- Zope - Zope lists

Zope 2.7.0 beta 4 Release and Security Update
by Brian Lloyd 10 Jan '04

10 Jan '04

Zope 2.7.0 beta 4 Release and Security Update Zope 2.7.0 beta 4 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.7.0b4 from Zope.org: http://www.zope.org/Products/Zope/2.7.0b4/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.7.0b4 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.7.0b4 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.7.0b4 in the near future. Also note that there are binary code changes in the 2.7.0b4 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.7.0b4/CHANGES.txt - http://www.zope.org/Products/Zope/2.7.0b4/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

1 0

Is ZEO my friend...
by Gilles Lenfant 10 Jan '04

10 Jan '04

Hi zopistas, Here's the future problem... A web app records "todo" tasks into a queue. The queue will be a folderish, the "todo" task will be file like objects with properties saying what to do with. Then a background process will read that queue in a loop, remove "todo" tasks 1 per one, the oldest first and start processing accordingly. What about using a ZEO client app for this kind of console python app ? As ZODB is transactional, ther should not be read/write conflicts on objects ? If I'm in the good direction, are there some examples or tutorials using that specific architecture ? Thanks in advance. -- Gilles

2 1

MSIE 6 not opening MIME attachments
by Jim Kutter 10 Jan '04

10 Jan '04

I'm trying to send a CSV via a python script. My problem is in IE 6, if the user clicks on "Open" instead of save from the dialog that appears, Excel will launch, but not find the file in the Temporary Internet Files folder. Clicking on "Save" then opening the file manually works just fine. Is this a problem with my response headers or an IE bug? Here are the headers I'm sending: response.setHeader('Content-Type', 'text/csv') response.setHeader('Content-Length', len(printed)) response.setHeader('Content-Disposition', 'attachment; filename=%s' % filename) return printed

2 1

Adding a ZPT when adding product instance
by Lee Harr 09 Jan '04

09 Jan '04

I use something like this to add a DTML Method inside of my folderish product: # Add default interface index_html = HTMLFile('dtml/index_html', globals()) text = index_html.read_raw() ob.manage_addDTMLMethod(id='index_html', title='') idx = ob.index_html idx.manage_edit(text, title='') the source for the index_html file is in the dtml folder in my product, and is called index_html.dtml Is this the correct Zope idiom? How can I do something similar for ZPT? _________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

2 1

Re: Getting started
by Josef Meile 09 Jan '04

09 Jan '04

> My initial requirement is to be able to install a simple app. > > Photo appears to be the simple sort of app which would be suitable. > > I've downloaded it and extracted it to Zope's Products directory and I can > see the Photo product under the Control Panel and a picture has been > uploaded. What URL do I use to view it as a normal user outside of the > ZMI? locally you can: http://localhost:8080/path/to/your/photo.gif or on a network: http://yourserver.yourdomain.com:8080/path/to/your/photo.gif or http://your_ip_address:8080/path/to/your/photo.gif Regards, Josef

1 0

RE: survey: zope 2.7 syntax errors with TAL statments overmultiple lines
by Gerry Kirk 09 Jan '04

09 Jan '04

> upon further inspection, it seems that the problem is related > to improperly escaped tab characters (and, I'm guessing, > CR/LF, etc). At least in my case, I'm sure it has something > to do with the fact that I run Zope on linux, but edit files > in a combination of browser textboxes on both Windows and > Linux, as well as via external editor (again, on multiple > platforms). > > I'm not sure that it's anything more than a coincidence that > we're seeing this all of a sudden with Zope 2.7. Are you > using Plone as well? > -- > larry j.c. prikockis <larry_prikockis(a)natureserve.org> NatureServe > All I know is the day I switched to 2.7 from 2.6.2, I *immediately* ran into these problems. The exact same code ran fine in 2.6.2. However the stuff is being escaped / formatted, it seems to be handled differently in the two. Maybe 2.7 is more strict and correct, I dunno. Gerry

2 1

Problems with ZCatalog method
by Jason Randell 09 Jan '04

09 Jan '04

I am a relatively new zope user so you'll have to excuse me. I am trying to write a python script that will automatically recatalog my Zcatalog. Unfortunately I keep getting an error that I can't get past. Here is a code snippet with some minor changes to protect the innocent: request = container.REQUEST RESPONSE = request.RESPONSE url1 = 'http://localhost:4444/myCatalog' url2 = 'http://localhost:4444/' obj_metatypes=['Page Template'] obj_expr='not noindex' obj_ids='None' obj_searchterm='None' obj_mtime='None' obj_mspec='None' obj_roles='None' obj_permission='None' monkey=[obj_metatypes, obj_ids, obj_searchterm, obj_expr, obj_mtime, obj_mspec, obj_roles, obj_permission] container.GALEN_Catalog.manage_catalogClear() container.GALEN_Catalog.manage_catalogFoundItems(request, RESPONSE, url2, url1, monkey) # I have also just tried obj_metatypes=['Page Template'], obj_expr='not noindex' instead of the monkey list I get an indexError: List index out of range. Here is the traceback: Traceback (innermost last): Module ZPublisher.Publish, line 98, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 39, in call_object Module Shared.DC.Scripts.Bindings, line 252, in __call__ Module Shared.DC.Scripts.Bindings, line 283, in _bindAndExec Module Products.PythonScripts.PythonScript, line 315, in _exec Module Script (Python), line 22, in cron_test.py - <PythonScript at /cron_test.py> - Line 22 Module Products.ZCatalog.ZCatalog, line 306, in manage_catalogFoundItems IndexError: list index out of range line 306 in ZCatalog is: obj = REQUEST.PARENTS[1] This is where I get stuck. Here is more software/platform info: Zope Version (Zope 2.6.1 (source release, python 2.1, linux2), python 2.1.3, sunos5) Python Version 2.1.3 (#1, Jul 12 2002, 11:06:12) [GCC 2.95.2 19991024 (release)] System Platform sunos5 Any help on this would be appreciated. Cheers, Jason Randell

2 1

Zope 2.6.3 linux binary needs GLIBC 2.3?
by Fred Yankowski 09 Jan '04

09 Jan '04

I just tried the Zope 2.6.3 binary on a Debian Woody system, and it fails to start: ImportError: /lib/libc.so.6: version `GLIBC_2.3' not found (required by /usr/local/Zope-2.6.3-linux2-x86/lib/python/AccessControl/cAccessControl.so) Zope 2.6.2 was happy with the version 2.2.5 of glibc that is standard in Woody. Any suggestions on how to proceed? I suppose I can build Zope 2.6.3 from source. Is there an easy and safe way to install glibc 2.3 on Woody? I haven't found such so far. -- Fred Yankowski fred(a)ontosys.com tel: +1.630.879.1312 OntoSys, Inc PGP keyID: 7B449345 fax: +1.630.879.1370 www.ontosys.com 38W242 Deerpath Rd, Batavia, IL 60510-9461, USA

2 1

Re: survey: zope 2.7 syntax errors with TAL statments over multiple lines
by Gerry Kirk 09 Jan '04

09 Jan '04

> I'm experiencing the same sort of problem as you - e.g., these lines > (which happen to be from the epoz_toolbox.pt): > > <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" > tal:define="charset here/portal_properties/site_properties/default_charset; dummy python:request.RESPONSE.setHeader('Content-Type', 'text/html;;charset=%s' % charset)" > tal:attributes="content string:text/html;;charset=${charset}" /> > > produced an error before I moved the 2 tal:define clauses up onto one > line. > > very weird > I was able to fix the problem by creating a new file, copy/pasting the contents of the original file into the new file, and saving it under the same name. I'm running everything in Linux. - Gerry

3 2

Getting started
by John Poltorak 09 Jan '04

09 Jan '04

I have just installed Zope and don't really know much about it but people tell me it's a great product. Are there any recommended apps which I should try to get a flavour of whit it can do? I'm not sure if I'm on the right list for newbie type questions. If not please redirect me to a more appropriate list. -- John

3 5