[Zope] Scripts run as least privileged user necessary?

Chris Withers chrisw at nipltd.com
Fri Sep 5 14:47:02 EDT 2003


Ken Causey wrote:
>>Indeed, but that's a nigh-on impossible task given the way HTTP and HTML work 
>>together...
> 
> I don't understand why.  In the past I have made such checks in DTML and
> ZPT pages and it seemed to work fine.  Is it not a common task to have a
> page that has different behaviour based on the roles of the user?

HTTP is stateless. It has no notion of whether or not the request for an image 
is within a page or not. Yeah, you can set a session variable or some other sort 
of cookie, but if your image is anonymously viewable, that may well not help you.

>>Hmmm, why do you care so much about these images being hijacked?
> 
> Because past experience has told me it will happen.  The most common
> occurrence is that eBay users will use my pictures and bandwidth rather
> than go to the trouble of making and hosting their own.  This will be
> exacerbated by the fact that I plan myself to post items on eBay as a
> source of promotion.  I really don't care to have to contact eBay all
> the time to complain about this or have to scan logs for the
> possibility.  There are better ways to spend my time.  So my preference
> is to find a technological solution.

*shrugs* Well, I guess you could write an alternative security policy for Zope, 
but you probably don't want to be doing that...

The only thign I can think of is to drop a view short lived cookie when you 
render your page and check for that when you decide whether or not to show the 
image.

Chris




More information about the Zope mailing list