Re: userrights for localfs_command
"Sascha Gottfried" <[email protected]> Tue, 03 Apr 2012 22:52:07 -0000
| Newsgroups | gmane.comp.cms.zms.devel |
|---|---|
| Message-ID | <[email protected]> |
--25wzZUFhSQu1LBPm0hHyv6TNB01H0TdFWCBwe27 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Niels, your comparison of zope proxy roles with unix suid made me really curious. = I need to think about what I read online. A difference is definitely that a linux application/script in the filesyste= m is not available to unauthorized users. A Zope python script COULD be ava= ilable to unauthorized users per direct URL traversal.=20 http://your_zope_root/path_to_zms/content/proxy_roled_script?param1=3Dvalue= 1 I think a python script that evaluates parameters from the request is even = more dangerous if proxy roled as manager. A developer needs to make careful= assertions on the values provided to this script or at least manage access= control to this script. Anyway, I am waiting for Thorsten submitting his traceback. Sascha --- In [email protected], "Niels Dettenbach (Syndicat IT&Inter= net)" <nd@...> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 >=20 >=20 >=20 > Sascha Gottfried <sascha.gottfried@...> schrieb: >=20 > >ZMS 2.12.1 (more specific: class ZMSGlobals.py) offered the method > >'localfs_command' as a public method without requiring any permission > >from the user/context to call it. As of today this method is not > >available anymore as a result of a former security review. >=20 > Ok, this - shurely - did not makes sense from a security perspective view= and disabling that was the right way to react here. My recommendations was= targeting a more general level. Proxy roles could be widely compared to un= ix suid - which could be very helpful but very dangerous if you handle it n= ot wisely... >=20 >=20 > >@Nils: I accidently addressed the last answer to you. > ahh, mhhmkay - no prob... =C3=9F) >=20 > But anyhow, your detailed explanation about localfs-command within ZMS wa= s very interesting and helpful too. >=20 > Many thanks and have a nice evening, >=20 >=20 > Niels. >=20 > - -- > Niels Dettenbach > Syndicat IT&Internet > http://www.syndicat.com > -----BEGIN PGP SIGNATURE----- > Version: APG v1.0.8 >=20 > iIEEAREIAEEFAk97K+k6HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu > dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDQ41AJ9eEgzgkN5O > W7NB/2iUO6tllUybtgCcD9rVVAgr/TnEolMwjr1r+R5jviA=3D > =3DNKK7 > -----END PGP SIGNATURE----- > --25wzZUFhSQu1LBPm0hHyv6TNB01H0TdFWCBwe27 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/htm= l4/strict.dtd"> <html> <head> </head> <body style=3D"background-color: #fff;"> <span style=3D"display:none"> </span> <!--~-|**|PrettyHtmlStartT|**|-~--> <div id=3D"ygrp-mlmsg" style=3D"position:relative;"> <div id=3D"ygrp-msg" style=3D"z-index: 1;"> <!--~-|**|PrettyHtmlEndT|**|-~--> <div id=3D"ygrp-text" > =20=20=20=20=20=20 =20=20=20=20=20=20 <p>Hi Niels,<br> your comparison of zope proxy roles with unix suid made me really curious. = I need to think about what I read online.<br> <br> A difference is definitely that a linux application/script in the filesyste= m is not available to unauthorized users. A Zope python script COULD be ava= ilable to unauthorized users per direct URL traversal. <br> <br> <a href=3D"http://your_zope_root/path_to_zms/content/proxy_roled_script?par= am1=3Dvalue1">http://your_zope_root/path_to_zms/content/proxy_roled_script?= param1=3Dvalue1</a><br> <br> I think a python script that evaluates parameters from the request is even = more dangerous if proxy roled as manager. A developer needs to make careful= assertions on the values provided to this script or at least manage access= control to this script.<br> <br> Anyway, I am waiting for Thorsten submitting his traceback.<br> <br> Sascha<br> <br> --- In <a href=3D"mailto:zms-developers%40yahoogroups.com">zms-developers@y= ahoogroups.com</a>, "Niels Dettenbach (Syndicat IT&Internet)"= <nd@...> wrote:<br> ><br> > -----BEGIN PGP SIGNED MESSAGE-----<br> > Hash: SHA256<br> > <br> > <br> > <br> > Sascha Gottfried <sascha.gottfried@...> schrieb:<br> > <br> > >ZMS 2.12.1 (more specific: class ZMSGlobals.py) offered the method= <br> > >'localfs_command' as a public method without requiring any permis= sion<br> > >from the user/context to call it. As of today this method is not<b= r> > >available anymore as a result of a former security review.<br> > <br> > Ok, this - shurely - did not makes sense from a security perspective v= iew and disabling that was the right way to react here. My recommendations = was targeting a more general level. Proxy roles could be widely compared to= unix suid - which could be very helpful but very dangerous if you handle i= t not wisely...<br> > <br> > <br> > >@Nils: I accidently addressed the last answer to you.<br> > ahh, mhhmkay - no prob... =C3=9F)<br> > <br> > But anyhow, your detailed explanation about localfs-command within ZMS= was very interesting and helpful too.<br> > <br> > Many thanks and have a nice evening,<br> > <br> > <br> > Niels.<br> > <br> > - --<br> > Niels Dettenbach<br> > Syndicat IT&Internet<br> > <a href=3D"http://www.syndicat.com">http://www.syndicat.com</a><br> > -----BEGIN PGP SIGNATURE-----<br> > Version: APG v1.0.8<br> > <br> > iIEEAREIAEEFAk97K+k6HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu<b= r> > dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDQ41AJ9eEgzgkN5O<br> > W7NB/2iUO6tllUybtgCcD9rVVAgr/TnEolMwjr1r+R5jviA=3D<br> > =3DNKK7<br> > -----END PGP SIGNATURE-----<br> ><br> <br> </p> </div> =20=20=20=20=20 <!--~-|**|PrettyHtmlStart|**|-~--> <div style=3D"color: #fff; height: 0;">__._,_.___</div> =20=20=20=20=20=20=20=20 =20=20 =20=20=20 <div id=3D"ygrp-actbar" style=3D"clear: both; margin-bottom: 10px; whit= e-space: nowrap; color: #666; padding-top: 15px;"> <div> <a href=3D"mailto:[email protected]?subject=3DRe%3A%20user= rights%20for%20localfs_command" style=3D"margin-right: 0; padding-right: 0;= "> Reply to <span style=3D"font-weight: 700;">sender</span></a> | <a href=3D"mailto:[email protected]?subject=3DRe%3A%20= userrights%20for%20localfs_command"> Reply to <span style=3D"font-weight: 700;">group</span></a> | <a href=3D"http://groups.yahoo.com/group/zms-developers/post;_yl= c=3DX3oDMTJwNWg1ajhuBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3Mjg= xOTQyBG1zZ0lkAzM3NzgEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzMzNTI2MzU3?act=3Drep= ly&messageNum=3D3778">Reply <span style=3D"font-weight: 700;">via web post<= /span></a> | <a href=3D"http://groups.yahoo.com/group/zms-developers/post;_= ylc=3DX3oDMTJlbm8za282BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3M= jgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMzMzUyNjM1Nw--" style=3D"font-weig= ht: 700;">Start a New Topic</a> </div> <a href=3D"http://groups.yahoo.com/group/zms-developers/mes= sage/3770;_ylc=3DX3oDMTM0M25jb3M3BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3= BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3NzgEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzMzNTI2M= zU3BHRwY0lkAzM3NzA-">Messages in this topic</a> (<span style=3D"font-weight: 700;">9</span>) </div>=20 <!------- Start Nav Bar ------> <!-- |**|begin egp html banner|**| --> <div id=3D"ygrp-vital" style=3D"background-color: #e0ecee; font-family: Ver= dana; font-size: 10px; margin-bottom: 10px; padding: 10px;"> <span id=3D"vithd" style=3D"font-weight: bold; color: #333; text-tran= sform: uppercase; ">Recent Activity:</span> <ul style=3D"list-style-type: none; margin: 0; padding: 0; display: inl= ine;"> </ul> =20=20=20=20 <div style=3D"clear: both; padding-top: 2px; color: #1e66ae;"> <a href=3D"http://groups.yahoo.com/group/zms-developers;_ylc=3DX3oDMTJl= N2dvNXFsBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN= 2dGwEc2xrA3ZnaHAEc3RpbWUDMTMzMzUyNjM1Nw--" style=3D"text-decoration: none;"= >Visit Your Group</a> </div> </div> =20=20 <div id=3D"ft" style=3D"font-family: Arial; font-size: 11px; margin-top: 5p= x; padding: 0 2px 0 0; clear: both;"> <a href=3D"http://groups.yahoo.com/;_ylc=3DX3oDMTJkc3Y5dmV2BF9TAzk3MzU5Nz= E0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZ= QMxMzMzNTI2MzU3" style=3D"float: left;"><img src=3D"http://l.yimg.com/a/i/u= s/yg/logo/us.gif" height=3D"15" width=3D"137" alt=3D"Yahoo! Groups" style= =3D"border: 0;"/></a> <div style=3D"color: #747575; float: right;">Switch to: <a href=3D"mailto= :[email protected]?subject=3DChange Delivery Forma= t: Traditional" style=3D"text-decoration: none;">Text-Only</a>, <a href=3D"= mailto:[email protected]?subject=3DEmail Delivery: Dige= st" class=3D"margin-rt" style=3D"text-decoration: none;">Daily Digest</a> &= bull; <a href=3D"mailto:[email protected]?subject= =3DUnsubscribe" style=3D"text-decoration: none;">Unsubscribe</a> • <a = href=3D"http://docs.yahoo.com/info/terms/" style=3D"text-decoration: none;"= >Terms of Use</a></div> </div> <!-- |**|end egp html banner|**| --> </div> <!-- ygrp-msg --> <!-- Sponsor --> <!-- |**|begin egp html banner|**| --> <div id=3D"ygrp-sponsor" style=3D"width:160px; float:right; clear:none; m= argin:0 0 25px 0; background: #fff;"> <!-- Start Recommendations --> <div id=3D"ygrp-reco"> </div> <!-- End Recommendations --> </div> <!-- |**|end egp html banner|**| --> <div style=3D"clear:both; color: #FFF; font-size:1px;">.</div> </div> <img src=3D"http://geo.yahoo.com/serv?s=3D97359714/grpId=3D8470821/grpspI= d=3D1707281942/msgId=3D3778/stime=3D1333526357/nc1=3D5191952/nc2=3D4507179/= nc3=3D3848640" width=3D"1" height=3D"1"> <br> <div style=3D"color: #fff; height: 0;">__,_._,___</div> <!--~-|**|PrettyHtmlEnd|**|-~--> </body> <!--~-|**|PrettyHtmlStart|**|-~--> <head> <style type=3D"text/css"> <!-- #ygrp-mkp { border: 1px solid #d8d8d8; font-family: Arial; margin: 10px 0; padding: 0 10px; } #ygrp-mkp hr { border: 1px solid #d8d8d8; } #ygrp-mkp #hd { color: #628c2a; font-size: 85%; font-weight: 700; line-height: 122%; margin: 10px 0; } #ygrp-mkp #ads { margin-bottom: 10px; } #ygrp-mkp .ad { padding: 0 0; } #ygrp-mkp .ad p { margin: 0; } #ygrp-mkp .ad a { color: #0000ff; text-decoration: none; } #ygrp-sponsor #ygrp-lc { font-family: Arial; } #ygrp-sponsor #ygrp-lc #hd { margin: 10px 0px; font-weight: 700; font-size: 78%; line-height: 122%; } #ygrp-sponsor #ygrp-lc .ad { margin-bottom: 10px; padding: 0 0; } a { color: #1e66ae; } #actions { font-family: Verdana; font-size: 11px; padding: 10px 0; } #activity { background-color: #e0ecee; float: left; font-family: Verdana; font-size: 10px; padding: 10px; } #activity span { font-weight: 700; } #activity span:first-child { text-transform: uppercase; } #activity span a { color: #5085b6; text-decoration: none; } #activity span span { color: #ff7900; } #activity span .underline { text-decoration: underline; } .attach { clear: both; display: table; font-family: Arial; font-size: 12px; padding: 10px 0; width: 400px; } .attach div a { text-decoration: none; } .attach img { border: none; padding-right: 5px; } .attach label { display: block; margin-bottom: 5px; } .attach label a { text-decoration: none; } =20=20 blockquote { margin: 0 0 0 4px; } .bold { font-family: Arial; font-size: 13px; font-weight: 700; } .bold a { text-decoration: none; } dd.last p a { font-family: Verdana; font-weight: 700; } dd.last p span { margin-right: 10px; font-family: Verdana; font-weight: 700; } dd.last p span.yshortcuts { margin-right: 0; } div.attach-table div div a { text-decoration: none; } div.attach-table { width: 400px; } div.file-title a, div.file-title a:active, div.file-title a:hover, div.fi= le-title a:visited { text-decoration: none; } div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div= .photo-title a:visited { text-decoration: none; } div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts { font-family: Verdana; font-size: 10px; font-weight: normal; } .green { color: #628c2a; } .MsoNormal { margin: 0 0 0 0; } o { font-size: 0; } #photos div { float: left; width: 72px; } #photos div div { border: 1px solid #666666; height: 62px; overflow: hidden; width: 62px; } #photos div label { color: #666666; font-size: 10px; overflow: hidden; text-align: center; white-space: nowrap; width: 64px; } #reco-category { font-size: 77%; } #reco-desc { font-size: 77%; } .replbq { margin: 4px; } #ygrp-actbar div a:first-child { /* border-right: 0px solid #000;*/ margin-right: 2px; padding-right: 5px; } #ygrp-mlmsg { font-size: 13px; font-family: Arial, helvetica,clean, sans-serif; *font-size: small; *font: x-small; } #ygrp-mlmsg table { font-size: inherit; font: 100%; } #ygrp-mlmsg select, input, textarea { font: 99% Arial, Helvetica, clean, sans-serif; } #ygrp-mlmsg pre, code { font:115% monospace; *font-size:100%; } #ygrp-mlmsg * { line-height: 1.22em; } #ygrp-mlmsg #logo { padding-bottom: 10px; } #ygrp-mlmsg a { color: #1E66AE; } #ygrp-msg p a { font-family: Verdana; } #ygrp-msg p#attach-count span { color: #1E66AE; font-weight: 700; } #ygrp-reco #reco-head { color: #ff7900; font-weight: 700; } #ygrp-reco { margin-bottom: 20px; padding: 0px; } #ygrp-sponsor #ov li a { font-size: 130%; text-decoration: none; } #ygrp-sponsor #ov li { font-size: 77%; list-style-type: square; padding: 6px 0; }=20 #ygrp-sponsor #ov ul { margin: 0; padding: 0 0 0 8px; } #ygrp-text { font-family: Georgia; } #ygrp-text p { margin: 0 0 1em 0; } #ygrp-text tt { font-size: 120%; } #ygrp-vital ul li:last-child { border-right: none !important;=20 }=20 --> </style> </head> <!--~-|**|PrettyHtmlEnd|**|-~--> </html> <!-- end group email --> --25wzZUFhSQu1LBPm0hHyv6TNB01H0TdFWCBwe27--