[Zope] Re: Query about Localfs on Mac Os X 10.4.8

2006-10-16 Thread Tres Seaver
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Nandan Deshpande wrote:
> Hi Jonathan,
> 
> 
> Thanks for the response..
> 
> 1) My zope installation is :
> /Users/nandan/Zope-2.9.4-final/zope_server/lib/python/Products
> 
> So I have put the unzipped "Localfs"  in the Products folder...
> But after restarting zope server ..I cannot SEE "Localfs" in the ADD dropdown 
> (in "manage) like the other products.
> 
> 2)
> Using darwin ports
> I used the command :
> 
> sudo port install zope-localfs
> It says now:
> --->  Cleaning zope-localfs
> 
> But again No localfs found on the system by locate command OR in the 
> Zope/manage !!
> 
> Thanks,
> 
> Nandan
> I think I used localfs 1.0 if that gives  any clue!!
> 
> Jonathan <[EMAIL PROTECTED]> wrote:   What do you mean by "nothing seems 
> to work"?  (that's just a wee bit vague!)
>   
>  Error messages... a traceback... anything  a little more specific would help 
> us help you!
>   
>   
>  Jonathan
>   
>   
>   
> - Original Message - 
>From:Nandan Deshpande 
>To: zope@zope.org 
>Sent: Monday, October 16, 2006 7:26PM
>Subject: [Zope] Query about Localfs onMac Os X 10.4.8
>
> 
> Hi all,
> 
> I have a small query.
> I am running Zopeserver 2.9.4 on my Mac Os X 10.4.8
> 
> I have tried installing Localfs(version 1.0 etc) on this by two way
> Our traditional approach : Unzippingthe Localfs download and putting it 
> into Products directory and 
> Using
> http://zope-localfs.darwinports.com/
> 
> 
> Butnothing seems to work..
> 
> Can any one guide me in this.. Appreciateit,

The producdt is not importing correctly, which causes it to be omitted
silently in "production" mode.  Start Zope in "debug" mode (e.g.,
'bin/zopectl fg'), and report the error which you see on the console.

At a guess, check the comment at the bottom of:

 http://www.zope.org/Members/aeg/LocalFS_1_3_andreas



Tres.
- --
===
Tres Seaver  +1 202-558-7113  [EMAIL PROTECTED]
Palladion Software   "Excellence by Design"http://palladion.com
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFNC3d+gerLs4ltQ4RAnAUAJ9/Ng0HTBDf0a5RFHUgnMYYiy5zcwCg0GKv
3xrp3ZEnP9kPg+PGacZ3yZo=
=vXI2
-END PGP SIGNATURE-

___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


Re: [Zope] Query about Localfs on Mac Os X 10.4.8

2006-10-16 Thread Nandan Deshpande
Hi Jonathan,Thanks for the response..1) My zope installation is :/Users/nandan/Zope-2.9.4-final/zope_server/lib/python/ProductsSo I have put the unzipped "Localfs"  in the Products folder...But after restarting zope server ..I cannot SEE "Localfs" in the ADD dropdown (in "manage) like the other products.2)Using darwin portsI used the command :sudo port install zope-localfsIt says now:--->  Cleaning zope-localfsBut again No localfs found on the system by locate command OR in the Zope/manage !!Thanks,NandanI think I used localfs 1.0 if that gives  any clue!!Jonathan <[EMAIL PROTECTED]> wrote:   What do you mean by "nothing seems to work"?  (that's just a wee bit vague!)   Error messages... a traceback... anything  a little more specific would help us help you!     Jonathan      - Original Message -From:Nandan DeshpandeTo: zope@zope.orgSent: Monday, October 16, 2006 7:26PM   Subject: [Zope] Query about Localfs onMac Os X 10.4.8   Hi all,I have a small query.I am running Zopeserver 2.9.4 on my Mac Os X 10.4.8I have tried installing Localfs(version 1.0 etc) on this by two wayOur traditional approach : Unzippingthe Localfs download and putting it into Products directory and Usinghttp://zope-localfs.darwinports.com/Butnothing seems to work..Can any one guide me in this.. Appreciateit,Nandan Find out what India is talking about on - Yahoo!Answers India Send FREE SMS to your friend's mobile from Yahoo!Messenger Version 8. Getit NOW  ___Zope maillist - Zope@zope.orghttp://mail.zope.org/mailman/listinfo/zope**  No cross posts or HTML encoding!  **(Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev) 
	

	
		 
Find out what India is talking about on  - Yahoo! Answers India  
Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


Re: [Zope] Query about Localfs on Mac Os X 10.4.8

2006-10-16 Thread Jonathan



What do you mean by "nothing seems to work"? 
(that's just a wee bit vague!)
 
Error messages... a traceback... anything 
a little more specific would help us help you!
 
 
Jonathan
 
 
 

  - Original Message - 
  From: 
  Nandan Deshpande 
  To: zope@zope.org 
  Sent: Monday, October 16, 2006 7:26 
  PM
  Subject: [Zope] Query about Localfs on 
  Mac Os X 10.4.8
  Hi all,I have a small query.I am running Zope 
  server 2.9.4 on my Mac Os X 10.4.8I have tried installing Localfs 
  (version 1.0 etc) on this by two wayOur traditional approach : Unzipping 
  the Localfs download and putting it into Products directory and Using 
  http://zope-localfs.darwinports.com/But 
  nothing seems to work..Can any one guide me in this.. Appreciate 
  it,Nandan
  
  
  Find out what India is talking about on - Yahoo! 
  Answers India Send FREE SMS to your friend's mobile from Yahoo! 
  Messenger Version 8. Get 
  it NOW
  
  

  ___Zope maillist  
  -  
  Zope@zope.orghttp://mail.zope.org/mailman/listinfo/zope**   
  No cross posts or HTML encoding!  **(Related lists - 
   http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev 
  )
___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


[Zope] Query about Localfs on Mac Os X 10.4.8

2006-10-16 Thread Nandan Deshpande
Hi all,I have a small query.I am running Zope server 2.9.4 on my Mac Os X 10.4.8I have tried installing Localfs (version 1.0 etc) on this by two wayOur traditional approach : Unzipping the Localfs download and putting it into Products directory and Using http://zope-localfs.darwinports.com/But nothing seems to work..Can any one guide me in this.. Appreciate it,Nandan 
	

	
		 
Find out what India is talking about on  - Yahoo! Answers India  
Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


Re: [Zope] Re: zope fork in external method - mysql connection dropped

2006-10-16 Thread Chris McDonough
You might also try running zope under runzope instead of under  
zopectl.  IIRC zopectl itself sets signal handlers and performs a  
fork before starting zope, so the inherited environment may not be  
what you think it is.


- C

On Oct 16, 2006, at 4:31 PM, Daniel Lopez wrote:



I made one tweak to the double-fork procedure, adding a waitpid  
call in the grandparent process (the original zope thread) before  
it returns out of the external method... the code then looked  
something like:


[...prefork code up to here...]
pid1 = os.fork()
if pid1 > 0:
   #grandparent waits for its child before returning
   os.waitpid(pid1, 0)
   return RESPONSE.redirect("wait_page")
pid2 = os.fork()
os.setsid()
if pid2 > 0:
   #child quits, orphaning grandchild
   sys.exit(0)
[...grandchild-only code after here...]

The waitpid call seems to be preventing the zombies... this is  
good! (though if you find something bad about this approach, please  
do speak up)


But in the process, a new bug was created, having to do with the  
MySQL connection.  I now receive a "Lost connection to MySQL server  
during query" error in what appears to be a final db flush from the  
grandparent's publish function (ZPublisher.Publish, line 104).  The  
good news is that the grandchild continues to do it's work, but the  
bad news is that the user receives an error page instead of the  
redirect to the "wait_page".


My guess is that this has something to do with the various forked  
processes sharing the MySQL connection, and in particular, I'm  
guessing the child process that exit(0)'s is closing the  
connection, which is then unavailable when the grandparent tries to  
use it.


Here's the interesting part: if I put a sleep(1) line in between  
the waitpid() line and the return line, I get no error.  It would  
appear that the 1 second pause provides enough time for a new MySQL  
connection to be made after the previous one is killed (less than 1  
second is not enough).


This is a very ugly fix, though... I can't guarantee that 1 second  
will always be enough... can anyone suggest a cleaner solution?   
Perhaps I shouldn't kill the child with sys.exit(0)?


-Daniel



On Fri, 13 Oct 2006, Jonathan wrote:

Pls keep your posts on the list  - so that others can help and so  
that others can search for problems/solutions!

- Original Message -
Sent: Friday, October 13, 2006 12:13 PM
Subject: zope fork in external method

Jonathan-
I'm emailing you because I saw your post a few months back at:
http://mail.zope.org/pipermail/zope/2006-May/166574.html
I've been doing my best to find answers on existing posts, but to  
no avail. Perhaps you can send further pointers?
On my system, a user can hit a page that initiates a long  
database query. If the user hits the stop button and tries to  
refresh, it messes things up (by interrupting the code upon  
return of the query), so I came up with a solution that almost  
works:
I put all the code into an external method, which forks.  The  
parent returns a redirect to a "waiting" throbber page that uses  
Ajax to poll whether the query is done.  The child then goes on  
to do the hard work.
This is working as desired, with a single exception: zombie child  
processes. Where can I learn more about forking processes in zope  
external methods? I've read about the double-fork method, but  
that hasn't resolved the problem...

A few ideas for reaping dead child processes:
1) implement a SIGCHLD handler
2) when a spawned child process is finished its 'zope processing'  
have it write its process id to a file (be careful when accessing  
files, you will need locking to eliminate problems that may be  
caused by zope's multiple threads) and then have a clean up  
routine which kills all of the processes listed in the file (this  
could be an independant clean-up routine which wakes up on a  
regular basis, or it could be built into the 'spawning' process  
which does the clean up before it spawns a child).
3) as the last thing it does, have the child process issue a kill  
-9 system command to kill its own process (I haven't tried this  
myself, but it may work and it would be simple to implement)

Good luck!
Jonathan


___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope-dev )



___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce

http://mail.zope.org/mailman/listinfo/zope-dev )


[Zope] Re: zope fork in external method - mysql connection dropped

2006-10-16 Thread Tres Seaver
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Daniel Lopez wrote:
> 
> I made one tweak to the double-fork procedure, adding a waitpid call in
> the grandparent process (the original zope thread) before it returns out
> of the external method... the code then looked something like:
> 
> [...prefork code up to here...]
> pid1 = os.fork()
> if pid1 > 0:
>#grandparent waits for its child before returning
>os.waitpid(pid1, 0)
>return RESPONSE.redirect("wait_page")
> pid2 = os.fork()
> os.setsid()
> if pid2 > 0:
>#child quits, orphaning grandchild
>sys.exit(0)
> [...grandchild-only code after here...]
> 
> The waitpid call seems to be preventing the zombies... this is good!
> (though if you find something bad about this approach, please do speak up)
> 
> But in the process, a new bug was created, having to do with the MySQL
> connection.  I now receive a "Lost connection to MySQL server during
> query" error in what appears to be a final db flush from the
> grandparent's publish function (ZPublisher.Publish, line 104).  The good
> news is that the grandchild continues to do it's work, but the bad news
> is that the user receives an error page instead of the redirect to the
> "wait_page".
> 
> My guess is that this has something to do with the various forked
> processes sharing the MySQL connection, and in particular, I'm guessing
> the child process that exit(0)'s is closing the connection, which is
> then unavailable when the grandparent tries to use it.
> 
> Here's the interesting part: if I put a sleep(1) line in between the
> waitpid() line and the return line, I get no error.  It would appear
> that the 1 second pause provides enough time for a new MySQL connection
> to be made after the previous one is killed (less than 1 second is not
> enough).
> 
> This is a very ugly fix, though... I can't guarantee that 1 second will
> always be enough... can anyone suggest a cleaner solution?  Perhaps I
> shouldn't kill the child with sys.exit(0)?
> 
> -Daniel
> 
> 
> 
> On Fri, 13 Oct 2006, Jonathan wrote:
> 
>> Pls keep your posts on the list  - so that others can help and so that
>> others can search for problems/solutions!
>>
>> - Original Message -
>> Sent: Friday, October 13, 2006 12:13 PM
>> Subject: zope fork in external method
>>
>>
>>>
>>> Jonathan-
>>>
>>> I'm emailing you because I saw your post a few months back at:
>>>
>>> http://mail.zope.org/pipermail/zope/2006-May/166574.html
>>>
>>> I've been doing my best to find answers on existing posts, but to no
>>> avail. Perhaps you can send further pointers?
>>>
>>> On my system, a user can hit a page that initiates a long database
>>> query. If the user hits the stop button and tries to refresh, it
>>> messes things up (by interrupting the code upon return of the query),
>>> so I came up with a solution that almost works:
>>>
>>> I put all the code into an external method, which forks.  The parent
>>> returns a redirect to a "waiting" throbber page that uses Ajax to
>>> poll whether the query is done.  The child then goes on to do the
>>> hard work.
>>>
>>> This is working as desired, with a single exception: zombie child
>>> processes. Where can I learn more about forking processes in zope
>>> external methods? I've read about the double-fork method, but that
>>> hasn't resolved the problem...
>>
>> A few ideas for reaping dead child processes:
>>
>> 1) implement a SIGCHLD handler
>>
>> 2) when a spawned child process is finished its 'zope processing' have
>> it write its process id to a file (be careful when accessing files,
>> you will need locking to eliminate problems that may be caused by
>> zope's multiple threads) and then have a clean up routine which kills
>> all of the processes listed in the file (this could be an independant
>> clean-up routine which wakes up on a regular basis, or it could be
>> built into the 'spawning' process which does the clean up before it
>> spawns a child).
>>
>> 3) as the last thing it does, have the child process issue a kill -9
>> system command to kill its own process (I haven't tried this myself,
>> but it may work and it would be simple to implement)

I'd recommend using the 'subprocess' module for such stuff.


Tres.
- --
===
Tres Seaver  +1 202-558-7113  [EMAIL PROTECTED]
Palladion Software   "Excellence by Design"http://palladion.com
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFM/sM+gerLs4ltQ4RArk4AJ9BjRO44YwZYPu2Mc4wo2PVEN504gCbBIw8
ja7CChvp288LUobko5cZHqY=
=izB3
-END PGP SIGNATURE-

___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


[Zope] Re: zope fork in external method - mysql connection dropped

2006-10-16 Thread Daniel Lopez


I made one tweak to the double-fork procedure, adding a waitpid call in the 
grandparent process (the original zope thread) before it returns out of the 
external method... the code then looked something like:


[...prefork code up to here...]
pid1 = os.fork()
if pid1 > 0:
   #grandparent waits for its child before returning
   os.waitpid(pid1, 0)
   return RESPONSE.redirect("wait_page")
pid2 = os.fork()
os.setsid()
if pid2 > 0:
   #child quits, orphaning grandchild
   sys.exit(0)
[...grandchild-only code after here...]

The waitpid call seems to be preventing the zombies... this is good! 
(though if you find something bad about this approach, please do speak up)


But in the process, a new bug was created, having to do with the MySQL 
connection.  I now receive a "Lost connection to MySQL server during 
query" error in what appears to be a final db flush from the grandparent's 
publish function (ZPublisher.Publish, line 104).  The good news is that 
the grandchild continues to do it's work, but the bad news is that the 
user receives an error page instead of the redirect to the "wait_page".


My guess is that this has something to do with the various forked 
processes sharing the MySQL connection, and in particular, I'm guessing 
the child process that exit(0)'s is closing the connection, which is then 
unavailable when the grandparent tries to use it.


Here's the interesting part: if I put a sleep(1) line in between the 
waitpid() line and the return line, I get no error.  It would appear that 
the 1 second pause provides enough time for a new MySQL connection to be 
made after the previous one is killed (less than 1 second is not enough).


This is a very ugly fix, though... I can't guarantee that 1 second will 
always be enough... can anyone suggest a cleaner solution?  Perhaps I 
shouldn't kill the child with sys.exit(0)?


-Daniel



On Fri, 13 Oct 2006, Jonathan wrote:

Pls keep your posts on the list  - so that others can help and so that others 
can search for problems/solutions!


- Original Message -
Sent: Friday, October 13, 2006 12:13 PM
Subject: zope fork in external method




Jonathan-

I'm emailing you because I saw your post a few months back at:

http://mail.zope.org/pipermail/zope/2006-May/166574.html

I've been doing my best to find answers on existing posts, but to no avail. 
Perhaps you can send further pointers?


On my system, a user can hit a page that initiates a long database query. If 
the user hits the stop button and tries to refresh, it messes things up (by 
interrupting the code upon return of the query), so I came up with a 
solution that almost works:


I put all the code into an external method, which forks.  The parent returns 
a redirect to a "waiting" throbber page that uses Ajax to poll whether the 
query is done.  The child then goes on to do the hard work.


This is working as desired, with a single exception: zombie child processes. 
Where can I learn more about forking processes in zope external methods? 
I've read about the double-fork method, but that hasn't resolved the 
problem...


A few ideas for reaping dead child processes:

1) implement a SIGCHLD handler

2) when a spawned child process is finished its 'zope processing' have it 
write its process id to a file (be careful when accessing files, you will 
need locking to eliminate problems that may be caused by zope's multiple 
threads) and then have a clean up routine which kills all of the processes 
listed in the file (this could be an independant clean-up routine which wakes 
up on a regular basis, or it could be built into the 'spawning' process which 
does the clean up before it spawns a child).


3) as the last thing it does, have the child process issue a kill -9 system 
command to kill its own process (I haven't tried this myself, but it may work 
and it would be simple to implement)


Good luck!

Jonathan




___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce

http://mail.zope.org/mailman/listinfo/zope-dev )


[Zope] Re: PAS and md5 or crypt passwords

2006-10-16 Thread Tres Seaver
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Robert (Jamie) Munro wrote:
> Piotr Furman wrote:
>>> I've edited GMailAuthPlugin, renamed it MD5AuthPlugin, added that code
>>> and removed the google specific code. It doesn't give any errors, but it
>>> also doesn't let me log in. I've tried adding a line to log things, but
>>> that doesn't seem to be working either.
>>>
>> Maybe You should take a look at SQLPASPlugin -
>> http://plone.org/products/sqlpasplugin - there are some SHA encryption
>> possibilities, however they are commented by default.
>> So You would have to modify it's code little bit.
> 
> That's what I was using before. I had no idea that it supported SHA, or
> that it was so easy to add MD5. That has solved my problem - Thanks
> 
> It's a pretty silly implementation, though. The point of hashing
> passwords with MD5 or SHA1 is that if an attacker can read the password
> files due to some kind of security leak, he still doesn't have the
> passwords themselves, so he still can't login. Unfortunately, the way it
> is implemented in SQLPASPlugin, the fact that he doesn't have the
> password doesn't matter because if you put the hash itself in the
> password field, you are allowed into the site.
> 
> It doesn't matter too much for my application, but it's something that
> should probably be fixed.

The problem is actually that SQLPASPlugin is schizoid about whether or
not to use encrypted passwrods (see the 'updateUserPassword' method for
more weirdness).  The plugin should probably have a boolean property,
'encrypt_passwords', which would control the behavior of
'authenticateCredentials' and 'updateUserPassword'.

I've added an issue to the collector for SQLPasPlugin:

  http://plone.org/products/sqlpasplugin/issues/4


Tres.
- --
===
Tres Seaver  +1 202-558-7113  [EMAIL PROTECTED]
Palladion Software   "Excellence by Design"http://palladion.com
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFM5/b+gerLs4ltQ4RAn8UAJ9GnHxqSQAkdmPDj7NsHxPajtK5FACfVA3g
e8wCzxsdyacVaUuawbDUX1Q=
=muJX
-END PGP SIGNATURE-

___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


Re: [Zope] New kubuntu zope/plone installation problem

2006-10-16 Thread Maciej Wisniowski



I just installed zope and plone on a new Kubuntu installation using
the Adept package manager.  Zope comes up on port 8081 -- which was a
bit of a surprise, as I expected it to be on port 9673 as in other
Debian distributions -- but I can deal with that.

8080 is standard port for Zope. You may change it in zope.conf file.



The problem is I don't know the admin username and password.  Is there
a way to either find out what they are or to reset them to something
known?

you may run ./zopectl from your's /bin
and execute adduser command in the prompt (be sure that
zope is not running) to add new user.

Other thing is that I think it is better to install zope from sources.
Then you have control on what is installed, where and what is user
account.

--
Maciej Wisniowski
___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
http://mail.zope.org/mailman/listinfo/zope-announce

http://mail.zope.org/mailman/listinfo/zope-dev )


Re: [Zope] Re: PAS and md5 or crypt passwords

2006-10-16 Thread Andrew Milton
+---[ Robert (Jamie) Munro ]--

[snip]

| It's a pretty silly implementation, though. The point of hashing
| passwords with MD5 or SHA1 is that if an attacker can read the password
| files due to some kind of security leak, he still doesn't have the
| passwords themselves, so he still can't login.

Remembering that if you have enough access to get to the database, you
probably have enough access to alter the Zope app itself (either by inserting
a new user, or through other permissions). So at that point it would be
trivial to alter any code to simply spew out the plaintext passwords (although
needing them at this point would probably be pointless).

I wouldn't worry about people trying to bruteforce your passwords, there are
many, much more efficient methods to grab zope passwords, once you achieve a
certain level of minimal access.

| Unfortunately, the way it
| is implemented in SQLPASPlugin, the fact that he doesn't have the
| password doesn't matter because if you put the hash itself in the
| password field, you are allowed into the site.

Yeah well...

-- 
Andrew Milton
[EMAIL PROTECTED]
___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


Re: [Zope] Re: PAS and md5 or crypt passwords

2006-10-16 Thread Robert (Jamie) Munro
Piotr Furman wrote:
> 
>> I've edited GMailAuthPlugin, renamed it MD5AuthPlugin, added that code
>> and removed the google specific code. It doesn't give any errors, but it
>> also doesn't let me log in. I've tried adding a line to log things, but
>> that doesn't seem to be working either.
>>
> 
> Maybe You should take a look at SQLPASPlugin -
> http://plone.org/products/sqlpasplugin - there are some SHA encryption
> possibilities, however they are commented by default.
> So You would have to modify it's code little bit.

That's what I was using before. I had no idea that it supported SHA, or
that it was so easy to add MD5. That has solved my problem - Thanks

It's a pretty silly implementation, though. The point of hashing
passwords with MD5 or SHA1 is that if an attacker can read the password
files due to some kind of security leak, he still doesn't have the
passwords themselves, so he still can't login. Unfortunately, the way it
is implemented in SQLPASPlugin, the fact that he doesn't have the
password doesn't matter because if you put the hash itself in the
password field, you are allowed into the site.

It doesn't matter too much for my application, but it's something that
should probably be fixed.

Thanks for everyone's advice, though.

Robert (Jamie) Munro

___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )


RE: [Zope] How can I store session data to db on login/logoff events ?

2006-10-16 Thread Pletli Antal
Thank you Dieter, it is work correctly, i found the session keys!  :-)

-Original Message-
From: Dieter Maurer [mailto:[EMAIL PROTECTED] 
Sent: Friday, October 13, 2006 8:43 PM
To: Pletli Antal
Cc: zope@zope.org
Subject: RE: [Zope] How can I store session data to db on login/logoff
events ?

Pletli Antal wrote at 2006-10-13 08:36 +0200:
>I see, but i dont't know why the session is empty. When the session 
>will be deleted it is not contains the previously set variables (keys) 
>by the user. Only the request object contains the authenticated user 
>name, the container.session or item parameter contents the "id", 
>"token" values but the  content keys is [].

That is strange.

As you can see
"Products.Transience.TransientObjectContainer._do_finalize_work"
the session is not cleared before the "notifyDel".

The real content might be in "item._container" which you can access with
the "TransientObject"s mapping API ("keys", "values", "items", ...)



--
Dieter
___
Zope maillist  -  Zope@zope.org
http://mail.zope.org/mailman/listinfo/zope
**   No cross posts or HTML encoding!  **
(Related lists -
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope-dev )