Re: userrights for localfs_command
"Sascha Gottfried" <[email protected]> Tue, 03 Apr 2012 09:21:58 -0000
| Newsgroups | gmane.comp.cms.zms.devel |
|---|---|
| Message-ID | <[email protected]> |
--ogW-tNwz3e75762YnSWBgKsuk92gOi9PctXKFgg Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Niels, what you did as well is giving a script all zope permissions available. Thi= s script is available for anybody in the web. With this script you access r= esources in your file system.=20 Welcome to secure web applications. Hello OWASP Top 10 Security Risks. Zope has a lot of secure answers for that stuff. If you want to know, why t= his worked in ZMS a couple of months ago and what you really need to do, as= k me. But I am not sure, if you need a quick fix or a secure solution for y= our customers.=20 Sascha --- In [email protected], Thorsten Weber <tweber@...> wrote: > > Hi Niels, >=20 > that does the trick ! :) > i forgot that one can assign the proxy role manager to the onChangeObjEve= nt methode as well. >=20 > thanx ! >=20 >=20 > kind regards, Thorsten >=20 >=20 >=20 > Am 15.03.2012 um 15:11 schrieb Niels Dettenbach (Syndicat IT&Internet): >=20 > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA256 > >=20 > > Thorsten Weber <tweber@...> schrieb: > >=20 > > >It seems as if a script (like onChangeObjEvt) is triggered from > > >ZMSAuthors it does not have the right to execute localfs_commands. > > > > > >Is there a quick fix for that? > >=20 > > hmm, > > such things are usually done inn Zope by assigning proxy roles to the a= ccessing method etc.. > >=20 > > Another way could be setting up an own product just allowing the things= to roles you require - overriding the acls in existing objects without to = touch them. > >=20 > > hth > > best regards, > >=20 > > Niels. > > - -- > > Niels Dettenbach > > Syndicat IT&Internet > > http://www.syndicat.com > > -----BEGIN PGP SIGNATURE----- > > Version: APG v1.0.8 > >=20 > > iIEEAREIAEEFAk9h+J46HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu > > dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDbCwAJsFG+feOkvT > > DRcXv6ADv1NHeSgPeACggGAUQBnKxsjz6t7PmRTYE8OFFJ4=3D > > =3Dj1JD > > -----END PGP SIGNATURE----- > >=20 > > > --ogW-tNwz3e75762YnSWBgKsuk92gOi9PctXKFgg Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> </head> <body style="background-color: #fff;"> <span style="display:none"> </span> <!--~-|**|PrettyHtmlStartT|**|-~--> <div id="ygrp-mlmsg" style="position:relative;"> <div id="ygrp-msg" style="z-index: 1;"> <!--~-|**|PrettyHtmlEndT|**|-~--> <div id="ygrp-text" > <p>Hi Niels,<br> what you did as well is giving a script all zope permissions available. This script is available for anybody in the web. With this script you access resources in your file system. <br> <br> Welcome to secure web applications. Hello OWASP Top 10 Security Risks.<br> <br> Zope has a lot of secure answers for that stuff. If you want to know, why this worked in ZMS a couple of months ago and what you really need to do, ask me. But I am not sure, if you need a quick fix or a secure solution for your customers. <br> <br> Sascha<br> <br> --- In <a href="mailto:zms-developers%40yahoogroups.com">[email protected]</a>, Thorsten Weber <tweber@...> wrote:<br> ><br> > Hi Niels,<br> > <br> > that does the trick ! :)<br> > i forgot that one can assign the proxy role manager to the onChangeObjEvent methode as well.<br> > <br> > thanx !<br> > <br> > <br> > kind regards, Thorsten<br> > <br> > <br> > <br> > Am 15.03.2012 um 15:11 schrieb Niels Dettenbach (Syndicat IT&Internet):<br> > <br> > > -----BEGIN PGP SIGNED MESSAGE-----<br> > > Hash: SHA256<br> > > <br> > > Thorsten Weber <tweber@...> schrieb:<br> > > <br> > > >It seems as if a script (like onChangeObjEvt) is triggered from<br> > > >ZMSAuthors it does not have the right to execute localfs_commands.<br> > > ><br> > > >Is there a quick fix for that?<br> > > <br> > > hmm,<br> > > such things are usually done inn Zope by assigning proxy roles to the accessing method etc..<br> > > <br> > > Another way could be setting up an own product just allowing the things to roles you require - overriding the acls in existing objects without to touch them.<br> > > <br> > > hth<br> > > best regards,<br> > > <br> > > Niels.<br> > > - --<br> > > Niels Dettenbach<br> > > Syndicat IT&Internet<br> > > <a href="http://www.syndicat.com">http://www.syndicat.com</a><br> > > -----BEGIN PGP SIGNATURE-----<br> > > Version: APG v1.0.8<br> > > <br> > > iIEEAREIAEEFAk9h+J46HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu<br> > > dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDbCwAJsFG+feOkvT<br> > > DRcXv6ADv1NHeSgPeACggGAUQBnKxsjz6t7PmRTYE8OFFJ4=<br> > > =j1JD<br> > > -----END PGP SIGNATURE-----<br> > > <br> > ><br> ><br> <br> </p> </div> <!--~-|**|PrettyHtmlStart|**|-~--> <div style="color: #fff; height: 0;">__._,_.___</div> <div id="ygrp-actbar" style="clear: both; margin-bottom: 10px; white-space: nowrap; color: #666; padding-top: 15px;"> <div> <a href="mailto:[email protected]?subject=Re%3A%20userrights%20for%20localfs_command" style="margin-right: 0; padding-right: 0;"> Reply to <span style="font-weight: 700;">sender</span></a> | <a href="mailto:[email protected]?subject=Re%3A%20userrights%20for%20localfs_command"> Reply to <span style="font-weight: 700;">group</span></a> | <a href="http://groups.yahoo.com/group/zms-developers/post;_ylc=X3oDMTJwdTNoZWN1BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3NzMEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzMzNDUxMjc5?act=reply&messageNum=3773">Reply <span style="font-weight: 700;">via web post</span></a> | <a href="http://groups.yahoo.com/group/zms-developers/post;_ylc=X3oDMTJlZm1jajBtBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMzMzQ1MTI3OQ--" style="font-weight: 700;">Start a New Topic</a> </div> <a href="http://groups.yahoo.com/group/zms-developers/message/3770;_ylc=X3oDMTM0azQzY2ZzBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3NzMEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzMzNDUxMjc5BHRwY0lkAzM3NzA-">Messages in this topic</a> (<span style="font-weight: 700;">4</span>) </div> <!------- Start Nav Bar ------> <!-- |**|begin egp html banner|**| --> <div id="ygrp-vital" style="background-color: #e0ecee; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;"> <span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; ">Recent Activity:</span> <ul style="list-style-type: none; margin: 0; padding: 0; display: inline;"> </ul> <div style="clear: both; padding-top: 2px; color: #1e66ae;"> <a href="http://groups.yahoo.com/group/zms-developers;_ylc=X3oDMTJlZjlxcjdhBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTMzMzQ1MTI3OQ--" style="text-decoration: none;">Visit Your Group</a> </div> </div> <div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;"> <a href="http://groups.yahoo.com/;_ylc=X3oDMTJkczdtNWY4BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMzMzNDUxMjc5" style="float: left;"><img src="http://l.yimg.com/a/i/us/yg/logo/us.gif" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a> <div style="color: #747575; float: right;">Switch to: <a href="mailto:[email protected]?subject=Change Delivery Format: Traditional" style="text-decoration: none;">Text-Only</a>, <a href="mailto:[email protected]?subject=Email Delivery: Digest" class="margin-rt" style="text-decoration: none;">Daily Digest</a> • <a href="mailto:[email protected]?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> • <a href="http://docs.yahoo.com/info/terms/" style="text-decoration: none;">Terms of Use</a></div> </div> <!-- |**|end egp html banner|**| --> </div> <!-- ygrp-msg --> <!-- Sponsor --> <!-- |**|begin egp html banner|**| --> <div id="ygrp-sponsor" style="width:160px; float:right; clear:none; margin:0 0 25px 0; background: #fff;"> <!-- Start Recommendations --> <div id="ygrp-reco"> </div> <!-- End Recommendations --> </div> <!-- |**|end egp html banner|**| --> <div style="clear:both; color: #FFF; font-size:1px;">.</div> </div> <img src="http://geo.yahoo.com/serv?s=97359714/grpId=8470821/grpspId=1707281942/msgId=3773/stime=1333451279/nc1=4507179/nc2=3848642/nc3=5758219" width="1" height="1"> <br> <div style="color: #fff; height: 0;">__,_._,___</div> <!--~-|**|PrettyHtmlEnd|**|-~--> </body> <!--~-|**|PrettyHtmlStart|**|-~--> <head> <style type="text/css"> <!-- #ygrp-mkp { border: 1px solid #d8d8d8; font-family: Arial; margin: 10px 0; padding: 0 10px; } #ygrp-mkp hr { border: 1px solid #d8d8d8; } #ygrp-mkp #hd { color: #628c2a; font-size: 85%; font-weight: 700; line-height: 122%; margin: 10px 0; } #ygrp-mkp #ads { margin-bottom: 10px; } #ygrp-mkp .ad { padding: 0 0; } #ygrp-mkp .ad p { margin: 0; } #ygrp-mkp .ad a { color: #0000ff; text-decoration: none; } #ygrp-sponsor #ygrp-lc { font-family: Arial; } #ygrp-sponsor #ygrp-lc #hd { margin: 10px 0px; font-weight: 700; font-size: 78%; line-height: 122%; } #ygrp-sponsor #ygrp-lc .ad { margin-bottom: 10px; padding: 0 0; } a { color: #1e66ae; } #actions { font-family: Verdana; font-size: 11px; padding: 10px 0; } #activity { background-color: #e0ecee; float: left; font-family: Verdana; font-size: 10px; padding: 10px; } #activity span { font-weight: 700; } #activity span:first-child { text-transform: uppercase; } #activity span a { color: #5085b6; text-decoration: none; } #activity span span { color: #ff7900; } #activity span .underline { text-decoration: underline; } .attach { clear: both; display: table; font-family: Arial; font-size: 12px; padding: 10px 0; width: 400px; } .attach div a { text-decoration: none; } .attach img { border: none; padding-right: 5px; } .attach label { display: block; margin-bottom: 5px; } .attach label a { text-decoration: none; } blockquote { margin: 0 0 0 4px; } .bold { font-family: Arial; font-size: 13px; font-weight: 700; } .bold a { text-decoration: none; } dd.last p a { font-family: Verdana; font-weight: 700; } dd.last p span { margin-right: 10px; font-family: Verdana; font-weight: 700; } dd.last p span.yshortcuts { margin-right: 0; } div.attach-table div div a { text-decoration: none; } div.attach-table { width: 400px; } div.file-title a, div.file-title a:active, div.file-title a:hover, div.file-title a:visited { text-decoration: none; } div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div.photo-title a:visited { text-decoration: none; } div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts { font-family: Verdana; font-size: 10px; font-weight: normal; } .green { color: #628c2a; } .MsoNormal { margin: 0 0 0 0; } o { font-size: 0; } #photos div { float: left; width: 72px; } #photos div div { border: 1px solid #666666; height: 62px; overflow: hidden; width: 62px; } #photos div label { color: #666666; font-size: 10px; overflow: hidden; text-align: center; white-space: nowrap; width: 64px; } #reco-category { font-size: 77%; } #reco-desc { font-size: 77%; } .replbq { margin: 4px; } #ygrp-actbar div a:first-child { /* border-right: 0px solid #000;*/ margin-right: 2px; padding-right: 5px; } #ygrp-mlmsg { font-size: 13px; font-family: Arial, helvetica,clean, sans-serif; *font-size: small; *font: x-small; } #ygrp-mlmsg table { font-size: inherit; font: 100%; } #ygrp-mlmsg select, input, textarea { font: 99% Arial, Helvetica, clean, sans-serif; } #ygrp-mlmsg pre, code { font:115% monospace; *font-size:100%; } #ygrp-mlmsg * { line-height: 1.22em; } #ygrp-mlmsg #logo { padding-bottom: 10px; } #ygrp-mlmsg a { color: #1E66AE; } #ygrp-msg p a { font-family: Verdana; } #ygrp-msg p#attach-count span { color: #1E66AE; font-weight: 700; } #ygrp-reco #reco-head { color: #ff7900; font-weight: 700; } #ygrp-reco { margin-bottom: 20px; padding: 0px; } #ygrp-sponsor #ov li a { font-size: 130%; text-decoration: none; } #ygrp-sponsor #ov li { font-size: 77%; list-style-type: square; padding: 6px 0; } #ygrp-sponsor #ov ul { margin: 0; padding: 0 0 0 8px; } #ygrp-text { font-family: Georgia; } #ygrp-text p { margin: 0 0 1em 0; } #ygrp-text tt { font-size: 120%; } #ygrp-vital ul li:last-child { border-right: none !important; } --> </style> </head> <!--~-|**|PrettyHtmlEnd|**|-~--> </html> <!-- end group email --> --ogW-tNwz3e75762YnSWBgKsuk92gOi9PctXKFgg--