Re: Re: userrights for localfs_command

"Niels Dettenbach (Syndicat IT&Internet)" <[email protected]> Tue, 03 Apr 2012 18:57:13 +0200
Newsgroups	gmane.comp.cms.zms.devel
Message-ID	<[email protected]>
--mZTnnnxHwwSwF39xbWsvK27sPXnYflBN9IfWd0f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256



Sascha Gottfried <[email protected]> schrieb:

>ZMS 2.12.1 (more specific: class ZMSGlobals.py) offered the method
>'localfs_command' as a public method  without requiring any permission
>from the user/context to call it. As of today this method is not
>available anymore as a result of a former security review.

Ok, this - shurely - did not makes sense from a security perspective view a=
nd disabling that was the right way to react here. My recommendations was t=
argeting a more general level. Proxy roles could be widely compared to unix=
 suid - which could be very helpful but very dangerous if you handle it not=
 wisely...


>@Nils: I accidently addressed the last answer to you.
ahh, mhhmkay - no prob... =C3=9F)

But anyhow, your detailed explanation about localfs-command within ZMS was =
very interesting and helpful too.

Many thanks and have a nice evening,


Niels.

- --
Niels Dettenbach
Syndicat IT&Internet
http://www.syndicat.com
-----BEGIN PGP SIGNATURE-----
Version: APG v1.0.8

iIEEAREIAEEFAk97K+k6HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu
dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDQ41AJ9eEgzgkN5O
W7NB/2iUO6tllUybtgCcD9rVVAgr/TnEolMwjr1r+R5jviA=3D
=3DNKK7
-----END PGP SIGNATURE-----


--mZTnnnxHwwSwF39xbWsvK27sPXnYflBN9IfWd0f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable




<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/htm=
l4/strict.dtd">
<html>
<head>
</head>







<body style=3D"background-color: #fff;">
<span style=3D"display:none">&nbsp;</span>

<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id=3D"ygrp-mlmsg" style=3D"position:relative;">
  <div id=3D"ygrp-msg" style=3D"z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->

    <div id=3D"ygrp-text" >
=20=20=20=20=20=20
=20=20=20=20=20=20
      <p>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Sascha Gottfried &lt;<a href=3D"mailto:sascha.gottfried%40yahoo.com">sascha=
[email protected]</a>&gt; schrieb:<br>
<br>
&gt;ZMS 2.12.1 (more specific: class ZMSGlobals.py) offered the method<br>
&gt;'localfs_command' as a public method  without requiring any permission<=
br>
&gt;from the user/context to call it. As of today this method is not<br>
&gt;available anymore as a result of a former security review.<br>
<br>
Ok, this - shurely - did not makes sense from a security perspective view a=
nd disabling that was the right way to react here. My recommendations was t=
argeting a more general level. Proxy roles could be widely compared to unix=
 suid - which could be very helpful but very dangerous if you handle it not=
 wisely...<br>
<br>
&gt;@Nils: I accidently addressed the last answer to you.<br>
ahh, mhhmkay - no prob... =C3=9F)<br>
<br>
But anyhow, your detailed explanation about localfs-command within ZMS was =
very interesting and helpful too.<br>
<br>
Many thanks and have a nice evening,<br>
<br>
Niels.<br>
<br>
- --<br>
Niels Dettenbach<br>
Syndicat IT&amp;Internet<br>
<a href=3D"http://www.syndicat.com">http://www.syndicat.com</a><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: APG v1.0.8<br>
<br>
iIEEAREIAEEFAk97K&#43;k6HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu<br>
dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDQ41AJ9eEgzgkN5O<br>
W7NB/2iUO6tllUybtgCcD9rVVAgr/TnEolMwjr1r&#43;R5jviA=3D<br>
=3DNKK7<br>
-----END PGP SIGNATURE-----<br>
<br>
</p>

    </div>
=20=20=20=20=20

    <!--~-|**|PrettyHtmlStart|**|-~-->
    <div style=3D"color: #fff; height: 0;">__._,_.___</div>

=20=20=20=20=20=20=20=20
=20=20
=20=20=20
    <div id=3D"ygrp-actbar" style=3D"clear: both; margin-bottom: 10px; whit=
e-space: nowrap; color: #666; padding-top: 15px;">
      <div>
        <a href=3D"mailto:[email protected]?subject=3DRe%3A%20%5Bzms-develope=
rs%5D%20Re%3A%20userrights%20for%20localfs_command" style=3D"margin-right: =
0; padding-right: 0;">
	  Reply to <span style=3D"font-weight: 700;">sender</span></a> |
        <a href=3D"mailto:[email protected]?subject=3DRe%3A%20=
%5Bzms-developers%5D%20Re%3A%20userrights%20for%20localfs_command">
	  Reply to <span style=3D"font-weight: 700;">group</span></a> |
        	  <a href=3D"http://groups.yahoo.com/group/zms-developers/post;_yl=
c=3DX3oDMTJwdjIxbDVjBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3Mjg=
xOTQyBG1zZ0lkAzM3NzYEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzMzNDcyNzM2?act=3Drep=
ly&messageNum=3D3776">Reply <span style=3D"font-weight: 700;">via web post<=
/span></a> |
            	<a href=3D"http://groups.yahoo.com/group/zms-developers/post;_=
ylc=3DX3oDMTJlMG9rbWkxBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3M=
jgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMzMzQ3MjczNg--" style=3D"font-weig=
ht: 700;">Start a New Topic</a>
      </div>

                <a href=3D"http://groups.yahoo.com/group/zms-developers/mes=
sage/3770;_ylc=3DX3oDMTM0YnRpMnRxBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3=
BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3NzYEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzMzNDcyN=
zM2BHRwY0lkAzM3NzA-">Messages in this topic</a>
          (<span style=3D"font-weight: 700;">7</span>)
          </div>=20
<!------- Start Nav Bar ------>

<!-- |**|begin egp html banner|**| -->
<div id=3D"ygrp-vital" style=3D"background-color: #e0ecee; font-family: Ver=
dana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
      <span id=3D"vithd" style=3D"font-weight: bold; color: #333; text-tran=
sform: uppercase; ">Recent Activity:</span>

    <ul style=3D"list-style-type: none; margin: 0; padding: 0; display: inl=
ine;">
                                                    </ul>
=20=20=20=20
  <div style=3D"clear: both; padding-top: 2px; color: #1e66ae;">
    <a href=3D"http://groups.yahoo.com/group/zms-developers;_ylc=3DX3oDMTJl=
MTk2dXE1BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN=
2dGwEc2xrA3ZnaHAEc3RpbWUDMTMzMzQ3MjczNg--" style=3D"text-decoration: none;"=
>Visit Your Group</a>
  </div>
</div>

=20=20
<div id=3D"ft" style=3D"font-family: Arial; font-size: 11px; margin-top: 5p=
x; padding: 0 2px 0 0; clear: both;">
  <a href=3D"http://groups.yahoo.com/;_ylc=3DX3oDMTJkMXB0cDBvBF9TAzk3MzU5Nz=
E0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZ=
QMxMzMzNDcyNzM2" style=3D"float: left;"><img src=3D"http://l.yimg.com/a/i/u=
s/yg/logo/us.gif" height=3D"15" width=3D"137" alt=3D"Yahoo! Groups" style=
=3D"border: 0;"/></a>
  <div style=3D"color: #747575; float: right;">Switch to: <a href=3D"mailto=
:[email protected]?subject=3DChange Delivery Forma=
t: Traditional" style=3D"text-decoration: none;">Text-Only</a>, <a href=3D"=
mailto:[email protected]?subject=3DEmail Delivery: Dige=
st" class=3D"margin-rt" style=3D"text-decoration: none;">Daily Digest</a> &=
bull; <a href=3D"mailto:[email protected]?subject=
=3DUnsubscribe" style=3D"text-decoration: none;">Unsubscribe</a> &bull; <a =
href=3D"http://docs.yahoo.com/info/terms/" style=3D"text-decoration: none;"=
>Terms of Use</a></div>
</div>

<!-- |**|end egp html banner|**| -->

  </div> <!-- ygrp-msg -->

  <!-- Sponsor -->
  <!-- |**|begin egp html banner|**| -->
  <div id=3D"ygrp-sponsor" style=3D"width:160px; float:right; clear:none; m=
argin:0 0 25px 0; background: #fff;">

<!-- Start Recommendations -->
<div id=3D"ygrp-reco">
     </div>
<!-- End Recommendations -->



  </div>   <!-- |**|end egp html banner|**| -->

  <div style=3D"clear:both; color: #FFF; font-size:1px;">.</div>
</div>

  <img src=3D"http://geo.yahoo.com/serv?s=3D97359714/grpId=3D8470821/grpspI=
d=3D1707281942/msgId=3D3776/stime=3D1333472736/nc1=3D5741391/nc2=3D3848644/=
nc3=3D4507179" width=3D"1" height=3D"1"> <br>

<div style=3D"color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->

</body>

<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
  <style type=3D"text/css">
  <!--
  #ygrp-mkp {
  border: 1px solid #d8d8d8;
  font-family: Arial;
  margin: 10px 0;
  padding: 0 10px;
}

#ygrp-mkp hr {
  border: 1px solid #d8d8d8;
}

#ygrp-mkp #hd {
  color: #628c2a;
  font-size: 85%;
  font-weight: 700;
  line-height: 122%;
  margin: 10px 0;
}

#ygrp-mkp #ads {
  margin-bottom: 10px;
}

#ygrp-mkp .ad {
  padding: 0 0;
}

#ygrp-mkp .ad p {
  margin: 0;
}

#ygrp-mkp .ad a {
  color: #0000ff;
  text-decoration: none;
}
  #ygrp-sponsor #ygrp-lc {
  font-family: Arial;
}

#ygrp-sponsor #ygrp-lc #hd {
  margin: 10px 0px;
  font-weight: 700;
  font-size: 78%;
  line-height: 122%;
}

#ygrp-sponsor #ygrp-lc .ad {
  margin-bottom: 10px;
  padding: 0 0;
}

  a {
    color: #1e66ae;
  }

  #actions {
    font-family: Verdana;
    font-size: 11px;
    padding: 10px 0;
  }

  #activity {
    background-color: #e0ecee;
    float: left;
    font-family: Verdana;
    font-size: 10px;
    padding: 10px;
  }

  #activity span {
    font-weight: 700;
  }

  #activity span:first-child {
    text-transform: uppercase;
  }

  #activity span a {
    color: #5085b6;
    text-decoration: none;
  }

  #activity span span {
    color: #ff7900;
  }

  #activity span .underline {
    text-decoration: underline;
  }

  .attach {
    clear: both;
    display: table;
    font-family: Arial;
    font-size: 12px;
    padding: 10px 0;
    width: 400px;
  }

  .attach div a {
    text-decoration: none;
  }

  .attach img {
    border: none;
    padding-right: 5px;
  }

  .attach label {
    display: block;
    margin-bottom: 5px;
  }

  .attach label a {
    text-decoration: none;
  }
=20=20
  blockquote {
    margin: 0 0 0 4px;
  }

  .bold {
    font-family: Arial;
    font-size: 13px;
    font-weight: 700;
  }

  .bold a {
    text-decoration: none;
  }

  dd.last p a {
    font-family: Verdana;
    font-weight: 700;
  }

  dd.last p span {
    margin-right: 10px;
    font-family: Verdana;
    font-weight: 700;
  }

  dd.last p span.yshortcuts {
    margin-right: 0;
  }

  div.attach-table div div a {
    text-decoration: none;
  }

  div.attach-table {
    width: 400px;
  }

  div.file-title a, div.file-title a:active, div.file-title a:hover, div.fi=
le-title a:visited {
    text-decoration: none;
  }

  div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div=
.photo-title a:visited {
    text-decoration: none;
  }

  div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
    font-family: Verdana;
    font-size: 10px;
    font-weight: normal;
  }

  .green {
    color: #628c2a;
  }

  .MsoNormal {
    margin: 0 0 0 0;
  }

  o {
    font-size: 0;
  }

  #photos div {
    float: left;
    width: 72px;
  }

  #photos div div {
    border: 1px solid #666666;
    height: 62px;
    overflow: hidden;
    width: 62px;
  }

  #photos div label {
    color: #666666;
    font-size: 10px;
    overflow: hidden;
    text-align: center;
    white-space: nowrap;
    width: 64px;
  }

  #reco-category {
    font-size: 77%;
  }

  #reco-desc {
    font-size: 77%;
  }

  .replbq {
    margin: 4px;
  }

  #ygrp-actbar div a:first-child {
   /* border-right: 0px solid #000;*/
    margin-right: 2px;
    padding-right: 5px;
  }

  #ygrp-mlmsg {
    font-size: 13px;
    font-family: Arial, helvetica,clean, sans-serif;
    *font-size: small;
    *font: x-small;
  }

  #ygrp-mlmsg table {
    font-size: inherit;
    font: 100%;
  }

  #ygrp-mlmsg select, input, textarea {
    font: 99% Arial, Helvetica, clean, sans-serif;
  }

  #ygrp-mlmsg pre, code {
    font:115% monospace;
    *font-size:100%;
  }

  #ygrp-mlmsg * {
    line-height: 1.22em;
  }

  #ygrp-mlmsg #logo {
    padding-bottom: 10px;
  }

  #ygrp-mlmsg a {
    color: #1E66AE;
  }

  #ygrp-msg p a {
    font-family: Verdana;
  }

  #ygrp-msg p#attach-count span {
    color: #1E66AE;
    font-weight: 700;
  }

  #ygrp-reco #reco-head {
    color: #ff7900;
    font-weight: 700;
  }

  #ygrp-reco {
    margin-bottom: 20px;
    padding: 0px;
  }

  #ygrp-sponsor #ov li a {
    font-size: 130%;
    text-decoration: none;
  }

  #ygrp-sponsor #ov li {
    font-size: 77%;
    list-style-type: square;
    padding: 6px 0;
  }=20

  #ygrp-sponsor #ov ul {
    margin: 0;
    padding: 0 0 0 8px;
  }

  #ygrp-text {
    font-family: Georgia;
  }

  #ygrp-text p {
    margin: 0 0 1em 0;
  }

  #ygrp-text tt {
    font-size: 120%;
  }

  #ygrp-vital ul li:last-child {
    border-right: none !important;=20
  }=20
  -->
  </style>
</head>

<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->


--mZTnnnxHwwSwF39xbWsvK27sPXnYflBN9IfWd0f--