 0

RE: [Zope] Security glitch on user-editing form
by Rob Page 11 May '99

11 May '99

> Great; I'm sorry I wasn't aware of this. No prob... "I just work here" and am unaware of a lot of things in Zope. :^) > Question: Do you need a module for NT authentication, or are > you writing > this already? (In case you need contributions.) That _must_ be a rhetorical question! Of course, we'd __**LOVE**__ a contributed NTUserFolder! When can we have it? -- only half-kidding! Tks, --Rob

1 0

RE: [Zope] Security glitch on user-editing form
by Alexander Staubo 11 May '99

11 May '99

Great; I'm sorry I wasn't aware of this. Question: Do you need a module for NT authentication, or are you writing this already? (In case you need contributions.) Alexander Staubo http://www.mop.no/~alex/ mailto:redhand@mop.no >-----Original Message----- >From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of Rob >Page >Sent: 11. mai 1999 22:54 >To: 'Alexander Staubo' >Cc: 'zope(a)zope.org' >Subject: RE: [Zope] Security glitch on user-editing form > > >> Any one-way encryption method will work, but why not modularized >> authentication support? Something that would permit you to >> use anything > >Already there in user folders! :^) We happen to have implemented an >internal Zope authentication/authorization database. Additionally, at: > >http://www.zope.org/Download/Unsupported > >there's an etcUserFolder (auth against /etc/passwd type files) and a >UserDB (auth against an RDBMS) and sometime soon there might be an >LDAPUserFolder based on something that smells a lot like an LDAP >Database Adapter. > >> from one-way-encryption to Kerberos to LDAP, but not >> necessarily just a >> fixed algorithm. LDAP is an interesting possibility, but I >don't like >> the idea of being stapled to LDAP -- it's overkill for most >> installations. > >I agree totally! My _real_ question was, in the internal User Folder >component, whether to store passwords a) in their original form or b) >as a hash or c) as a selectable option ... Of course, the c) is >probably the best answer! > >--Rob > >_______________________________________________ >Zope maillist - Zope(a)zope.org >http://www.zope.org/mailman/listinfo/zope > >(For developer-specific issues, use the companion list, >zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] Security glitch on user-editing form
by Rob Page 11 May '99

11 May '99

> Any one-way encryption method will work, but why not modularized > authentication support? Something that would permit you to > use anything Already there in user folders! :^) We happen to have implemented an internal Zope authentication/authorization database. Additionally, at: http://www.zope.org/Download/Unsupported there's an etcUserFolder (auth against /etc/passwd type files) and a UserDB (auth against an RDBMS) and sometime soon there might be an LDAPUserFolder based on something that smells a lot like an LDAP Database Adapter. > from one-way-encryption to Kerberos to LDAP, but not > necessarily just a > fixed algorithm. LDAP is an interesting possibility, but I don't like > the idea of being stapled to LDAP -- it's overkill for most > installations. I agree totally! My _real_ question was, in the internal User Folder component, whether to store passwords a) in their original form or b) as a hash or c) as a selectable option ... Of course, the c) is probably the best answer! --Rob

1 0

RE: [Zope] Security glitch on user-editing form
by Phillip J. Eby 11 May '99

11 May '99

At 03:59 PM 5/11/99 -0400, Rob Page wrote: > >As an example of our Open Source business model a current customer is >rather interested in LDAP and has asked us to develop some Zope >integration for it. LDAP stores the _hash_ of users' passwords (e.g., >crypt, MD5, SHA). Our LDAP effort will be very sensitive to this >approach. > >What are people's thoughts on storing password hashes instead of the >plaintext password? Of course, it would become impossible to offer the >"You Forgot Your Password For the Fifteenth Time" email messages... Actually, it's not impossible, so long as you change their password, generate a new one, and send it in the message... :) Seriously, storing hashes is much more secure than plaintext, IMHO. If you have a hash, all you get is the ability to test for possible passwords much faster. Granted, this does nothing about the transmission of the plaintext password to Zope in the first place... Where LDAP is concerned, I suggest a multi-leveled approach. First, encrypt the password stored on the LDAP server. Second, grant absolutely no-one the rights to *read* the password value, and only grant *compare* rights to the application server's login, perhaps restricting the IP/domain as well. Rather than using the LDAP bind operation to check the password, bind as an application server login and keep the connection open. Use the compare operation on the encrypted password attribute, so that you are not retransmitting the user's password in the clear. Now a hacker has to do a fair amount just to get to the point where they can start even *guessing* passwords... and they still have to try one password at a time against a single user, unless they can break into the LDAP server's underlying DB.

1 0

RE: [Zope] Security glitch on user-editing form
by Alexander Staubo 11 May '99

11 May '99

Any one-way encryption method will work, but why not modularized authentication support? Something that would permit you to use anything from one-way-encryption to Kerberos to LDAP, but not necessarily just a fixed algorithm. LDAP is an interesting possibility, but I don't like the idea of being stapled to LDAP -- it's overkill for most installations. Alexander Staubo http://www.mop.no/~alex/ mailto:redhand@mop.no >-----Original Message----- >From: Rob Page [mailto:rob.page@digicool.com] >Sent: 11. mai 1999 22:10 >To: 'Alexander Staubo' >Cc: 'zope(a)zope.org' >Subject: RE: [Zope] Security glitch on user-editing form > > >> I just found that Zope presents the user-editing form (manage_users) >> with the password in plaintext. That's a bit crude. >> > >As an example of our Open Source business model a current customer is >rather interested in LDAP and has asked us to develop some Zope >integration for it. LDAP stores the _hash_ of users' passwords (e.g., >crypt, MD5, SHA). Our LDAP effort will be very sensitive to this >approach. > >What are people's thoughts on storing password hashes instead of the >plaintext password? Of course, it would become impossible to offer the >"You Forgot Your Password For the Fifteenth Time" email messages... > >Idea? Comments? > >--Rob >

1 0

Z Classes Question
by Jeff K.Hoffman 11 May '99

11 May '99

Hello Zopesters, I am working on a project using 1.11pre and Z Classes, and have run into an interesting situation. First, let me tell you what I am trying to do. I need to create a structure like this: + class - index_html - document_a - document_b + instance - document_a Which is navigated to via http://mysite/instance. Why? Because the 'instance' folder might be seven levels deep, and I never want the user to know about its parents. Its context is always going to be the same (/class1/class2/classN/instance). So, I thought, why not use a Z Class? I made a 'class' Z Class which inherits from 'Object Manager' and defines 'index_html', 'document_a', and 'document_b'. So far so good. Now, what I want to be able to do is to create an instance of my Z Class, 'instance' and place a DTML Method inside it called 'document_a' which overrides the 'document_a' member of the Z Class. In this way, I could navigate to my site via http://mysite/instance/document_a and I would get the new, overloaded 'document_a', while navigating to http://mysite/instance/document_b would give me the 'document_b' inherited from the Z Class. This way, if I want a new instance of 'class', I can just drop it in place and be done with it. If, however, my new instance requires 'document_b' be slightly different than it was defined in 'class', I want to be able to easily customize it via the Zope Management interface. Now, however, when I try to drop a 'document_a' DTML Method in 'instance', I get a "Bad Request" error. I'm thinking Zope is not allowing me to create 'document_a' because 'document_a' is already there as part of the class. Is what I'm trying to do possible? If I didn't explain clearly enough, let me know and I'll try to clarify. :) Thanks, --jkh ____________________________________________________________________ Get free e-mail and a permanent address at http://www.netaddress.com/?N=1

2 1

RE: [Zope] Security glitch on user-editing form
by Rob Page 11 May '99

11 May '99

> I just found that Zope presents the user-editing form (manage_users) > with the password in plaintext. That's a bit crude. > As an example of our Open Source business model a current customer is rather interested in LDAP and has asked us to develop some Zope integration for it. LDAP stores the _hash_ of users' passwords (e.g., crypt, MD5, SHA). Our LDAP effort will be very sensitive to this approach. What are people's thoughts on storing password hashes instead of the plaintext password? Of course, it would become impossible to offer the "You Forgot Your Password For the Fifteenth Time" email messages... Idea? Comments? --Rob

1 0