Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread Sascha Welter
(Wed, Feb 08, 2006 at 12:00:07PM -0500) [EMAIL PROTECTED] wrote/schrieb/egrapse: > From: michael nt milne <[EMAIL PROTECTED]> > Subject: [Zope] major problems placing authentication on an extranet > site-security flaw? > I have major problems here trying to set-up authentication over a whole

Re: [Zope] Startup error with Formulator

2006-02-09 Thread Martijn Faassen
Dennis Allison wrote: Zope 2.8.4 Python 2.4.2 Startup error with Formulator. What's missing or broken? The offending file is: http://namespaces.zope.org/zope"; xmlns:i18n="http://namespaces.zope.org/i18n"; > From the INSTALL.txt file: Five 1.2 is needed to make i18

Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread Chris Withers
michael nt milne wrote: Look I'm having genuine issues here and to be honest there's no need to become personally insulting. And what do you think you're doing by continuously coming back with phantom problems that no-one else experiences because they don't exist? And how about your insiste

Re: [Zope] ExtFile - wrong file extension and content_type

2006-02-09 Thread Stefan H. Holek
Two things to check - Does your /etc/mime.types file on the server contain the correct entry for msword? - Do your clients (browsers) reliably sent the msword content-type? Stefan On 7. Feb 2006, at 19:16, Palermo, Tom wrote: All, I am working on a project using ExtFile. Lately, when upl

Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread michael nt milne
Sorry but the SSL and virtual hosting through Apache is all working fine. It's only the authentication bit that I'm having an issue with. Should be easy compared to what I've configured previously. And isn't it Plone? :-) On 2/9/06, Chris Withers <[EMAIL PROTECTED]> wrote: michael nt milne wrote:>

Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread Chris Withers
michael nt milne wrote: Sorry but the SSL and virtual hosting through Apache is all working fine. It's only the authentication bit that I'm having an issue with. Should be easy compared to what I've configured previously. Yeahright, that gives some idea of the lack of understanding you have...

Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread michael nt milne
Over and out on this one from me and thanks for all your help Sorry but SSL over virtual hosts *is* more involved that setting up a basic password protectOn 2/9/06, Chris Withers <[EMAIL PROTECTED]> wrote: michael nt milne wrote:> Sorry but the SSL and virtual hosting through Apache is all wor

Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread Chris Withers
michael nt milne wrote: Over and out on this one from me You promise? ;-) Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk ___ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/li

Re: [Zope] Re: htaccess with zope/plone ?

2006-02-09 Thread Chris Withers
michael nt milne wrote: Sorry but can't you post in one message? That, coming from you, is pretty rich ;-) Also, Zope does do SSL but it's not as good as Apache. No, Zope doesn't. There are some half baked addons that sort of promise to do something like SSL, but I'd trust them as far as

Re: [Zope] major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread Robert Boyd
On 2/9/06, michael nt milne <[EMAIL PROTECTED]> wrote: > Over and out on this one from me and thanks for all your help Sorry but > SSL over virtual hosts *is* more involved that setting up a basic password > protect > My 2 cents on this thread: I've seen (ok, I've done, long ago) the following

[Zope] Using ParsedXML from Python script

2006-02-09 Thread Brian Sullivan
I am attempting to extract information from a ParsedXML object using Python script. I can't seem to get my mind around exactly how this works. Can anyone point non trivial examples in Python of maniupulating a ParsedXML object? ___ Zope maillist - Zope

Re: [Zope] Startup error with Formulator

2006-02-09 Thread Dennis Allison
Thanks. On Thu, 9 Feb 2006, Martijn Faassen wrote: > Dennis Allison wrote: > > Zope 2.8.4 > > Python 2.4.2 > > > > Startup error with Formulator. What's missing or broken? > > > The offending file is: > > > > > xmlns="http://namespaces.zope.org/zope"; > > xmlns:i18n="http://names

Re: [Zope] Re: htaccess with zope/plone ?

2006-02-09 Thread michael nt milne
glad you've taken that on board :-) Over and out from me on this one as well. By the way using theĀ  directive is the way to password protect using Apache on non directory based virtual hosts. It works using the URL line rather than directory access. Just so you know. And that wasn't even sourced f

Re: [Zope] Re: htaccess with zope/plone ?

2006-02-09 Thread Tino Wildenhain
michael nt milne schrieb: glad you've taken that on board :-) Over and out from me on this one as well. By the way using the directive is the way to password protect using Apache on non directory based virtual hosts. It works using the URL line rather than directory access. Just so you know. An

Re: [Zope] Re: htaccess with zope/plone ?

2006-02-09 Thread Robert Boyd
On 2/7/06, michael nt milne <[EMAIL PROTECTED]> wrote: > Also Zope doesn't do SSL well and all password - login is > basically insecure! If you mean that logins without SSL are basically insecure, ok. But given your other posts, if you mean that Zope authentication is somehow inherently insecure (

[Zope] missing add version in Zope

2006-02-09 Thread Luca Dall'Olio
I have been looking (almost) everywhere, but I can't find the "Version" line in the main combo box (the one for adding products). This means that I cannot start working in a Version. I can't find the "Add Version" line in the security tab, either. In Control Panel I can see the Version Management

Re: [Zope] missing add version in Zope

2006-02-09 Thread Andreas Pakulat
On 09.02.06 18:38:57, Luca Dall'Olio wrote: > I have been looking (almost) everywhere, but I can't find the "Version" line > in > the main combo box (the one for adding products). > This means that I cannot start working in a Version. > I can't find the "Add Version" line in the security tab, eit

Re: [Zope] proxy roles on Product methods

2006-02-09 Thread Dieter Maurer
Chris Withers wrote at 2006-2-8 23:04 +: > ... >If the code is in a disk-based class method, security won't be coming >into play. Unless you call something with internal security checks (such as e.g. "_verifyObjectPaste" during "manage_paste"). -- Dieter

Re: [Zope] Session Variables Redux

2006-02-09 Thread Dieter Maurer
Dennis Allison wrote at 2006-2-8 11:16 -0800: > >The problem we see is a sudden disappearance of all, one, or a small >number of session variables. You already reported this and I replied that it is virtually impossible to lose part of the session variables: The session container is a uni

[Zope] Small Spam Vulnerability in Squishdot

2006-02-09 Thread Chris Withers
Garikoitz Araolaza <[EMAIL PROTECTED]> has discovered a vulnerability in Squishdot that can result in a Squishdot Site being used to send spam. Full discussion and a fix can be found here: http://www.squishdot.org/1139510883 cheers, Chris -- Simplistix - Content Management, Zope & Python Con

Re: [Zope] Re: htaccess with zope/plone ?

2006-02-09 Thread michael nt milne
Thanks for the help. I got some good Apache advice on the Plone list vis avis What I'd like to do is have Apache and Zope (roles, workflow) for extrasecurity over SSL. I'll re-visit the authentication issue with the help I've received. On 2/9/06, michael nt milne <[EMAIL PROTECTED]> wrote: Thanks f

Re: [Zope] Applying updates to zope site

2006-02-09 Thread Brian Sullivan
On 1/10/06, Gabriel Genellina <[EMAIL PROTECTED]> wrote: > At Monday 9/1/2006 12:15, Brian Sullivan wrote: > > >I am involved in maintaining a remote Zope site that is behind a > >firewall where I have no remote access. > > > >I have a (parallel) site that I use to test changes and upgrades that >

[Zope] Transfer Data to New Zope Server

2006-02-09 Thread Peter Evans
I am Zope newbie so please bear with me. As a part of my job I just inherited control of an extremely old Zope server running on FreeBSD. I would like to move to a new instance of Zope runninf on Windows Server 2003. So basically I need help transferring all the data from the old box to the new one

[Zope] Re: major problems placing authentication on an extranet site-security flaw?

2006-02-09 Thread Norbert Marrale
Chris Withers wrote: michael nt milne wrote: Over and out on this one from me You promise? ;-) Chris I think Tino made the key suggestion earlier on: log out of the ZMI, close your browser, restart it, clear the cache, clear any saved passwords, try to view the page in question and - if

[Zope] Re: Transfer Data to New Zope Server

2006-02-09 Thread Tres Seaver
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Peter Evans wrote: > I am Zope newbie so please bear with me. As a part of my job I just > inherited control of an extremely old Zope server running on FreeBSD. I > would like to move to a new instance of Zope runninf on Windows Server 2003. > So basic

[Zope] Zope and roles and hierarchy

2006-02-09 Thread David
Hello Zope, Is it true that even though a user Role like 'author' is defined at zope root that users defined lower in the hierarchy *also* with role 'author' cannot access objects at root with role 'author' and permissions of view and access? The online zope book seems to say so. If so,

[Zope] Strange problem with WebDAV and Zope

2006-02-09 Thread Ivan \"Rambius\" Ivanov
Hello, I am observing a strange problem when trying to use MKCOL WebDAV method with a specific url. I can reproduce it with two WebDAV clients: Jakarta Slides[1] and the command-line client nd[2]. The problem: Invoking MKCOL method against Zope's WebDAV server with an url ending with "title" fai

Re: [Zope] Strange problem with WebDAV and Zope

2006-02-09 Thread David
Ivan "Rambius" Ivanov wrote: Hello, I am observing a strange problem when trying to use MKCOL WebDAV method with a specific url. I can reproduce it with two WebDAV clients: Jakarta Slides[1] and the command-line client nd[2]. The problem: Invoking MKCOL method against Zope's WebDAV server wi

Re: [Zope] Zope and roles and hierarchy

2006-02-09 Thread Andreas Jung
--On 9. Februar 2006 19:44:37 -0800 David <[EMAIL PROTECTED]> wrote: Hello Zope, Is it true that even though a user Role like 'author' is defined at zope root that users defined lower in the hierarchy *also* with role 'author' cannot access objects at root with role 'author' and permissions