Hi, A simple question, but getting a bit irritating... How can I change the roles assigned to a user without knowing their password? The form to do this has password fields which come up blank, and you can't submit the form without filling them in. I don't want to know what the user's password is anyway, I just want to change the assigned roles... ;-) HSCH, Chris PS: Zope 2.1.4 and 2.1.6...
Chris, this was discussed on the list back in early February, but I don't think there every was a solution. (http://www.egroups.com/group/zope/22675.html) I would go ahead and put this into the collector (as I didn't get a chance to before) Adam On 23-Mar-2000 Chris Withers wrote:
Hi, How can I change the roles assigned to a user without knowing their password?
-- M. Adam Kendall | mak@kha0s.org | "There's never enough time to do http://kha0s.org | all the nothing you want." | --Bill Watterson (Calvin and Hobbes)
Okay, I've put this into the collector now (hence my complaints about the collector ;-) I've got a proposal: How about leaving the form as is, but if the password fields are blank, then don't change the user's password? I might have a look at coding this later today. If I do, how do I get it into the CVS or back to DC in some other way that it'll make it into the next Zope point release? cheers, Chris "M. Adam Kendall" wrote:
Chris, this was discussed on the list back in early February, but I don't think there every was a solution. (http://www.egroups.com/group/zope/22675.html) I would go ahead and put this into the collector (as I didn't get a chance to before)
Adam
On 23-Mar-2000 Chris Withers wrote:
Hi, How can I change the roles assigned to a user without knowing their password?
-- M. Adam Kendall | mak@kha0s.org | "There's never enough time to do http://kha0s.org | all the nothing you want." | --Bill Watterson (Calvin and Hobbes)
Chris Withers wrote:
Okay, I've put this into the collector now (hence my complaints about the collector ;-)
I've got a proposal:
How about leaving the form as is, but if the password fields are blank, then don't change the user's password?
This is a possible fix.
I might have a look at coding this later today.
If I do, how do I get it into the CVS or back to DC in some other way that it'll make it into the next Zope point release?
Post the patch to the collector (there is a 'with patch' option). -Michel
Your question addresses a fundamental lack in Zope. Zope was developed internally in a closed source fasion for years to address the needs of paying customers. These customers typically did not design applications themselves, we did all of that. Therefore, much of Zope's API is fairly oriented toward specific directions and there are big gaping holes. Don't let that discourage, you, there are big gaping holes in all software. We are working on a project right now to come up with a solid undertanding of interfaces in Zope. While this may seem like a simple task, it is not, but we are working on it and we are making progress. Here, you have come upon a hole, there is a method that lets you do a number of things in one call but there are no decomposed methods that let you do finer grained tasks. This kind of situation is common, not just in Zope, but in lots of software where extensability is very important. Unfortunatly, this is a gnarly problem. For example, if we decompose manage_users() into a number of smaller methods, it would make sense for us to re-implement manage_users() to use those methods. But this involves not only writing a bunch of new methods but also taking solid proven code and discarding it for new code, based on even _newer_ code. This problem becomes almost nauseatingly dificult when you consider that we could turn this process to all objects in Zope, Folders, ObjectManagers, ZCatalogs... And while it may seem clear there should be so and so methods to decompose to, we need to make sure we think hard about issues like, should they be callable via XML-RPC? Will this new method reveal a security exploit? etc... I don't want to take the wind out of your sails, perhaps you could suggest some improvments, all the code is there. For now we are taking small steps, document what is there, propose a framework for sensible extension, and then fill in some of the gaps, and tear down some of the cruft. I will make a note of your question for when we get to security. -Michel
Hi,
A simple question, but getting a bit irritating...
How can I change the roles assigned to a user without knowing their password?
The form to do this has password fields which come up blank, and you can't submit the form without filling them in.
I don't want to know what the user's password is anyway, I just want to change the assigned roles... ;-)
HSCH,
Chris
PS: Zope 2.1.4 and 2.1.6...
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
I totally agree, don't worry... no wind taken out of any sails ;-) After all, Zope is free and there are plenty of (very) expensive alternatives that will have just the same sort of problems. Hope I can help at some stage :-) Chris Michel Pelletier wrote:
Your question addresses a fundamental lack in Zope. Zope was developed internally in a closed source fasion for years to address the needs of paying customers. These customers typically did not design applications themselves, we did all of that. Therefore, much of Zope's API is fairly oriented toward specific directions and there are big gaping holes.
Don't let that discourage, you, there are big gaping holes in all software. We are working on a project right now to come up with a solid undertanding of interfaces in Zope. While this may seem like a simple task, it is not, but we are working on it and we are making progress. Here, you have come upon a hole, there is a method that lets you do a number of things in one call but there are no decomposed methods that let you do finer grained tasks. This kind of situation is common, not just in Zope, but in lots of software where extensability is very important.
Unfortunatly, this is a gnarly problem. For example, if we decompose manage_users() into a number of smaller methods, it would make sense for us to re-implement manage_users() to use those methods. But this involves not only writing a bunch of new methods but also taking solid proven code and discarding it for new code, based on even _newer_ code. This problem becomes almost nauseatingly dificult when you consider that we could turn this process to all objects in Zope, Folders, ObjectManagers, ZCatalogs... And while it may seem clear there should be so and so methods to decompose to, we need to make sure we think hard about issues like, should they be callable via XML-RPC? Will this new method reveal a security exploit? etc...
I don't want to take the wind out of your sails, perhaps you could suggest some improvments, all the code is there. For now we are taking small steps, document what is there, propose a framework for sensible extension, and then fill in some of the gaps, and tear down some of the cruft. I will make a note of your question for when we get to security.
-Michel
Hi,
A simple question, but getting a bit irritating...
How can I change the roles assigned to a user without knowing their password?
The form to do this has password fields which come up blank, and you can't submit the form without filling them in.
I don't want to know what the user's password is anyway, I just want to change the assigned roles... ;-)
HSCH,
Chris
PS: Zope 2.1.4 and 2.1.6...
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
Hey all, I ran into this problem awhile ago. My solution was a bit of a hack and has obvious security concerns but here it is: <dtml-call "REQUEST.set('name', login_name)"> <dtml-call "REQUEST.set('password', GetPassword(acl_users.getUser(login_name)))"> <dtml-call "REQUEST.set('confirm', password)"> <dtml-call "REQUEST.set('roles', roles)"> <dtml-call "acl_users.manage_users(submit='Change', REQUEST=REQUEST)"> Code for GetPassword(): return login_name._getPassword()
On Thu, 23 Mar 2000, Daniel G. Rusch wrote:
Code for GetPassword(): return login_name._getPassword()
Isn't here a security hole? Could anyone sniff passwords on WWW? Oleg. ---- Oleg Broytmann Foundation for Effective Policies phd@phd.russ.ru Programmers don't die, they just GOSUB without RETURN.
participants (5)
-
Chris Withers -
Daniel G. Rusch -
M. Adam Kendall -
Michel Pelletier -
Oleg Broytmann