date:20120425

[Dspace-tech] Creating md5 sums for external links and lighttpd

2012-04-25 Thread Evelthon Prodromou

Goodmorning everyone,


I am investigating the possibility of using lighttpd's secdownload
module to use expiring links. I'd like to use those in metadata, so that
a link will be valid if viewed within a dspace record, yet inaccessible
if hard linked directly. Just to be clear, these files are not hosted by
dspace.

At first i tried implementing lighttpd's instructions in item-view.xsl,
but creating and md5 sum seems to be next to impossible.

Lighttpd offers ready to use source codes for many languages, including
java, at
http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs:ModSecDownload#Examples.
If i was to use that, where should i add that piece of code and how
should i call it to have the generated hash value in item-view.xsl ?


Many thanks,


Evelthon.
attachment: prodromou_evelthon.vcf--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

Re: [Dspace-tech] OAI question

2012-04-25 Thread Robert Ruiz


Hi,

the real question is:

how to configure the sets that are served to the outside via OAI-PMH. By 
default ?verb=ListSets lists all the sets and that's what we don't want.


Thanks in advance,
Robert


El 19/04/2012 16:46, revskill escribió:
I'm sorry, i really don't understand what harvested items are , 
what're their role ? And what we can do with oai-pmh ?


Thank you for attention.

2012/4/19 Alexandre Magaz Graça alexandre.ma...@udl.cat 
mailto:alexandre.ma...@udl.cat


On dc 18 abr 2012 13:09:00 CEST, helix84 wrote:
 Would this help?

 https://wiki.duraspace.org/display/DSPACE/DSpaceOAISets

 Regards,
 ~~helix84

Hi helix84,

I already thought of most the options in this page when I started
looking at the problem. Still not sure of which is worse...

Thanks,
Àlex


--
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
mailto:DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech




--
TRUONG HOANG DUNG*
*/*Librarian **Researcher
*//Information and Library Centre
Mobile: 0121.411.5322
Email: _dun...@hpu.edu.vn mailto:dun...@hpu.edu.vn_/
_/Hai Phong Private University/_ http://lib.hpu.vn


--
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2


___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech


--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

Re: [Dspace-tech] Creating md5 sums for external links and lighttpd

2012-04-25 Thread helix84

On Wed, Apr 25, 2012 at 07:54, Evelthon Prodromou
prodromou.evelt...@ucy.ac.cy wrote:
 If i was to use that, where should i add that piece of code and how
 should i call it to have the generated hash value in item-view.xsl ?

Hi Evelthon,

actually there already is an MD5 checksum calculated for each
bitstream. It's easy to construct the URL in XSL - in your stylesheet
override the xsl:template match=mets:file from item-view.xsl.
You'll need to add the
xmlns:util=org.dspace.app.xmlui.utils.XSLUtils
xmlns:exdate=http://exslt.org/dates-and-times;
attributes to the stylesheet tag
and util and exdate to its exclude-result-prefixes attribute.

To construct the URL, use these values down in a href:
xsl:value-of select=@CHECKSUM/
xsl:value-of select=exdate:date-time()/

That's the easy part - displaying the link. Now to actually make that
link work, you have to change
dspace-xmlui/dspace-xmlui-webapp/src/main/webapp/sitemap.xmap
starting from
map:match pattern=bitstream/handle/*/*/**
to include the new parameters - checksum and timestamp.

Then you have to make use of those parameters in
[dspace-src]/dspace-xmlui/dspace-xmlui-api/src/main/java/org/dspace/app/xmlui/cocoon/BitstreamReader.java

That should be enough to point you in the right direction.

Anyway, I'm wondering what's the reason you want to do this?

Regards,
~~helix84

--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

Re: [Dspace-tech] Creating md5 sums for external links and lighttpd

2012-04-25 Thread Evelthon Prodromou

Hi Helix,

Thanks for the reply. I will look into it.

I'm working with lighttpd to host large video files. It seems to be
working but i still have to make some more checks. My problem is that
the url pointing to the file is viewable in the source code leading to
the possibility of a third party linkining to the file. By using the
secdownload module, links expire after a certain amount of time, thus
discouraging direct linking.

Evelthon

On 04/25/2012 11:14 AM, helix84 wrote:
On Wed, Apr 25, 2012 at 07:54, Evelthon Prodromou
prodromou.evelt...@ucy.ac.cy wrote:
If i was to use that, where should i add that piece of code and how
should i call it to have the generated hash value in item-view.xsl ?
Hi Evelthon,

actually there already is an MD5 checksum calculated for each
bitstream. It's easy to construct the URL in XSL - in your stylesheet
override the xsl:template match=mets:file from item-view.xsl.
You'll need to add the
xmlns:util=org.dspace.app.xmlui.utils.XSLUtils
xmlns:exdate=http://exslt.org/dates-and-times;
attributes to the stylesheet tag
and util and exdate to its exclude-result-prefixes attribute.

To construct the URL, use these values down in a href:
xsl:value-of select=@CHECKSUM/
xsl:value-of select=exdate:date-time()/

That's the easy part - displaying the link. Now to actually make that
link work, you have to change
dspace-xmlui/dspace-xmlui-webapp/src/main/webapp/sitemap.xmap
starting from
map:match pattern=bitstream/handle/*/*/**
to include the new parameters - checksum and timestamp.

Then you have to make use of those parameters in
[dspace-src]/dspace-xmlui/dspace-xmlui-api/src/main/java/org/dspace/app/xmlui/cocoon/BitstreamReader.java

That should be enough to point you in the right direction.

Anyway, I'm wondering what's the reason you want to do this?

Regards,
~~helix84

--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

Re: [Dspace-tech] Creating md5 sums for external links and lighttpd

2012-04-25 Thread helix84

On Wed, Apr 25, 2012 at 10:37, Evelthon Prodromou
prodromou.evelt...@ucy.ac.cy wrote:
 I'm working with lighttpd to host large video files. It seems to be
 working but i still have to make some more checks. My problem is that
 the url pointing to the file is viewable in the source code leading to
 the possibility of a third party linkining to the file. By using the
 secdownload module, links expire after a certain amount of time, thus
 discouraging direct linking.

You might want to prefer solving that on the file server side by
checking HTTP referer instead of on the DSpace side.

If you insist on doing that in DSpace, you can store the
pre-calculated checksum of externally hosted files in metadata and
only calculate the timestamp on page display.

Regards,
~~helix84

--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

Re: [Dspace-tech] Creating md5 sums for external links and lighttpd

2012-04-25 Thread Evelthon Prodromou

I don't think the generated bitstream checksum can be used in this
case.  The sum needed in lighttpd's case is the md5 sum of a
concatenated string. The string is made up of a secret pass, the file
name with a forward slash in front, and a time string that was
previously converted to it's hex value.

On the other hand i don't think one can trust the HTTP referer since it
can be manipulated.

Evelthon




On 04/25/2012 11:41 AM, helix84 wrote:
 On Wed, Apr 25, 2012 at 10:37, Evelthon Prodromou
 prodromou.evelt...@ucy.ac.cy wrote:
 I'm working with lighttpd to host large video files. It seems to be
 working but i still have to make some more checks. My problem is that
 the url pointing to the file is viewable in the source code leading to
 the possibility of a third party linkining to the file. By using the
 secdownload module, links expire after a certain amount of time, thus
 discouraging direct linking.
 You might want to prefer solving that on the file server side by
 checking HTTP referer instead of on the DSpace side.

 If you insist on doing that in DSpace, you can store the
 pre-calculated checksum of externally hosted files in metadata and
 only calculate the timestamp on page display.

 Regards,
 ~~helix84


--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

Re: [Dspace-tech] Creating md5 sums for external links and lighttpd

2012-04-25 Thread helix84

On Wed, Apr 25, 2012 at 12:20, Evelthon Prodromou
prodromou.evelt...@ucy.ac.cy wrote:
 I don't think the generated bitstream checksum can be used in this
 case.  The sum needed in lighttpd's case is the md5 sum of a
 concatenated string. The string is made up of a secret pass, the file
 name with a forward slash in front, and a time string that was
 previously converted to it's hex value.

OK, I didn't know that. In that case, the approach I described won't
work. You'd have to calculate the checksum in Java in an aspect and
insert it into the DRI (the XML document processed by XSLT).
You might be able to find an XSLT implementation of the MD5 algorithm,
but I'd really avoid that. Also keep in mind that DSpace currently
uses XSLT 1.0, not 2.0.

 On the other hand i don't think one can trust the HTTP referer since it
 can be manipulated.

That's correct, although it must be done consciously by the client,
there's no way of another site publishing a link that forces a client
to use a different referer. I thought you only wanted to reduce load
on your servers, not catch every single access.

Regards,
~~helix84

--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech

36 matches

Mail list logo