Authorization problem with python module
Hi Everyone, I have a security problem with a python script in Zope (2.7.0). I try to import a not very common python module to use some of is method in my script. In the _init_.py of the product that use this module, I have checked if "allow_module" and "allow_class" is correctly set ans all seems to be ok. The problem is when I use one of the method of a class of that module in my script, a message box appear asking for my login and password and if I write my user name and password (manager) it doesn't work. I receive message like: you have not the authorization to access this method in that context... Someone have an idea of what I'm doing wrong? Is there a way to bypass this security check? Thanks a lot Etienne
--On Mittwoch, 2. Februar 2005 22:11 Uhr -0500 Etienne Desgagné <etienne.desgagne.1@ulaval.ca> wrote:
Hi Everyone,
I have a security problem with a python script in Zope (2.7.0). I try to import a not very common python module to use some of is method in my script.
In the _init_.py of the product that use this module, I have checked if "allow_module" and "allow_class" is correctly set ans all seems to be ok. The problem is when I use one of the method of a class of that module in my script, a message box appear asking for my login and password and if I write my user name and password (manager) it doesn't work.
allow_module() and allow_class() are *not* designed to work for all and everything! If this stuff does not work, use ExternalMethods, filesystem code or TrustedExecutables by DM. -aj
Am Mittwoch, den 02.02.2005, 22:11 -0500 schrieb Etienne Desgagné:
Hi Everyone,
I have a security problem with a python script in Zope (2.7.0). I try to import a not very common python module to use some of is method in my script.
In the _init_.py of the product that use this module, I have checked if
If its really named _init_.py instead of __init__.py it cant work. Your module would just be ignored.
"allow_module" and "allow_class" is correctly set ans all seems to be ok. The problem is when I use one of the method of a class of that module in my script, a message box appear asking for my login and password and if I write my user name and password (manager) it doesn't work.
If you do it right and it still does not work, I suggest you write small wrapper functions into your module and allow them (and their return values) to python scripts. Regards Tino
Etienne Desgagné wrote:
a message box appear asking for my login and password and if I write my user name and password (manager) it doesn't work.
I receive message like: you have not the authorization to access this method in that context...
Have you tried installing VerboseSecurity? It'll give you a clue as to exactly which farmyard animal's blood needs to be spilled... Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk
participants (4)
-
Andreas Jung -
Chris Withers -
Etienne Desgagné -
Tino Wildenhain