Re: userrights for localfs_command
Thorsten Weber <[email protected]> Wed, 4 Apr 2012 09:51:54 +0200
| Newsgroups | gmane.comp.cms.zms.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_5B580A46-2D19-4960-A1BB-E5BBBBCE086A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=windows-1252
Hello Sascha,
thanks a lot for your detailed and very insightful explanation!
and you are probably right concerning the exception - which might be raised=
silently.
until the 10. of april I'm out of the office ...=20
but i will come back to this as soon as possible and will apply verbose sec=
urity on a dev instance and provide the traceback.
this for now:
ZMS: ZMS2 2.12.1.1047 (Build #132e)
ZOPE: (2.12.3, python 2.5.2, linux2)
PYTHON: 2.5.2
we generate some xml to feed a flash application when storing an object wit=
hin zms and store it in local filesystem (for performance reasons)
(localfs_write(path_to_xml, xml_structur_text, mode=3D'b'))
and purge that object from cache afterwards
(localfs_command('/usr/bin/squidclient -h my_squid_ipaddress -p 80 -m PUR=
GE http://my_frontend_url')
all triggered by onChangeObjEvt
but we were facing the problem that the method seems not have the right to =
execute the commands
1. write the new xml file
2. calling the squidclient
Giving proxy manager rights to that method solved the problem so far.
but from a web application developer view one may expect that these "batter=
ies" might be included within these zms-api calls
if only when called by with a rather privileged account as ZMSAuthor ... =
no?
kind regards,=20=20
Thorsten Weber
Am 03.04.2012 um 16:10 schrieb Sascha Gottfried:
> Hi Thorsten,
> Zope Products (in your case: ZMS) offer an API that is available to restr=
icted code if the required permission can be acquired in the request contex=
t.
>=20
> ZMS 2.12.1 (more specific: class ZMSGlobals.py) offered the method 'local=
fs_command' as a public method without requiring any permission from the us=
er/context to call it. As of today this method is not available anymore as =
a result of a former security review.
>=20
> That most probably means, that not the call of the method 'locafs_command=
' is raising an exception, but the code in your method 'onChangeObjEvt'. Pl=
ease provide the traceback to your problem - without I am just guessing. I =
do not want to guess.
>=20
> Another hint - during development please change your zope instance to use=
'Verbose Security'. Now a security exception tells you exactly what permis=
sion is required and more. This link shows how to change zope.conf (http://=
plone.org/documentation/kb/debug-unauthorized)
>=20
> If you don't mind provide some application details to your next answer. P=
lease do not forget the traceback. And if you do not mind tell me more abou=
t the task you are trying to do.
>=20
> @Nils: I accidently addressed the last answer to you.
>=20
> A more secure way would be just to find out which permission is needed an=
d to give this permission to a user. This applies to existing zope permissi=
ons currently not available to ZMSAuthor.
>=20
> Another way would be to register a new permission in your application and=
add it to custom ZMS roles. In your script you could use Zope's API method=
checkPermission() or similar to verify that the caller has this permission=
. Now it is up to a zope administrator to provide this permission to certai=
n users.=20
>=20
> If more methods in ZMS like 'localfs_command' had a proper permission req=
uirement, it would be more easy to application developers to provide the pe=
rmissions needed. Usual zope products contain code like this.
>=20
> security.declareProtected(permissionName, methodName)
>=20
> source:
> http://docs.zope.org/zope2/zdgbook/Security.html#implementing-security-in=
-python-products
>=20
> Users need this permission to call this method from restriced code (like =
any python script in ZODB). With this in mind - access control to applicati=
on logic is a matter of user administration.
>=20
> That restriction does not apply to file system code like Zope products - =
but ZMS developers usually implement business logic in restricted code. Tha=
t's why it is important to know the stuff mentioned above.
>=20
> Looking forward to see the traceback,
> Sascha
>=20
> --- In [email protected], Niels Dettenbach <nd@...> wrote:
> >
> > Am Dienstag, 3. April 2012, 09:21:58 schrieben Sie:
> > > what you did as well is giving a script all zope permissions availabl=
e. This
> > > script is available for anybody in the web. With this script you acce=
ss
> > > resources in your file system.=20
> > ...shure it does - so it is very (!) important to know what the script =
does=20
> > and allows by theory and in practice...
> >=20
> > > Zope has a lot of secure answers for that stuff. If you want to know,=
why=20
> > > this worked in ZMS a couple of months ago and what you really need to=
do,=20
> > > ask me. But I am not sure, if you need a quick fix or a secure soluti=
on for
> > > your customers.=20
> >=20
> > Can you give some more details or examples? "a lot of " is really nothi=
ng more=20
> > then helpless to anyone here on the list...
> >=20
> >=20
> > cheers,
> >=20
> >=20
> > Niels.
> > --=20
> > ---
> > Niels Dettenbach
> > Syndicat IT & Internet
> > http://www.syndicat.com
> > ---
> >
>=20
>=20
--Apple-Mail=_5B580A46-2D19-4960-A1BB-E5BBBBCE086A
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
</head>
<body style="background-color: #fff;">
<span style="display:none"> </span>
<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id="ygrp-mlmsg" style="position:relative;">
<div id="ygrp-msg" style="z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->
<div id="ygrp-text" >
<p>Hello Sascha,<div><br></div><div>thanks a lot for your detailed and very insightful explanation!</div><div>and you are probably right concerning the exception - which might be raised silently.</div><div><br></div><div>until the 10. of april I'm out of the office ... </div><div>but i will come back to this as soon as possible and will apply verbose security on a dev instance and provide the traceback.</div><div><br></div><div><br></div><div>this for now:</div><div><br></div><div>ZMS: ZMS2 2.12.1.1047 (Build #132e)<br>
<a name="_AutoPack"></a>
ZOPE: (2.12.3, python 2.5.2, linux2)<br>
PYTHON: 2.5.2</div><div><br></div><div>we generate some xml to feed a flash application when storing an object within zms and store it in local filesystem (for performance reasons)</div><div>(localfs_write(path_to_xml, xml_structur_text, mode='b'))</div><div><br></div><div>and purge that object from cache afterwards</div><div>(localfs_command('/usr/bin/squidclient -h my_squid_ipaddress -p 80 -m PURGE <a href="http://my_frontend_url'">http://my_frontend_url'</a>)</div><div><br></div><div>all triggered by onChangeObjEvt</div><div><br></div><div>but we were facing the problem that the method seems not have the right to execute the commands</div><div>1. write the new xml file</div><div>2. calling the squidclient</div><div><br></div><div>Giving proxy manager rights to that me
thod solved the problem so far.</div><div><br></div><div><br></div><div>but from a web application developer view one may expect that these "batteries" might be included within these zms-api calls</div><div>if only when called by with a rather privileged account as ZMSAuthor ... no?</div><div><br></div><div><br></div><div><div apple="true">
<div>kind regards, <br>Thorsten Weber</div><div><br></div><div><br></div><div><br></div></div><div><div>Am 03.04.2012 um 16:10 schrieb Sascha Gottfried:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<div style="background-color: #fff;">
<span> </span>
<div id="ygrp-text"><p>Hi Thorsten,<br>
Zope Products (in your case: ZMS) offer an API that is available to restricted code if the required permission can be acquired in the request context.<br>
<br>
ZMS 2.12.1 (more specific: class ZMSGlobals.py) offered the method 'localfs_command' as a public method without requiring any permission from the user/context to call it. As of today this method is not available anymore as a result of a former security review.<br>
<br>
That most probably means, that not the call of the method 'locafs_command' is raising an exception, but the code in your method 'onChangeObjEvt'. Please provide the traceback to your problem - without I am just guessing. I do not want to guess.<br>
<br>
Another hint - during development please change your zope instance to use 'Verbose Security'. Now a security exception tells you exactly what permission is required and more. This link shows how to change zope.conf (<a href="http://plone.org/documentation/kb/debug-unauthorized">http://plone.org/documentation/kb/debug-unauthorized</a>)<br>
<br>
If you don't mind provide some application details to your next answer. Please do not forget the traceback. And if you do not mind tell me more about the task you are trying to do.<br>
<br>
@Nils: I accidently addressed the last answer to you.<br>
<br>
A more secure way would be just to find out which permission is needed and to give this permission to a user. This applies to existing zope permissions currently not available to ZMSAuthor.<br>
<br>
Another way would be to register a new permission in your application and add it to custom ZMS roles. In your script you could use Zope's API method checkPermission() or similar to verify that the caller has this permission. Now it is up to a zope administrator to provide this permission to certain users. <br>
<br>
If more methods in ZMS like 'localfs_command' had a proper permission requirement, it would be more easy to application developers to provide the permissions needed. Usual zope products contain code like this.<br>
<br>
security.declareProtected(permissionName, methodName)<br>
<br>
source:<br>
<a href="http://docs.zope.org/zope2/zdgbook/Security.html#implementing-security-in-python-products">http://docs.zope.org/zope2/zdgbook/Security.html#implementing-security-in-python-products</a><br>
<br>
Users need this permission to call this method from restriced code (like any python script in ZODB). With this in mind - access control to application logic is a matter of user administration.<br>
<br>
That restriction does not apply to file system code like Zope products - but ZMS developers usually implement business logic in restricted code. That's why it is important to know the stuff mentioned above.<br>
<br>
Looking forward to see the traceback,<br>
Sascha<br>
<br>
--- In <a href="mailto:zms-developers%40yahoogroups.com">[email protected]</a>, Niels Dettenbach <nd@...> wrote:<br>
><br>
> Am Dienstag, 3. April 2012, 09:21:58 schrieben Sie:<br>
> > what you did as well is giving a script all zope permissions available. This<br>
> > script is available for anybody in the web. With this script you access<br>
> > resources in your file system. <br>
> ...shure it does - so it is very (!) important to know what the script does <br>
> and allows by theory and in practice...<br>
> <br>
> > Zope has a lot of secure answers for that stuff. If you want to know, why <br>
> > this worked in ZMS a couple of months ago and what you really need to do, <br>
> > ask me. But I am not sure, if you need a quick fix or a secure solution for<br>
> > your customers. <br>
> <br>
> Can you give some more details or examples? "a lot of " is really nothing more <br>
> then helpless to anyone here on the list...<br>
> <br>
> <br>
> cheers,<br>
> <br>
> <br>
> Niels.<br>
> -- <br>
> ---<br>
> Niels Dettenbach<br>
> Syndicat IT & Internet<br>
> <a href="http://www.syndicat.com/">http://www.syndicat.com</a><br>
> ---<br>
><br>
<br>
</p>
</div>
</div>
<!-- end group email -->
</blockquote></div><br></div></p>
</div>
<!--~-|**|PrettyHtmlStart|**|-~-->
<div style="color: #fff; height: 0;">__._,_.___</div>
<div id="ygrp-actbar" style="clear: both; margin-bottom: 10px; white-space: nowrap; color: #666; padding-top: 15px;">
<div>
<a href="mailto:[email protected]?subject=Re%3A%20%5Bzms-developers%5D%20userrights%20for%20localfs_command" style="margin-right: 0; padding-right: 0;">
Reply to <span style="font-weight: 700;">sender</span></a> |
<a href="mailto:[email protected]?subject=Re%3A%20%5Bzms-developers%5D%20userrights%20for%20localfs_command">
Reply to <span style="font-weight: 700;">group</span></a> |
<a href="http://groups.yahoo.com/group/zms-developers/post;_ylc=X3oDMTJwanVuZWhjBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3NzcEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzMzNTI1OTIx?act=reply&messageNum=3777">Reply <span style="font-weight: 700;">via web post</span></a> |
<a href="http://groups.yahoo.com/group/zms-developers/post;_ylc=X3oDMTJlNmI4c3RlBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMzMzUyNTkyMQ--" style="font-weight: 700;">Start a New Topic</a>
</div>
<a href="http://groups.yahoo.com/group/zms-developers/message/3770;_ylc=X3oDMTM0ajJsZ2VhBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3NzcEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzMzNTI1OTIxBHRwY0lkAzM3NzA-">Messages in this topic</a>
(<span style="font-weight: 700;">8</span>)
</div>
<!------- Start Nav Bar ------>
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #e0ecee; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
<span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; ">Recent Activity:</span>
<ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
</ul>
<div style="clear: both; padding-top: 2px; color: #1e66ae;">
<a href="http://groups.yahoo.com/group/zms-developers;_ylc=X3oDMTJlYmsxbHF1BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTMzMzUyNTkyMQ--" style="text-decoration: none;">Visit Your Group</a>
</div>
</div>
<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
<a href="http://groups.yahoo.com/;_ylc=X3oDMTJkM2lzajBhBF9TAzk3NDc2NTkwBGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMzMzNTI1OTIx" style="float: left;"><img src="http://l.yimg.com/a/i/us/yg/logo/us.gif" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
<div style="color: #747575; float: right;">Switch to: <a href="mailto:[email protected]?subject=Change Delivery Format: Traditional" style="text-decoration: none;">Text-Only</a>, <a href="mailto:[email protected]?subject=Email Delivery: Digest" class="margin-rt" style="text-decoration: none;">Daily Digest</a> • <a href="mailto:[email protected]?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> • <a href="http://docs.yahoo.com/info/terms/" style="text-decoration: none;">Terms of Use</a></div>
</div>
<!-- |**|end egp html banner|**| -->
</div> <!-- ygrp-msg -->
<!-- Sponsor -->
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-sponsor" style="width:160px; float:right; clear:none; margin:0 0 25px 0; background: #fff;">
<!-- Start Recommendations -->
<div id="ygrp-reco">
</div>
<!-- End Recommendations -->
</div> <!-- |**|end egp html banner|**| -->
<div style="clear:both; color: #FFF; font-size:1px;">.</div>
</div>
<img src="http://geo.yahoo.com/serv?s=97359714/grpId=8470821/grpspId=1707281942/msgId=3777/stime=1333525921/nc1=4507179/nc2=5191952/nc3=3848641" width="1" height="1"> <br>
<div style="color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</body>
<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
<style type="text/css">
<!--
#ygrp-mkp {
border: 1px solid #d8d8d8;
font-family: Arial;
margin: 10px 0;
padding: 0 10px;
}
#ygrp-mkp hr {
border: 1px solid #d8d8d8;
}
#ygrp-mkp #hd {
color: #628c2a;
font-size: 85%;
font-weight: 700;
line-height: 122%;
margin: 10px 0;
}
#ygrp-mkp #ads {
margin-bottom: 10px;
}
#ygrp-mkp .ad {
padding: 0 0;
}
#ygrp-mkp .ad p {
margin: 0;
}
#ygrp-mkp .ad a {
color: #0000ff;
text-decoration: none;
}
#ygrp-sponsor #ygrp-lc {
font-family: Arial;
}
#ygrp-sponsor #ygrp-lc #hd {
margin: 10px 0px;
font-weight: 700;
font-size: 78%;
line-height: 122%;
}
#ygrp-sponsor #ygrp-lc .ad {
margin-bottom: 10px;
padding: 0 0;
}
a {
color: #1e66ae;
}
#actions {
font-family: Verdana;
font-size: 11px;
padding: 10px 0;
}
#activity {
background-color: #e0ecee;
float: left;
font-family: Verdana;
font-size: 10px;
padding: 10px;
}
#activity span {
font-weight: 700;
}
#activity span:first-child {
text-transform: uppercase;
}
#activity span a {
color: #5085b6;
text-decoration: none;
}
#activity span span {
color: #ff7900;
}
#activity span .underline {
text-decoration: underline;
}
.attach {
clear: both;
display: table;
font-family: Arial;
font-size: 12px;
padding: 10px 0;
width: 400px;
}
.attach div a {
text-decoration: none;
}
.attach img {
border: none;
padding-right: 5px;
}
.attach label {
display: block;
margin-bottom: 5px;
}
.attach label a {
text-decoration: none;
}
blockquote {
margin: 0 0 0 4px;
}
.bold {
font-family: Arial;
font-size: 13px;
font-weight: 700;
}
.bold a {
text-decoration: none;
}
dd.last p a {
font-family: Verdana;
font-weight: 700;
}
dd.last p span {
margin-right: 10px;
font-family: Verdana;
font-weight: 700;
}
dd.last p span.yshortcuts {
margin-right: 0;
}
div.attach-table div div a {
text-decoration: none;
}
div.attach-table {
width: 400px;
}
div.file-title a, div.file-title a:active, div.file-title a:hover, div.file-title a:visited {
text-decoration: none;
}
div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div.photo-title a:visited {
text-decoration: none;
}
div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
font-family: Verdana;
font-size: 10px;
font-weight: normal;
}
.green {
color: #628c2a;
}
.MsoNormal {
margin: 0 0 0 0;
}
o {
font-size: 0;
}
#photos div {
float: left;
width: 72px;
}
#photos div div {
border: 1px solid #666666;
height: 62px;
overflow: hidden;
width: 62px;
}
#photos div label {
color: #666666;
font-size: 10px;
overflow: hidden;
text-align: center;
white-space: nowrap;
width: 64px;
}
#reco-category {
font-size: 77%;
}
#reco-desc {
font-size: 77%;
}
.replbq {
margin: 4px;
}
#ygrp-actbar div a:first-child {
/* border-right: 0px solid #000;*/
margin-right: 2px;
padding-right: 5px;
}
#ygrp-mlmsg {
font-size: 13px;
font-family: Arial, helvetica,clean, sans-serif;
*font-size: small;
*font: x-small;
}
#ygrp-mlmsg table {
font-size: inherit;
font: 100%;
}
#ygrp-mlmsg select, input, textarea {
font: 99% Arial, Helvetica, clean, sans-serif;
}
#ygrp-mlmsg pre, code {
font:115% monospace;
*font-size:100%;
}
#ygrp-mlmsg * {
line-height: 1.22em;
}
#ygrp-mlmsg #logo {
padding-bottom: 10px;
}
#ygrp-mlmsg a {
color: #1E66AE;
}
#ygrp-msg p a {
font-family: Verdana;
}
#ygrp-msg p#attach-count span {
color: #1E66AE;
font-weight: 700;
}
#ygrp-reco #reco-head {
color: #ff7900;
font-weight: 700;
}
#ygrp-reco {
margin-bottom: 20px;
padding: 0px;
}
#ygrp-sponsor #ov li a {
font-size: 130%;
text-decoration: none;
}
#ygrp-sponsor #ov li {
font-size: 77%;
list-style-type: square;
padding: 6px 0;
}
#ygrp-sponsor #ov ul {
margin: 0;
padding: 0 0 0 8px;
}
#ygrp-text {
font-family: Georgia;
}
#ygrp-text p {
margin: 0 0 1em 0;
}
#ygrp-text tt {
font-size: 120%;
}
#ygrp-vital ul li:last-child {
border-right: none !important;
}
-->
</style>
</head>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->
--Apple-Mail=_5B580A46-2D19-4960-A1BB-E5BBBBCE086A--