Re: userrights for localfs_command - verbose security unauthorized exception

"Niels Dettenbach (Syndicat IT&Internet)" <[email protected]> Fri, 20 Apr 2012 10:33:28 +0200
Newsgroups	gmane.comp.cms.zms.devel
Message-ID	<[email protected]>
--cjgWfts3ZzDJ9MQduUbM74kug3umGBfDJLKOSIt
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256



Thorsten Weber <[email protected]> schrieb:

>> > <dtml-let
>xml_text=3D"http_import('http://myObj_url/FS_home.xml?prerender=3Dtrue&ran=
d=3D'+ZopeTime().strftime('%Y%m%d%H%M%S'))"
>> > path=3D"'/srv/project/virtualenv/xml/'">
>> >
>> > <dtml-if xml_text>
>> > <dtml-comment> -- // write FS_Home.xml to disk // --
></dtml-comment>
>> > <dtml-call "localfs_write(path+'FS_home.xml',xml_text,mode=3D'b')">
>> > </dtml-if>
>> >
>> > <dtml-comment> -- // remove FS_Home.xml from Squid cache // --
></dtml-comment>
>> > <dtml-call "localfs_command('/usr/bin/squidclient -h 85.25.124.231
>-p 80 -m PURGE http://myObj_url/FS_home.xml')">
>> >
>> > </dtml-let>

...just a small btw:
I usually put such things which must hardly/directly interact with the loca=
l OS and/or fetching external ressources into my own External Methods by pl=
anning/checking the code against any (more or less) "thinkable" security im=
plications, especially by offered parameters etc..

On the other hand - i did not understand why (if i read right) your XML has=
 to get into a local filesystem and not a typical Zope object (file or simi=
liar). Local FS (from my view) makes only sense i.e. for store large file b=
ases and to interact with a Filesystem if really required. As you xml seems=
 small i can't get it really here... =C3=9F)


May be that helps here too in any way...



best regards,


Niels.

- --
Niels Dettenbach
Syndicat IT&Internet
http://www.syndicat.com
-----BEGIN PGP SIGNATURE-----
Version: APG v1.0.8

iIEEAREIAEEFAk+RH1g6HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu
dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDf2QAJ9xetqSkDx3
Ajx8zINPYYysekfGxQCeLUVNcRjQsCPdzC/Y+rlir/Vbsfw=3D
=3DKSnp
-----END PGP SIGNATURE-----


--cjgWfts3ZzDJ9MQduUbM74kug3umGBfDJLKOSIt
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable




<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/htm=
l4/strict.dtd">
<html>
<head>
</head>







<body style=3D"background-color: #fff;">
<span style=3D"display:none">&nbsp;</span>

<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id=3D"ygrp-mlmsg" style=3D"position:relative;">
  <div id=3D"ygrp-msg" style=3D"z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->

    <div id=3D"ygrp-text" >
=20=20=20=20=20=20
=20=20=20=20=20=20
      <p>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Thorsten Weber &lt;<a href=3D"mailto:tweber%40proinspace.de">tweber@proinsp=
ace.de</a>&gt; schrieb:<br>
<br>
&gt;&gt; &gt; &lt;dtml-let<br>
&gt;xml_text=3D&quot;http_import('<a href=3D"http://myObj_url/FS_home.xml?p=
rerender=3Dtrue&amp;rand=3D">http://myObj_url/FS_home.xml?prerender=3Dtrue&=
amp;rand=3D</a>'&#43;ZopeTime().strftime('%Y%m%d%H%M%S'))&quot;<br>
&gt;&gt; &gt; path=3D&quot;'/srv/project/virtualenv/xml/'&quot;&gt;<br>
&gt;&gt; &gt;<br>
&gt;&gt; &gt; &lt;dtml-if xml_text&gt;<br>
&gt;&gt; &gt; &lt;dtml-comment&gt; -- // write FS_Home.xml to disk // --<br=
>
&gt;&lt;/dtml-comment&gt;<br>
&gt;&gt; &gt; &lt;dtml-call &quot;localfs_write(path+'FS_home.xml',xml_text=
,mode=3D'b')&quot;&gt;<br>
&gt;&gt; &gt; &lt;/dtml-if&gt;<br>
&gt;&gt; &gt;<br>
&gt;&gt; &gt; &lt;dtml-comment&gt; -- // remove FS_Home.xml from Squid cach=
e // --<br>
&gt;&lt;/dtml-comment&gt;<br>
&gt;&gt; &gt; &lt;dtml-call &quot;localfs_command('/usr/bin/squidclient -h =
85.25.124.231<br>
&gt;-p 80 -m PURGE <a href=3D"http://myObj_url/FS_home.xml">http://myObj_ur=
l/FS_home.xml</a>')&quot;&gt;<br>
&gt;&gt; &gt;<br>
&gt;&gt; &gt; &lt;/dtml-let&gt;<br>
<br>
...just a small btw:<br>
I usually put such things which must hardly/directly interact with the loca=
l OS and/or fetching external ressources into my own External Methods by pl=
anning/checking the code against any (more or less) &quot;thinkable&quot; s=
ecurity implications, especially by offered parameters etc..<br>
<br>
On the other hand - i did not understand why (if i read right) your XML has=
 to get into a local filesystem and not a typical Zope object (file or simi=
liar). Local FS (from my view) makes only sense i.e. for store large file b=
ases and to interact with a Filesystem if really required. As you xml seems=
 small i can't get it really here... =C3=9F)<br>
<br>
May be that helps here too in any way...<br>
<br>
best regards,<br>
<br>
Niels.<br>
<br>
- --<br>
Niels Dettenbach<br>
Syndicat IT&amp;Internet<br>
<a href=3D"http://www.syndicat.com">http://www.syndicat.com</a><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: APG v1.0.8<br>
<br>
iIEEAREIAEEFAk&#43;RH1g6HE5pZWxzIERldHRlbmJhY2ggKFN5bmRpY2F0IElUJklu<br>
dGVybmV0KSA8bmRAc3luZGljYXQuY29tPgAKCRBU3ERlZRyiDf2QAJ9xetqSkDx3<br>
Ajx8zINPYYysekfGxQCeLUVNcRjQsCPdzC/Y&#43;rlir/Vbsfw=3D<br>
=3DKSnp<br>
-----END PGP SIGNATURE-----<br>
<br>
</p>

    </div>
=20=20=20=20=20

    <!--~-|**|PrettyHtmlStart|**|-~-->
    <div style=3D"color: #fff; height: 0;">__._,_.___</div>

=20=20=20=20=20=20=20=20
=20=20
=20=20=20
    <div id=3D"ygrp-actbar" style=3D"clear: both; margin-bottom: 10px; whit=
e-space: nowrap; color: #666; padding-top: 15px;">
      <div>
        <a href=3D"mailto:[email protected]?subject=3DRe%3A%20%5Bzms-develope=
rs%5D%20userrights%20for%20localfs_command%20-%20verbose%20security%20unaut=
horized%20exception" style=3D"margin-right: 0; padding-right: 0;">
	  Reply to <span style=3D"font-weight: 700;">sender</span></a> |
        <a href=3D"mailto:[email protected]?subject=3DRe%3A%20=
%5Bzms-developers%5D%20userrights%20for%20localfs_command%20-%20verbose%20s=
ecurity%20unauthorized%20exception">
	  Reply to <span style=3D"font-weight: 700;">group</span></a> |
        	  <a href=3D"http://groups.yahoo.com/group/zms-developers/post;_yl=
c=3DX3oDMTJwazZhcjVqBF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3Mjg=
xOTQyBG1zZ0lkAzM3ODUEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzM0OTExMzQw?act=3Drep=
ly&messageNum=3D3785">Reply <span style=3D"font-weight: 700;">via web post<=
/span></a> |
            	<a href=3D"http://groups.yahoo.com/group/zms-developers/post;_=
ylc=3DX3oDMTJlOTNvNGQ4BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3M=
jgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMzNDkxMTM0MA--" style=3D"font-weig=
ht: 700;">Start a New Topic</a>
      </div>

                <a href=3D"http://groups.yahoo.com/group/zms-developers/mes=
sage/3770;_ylc=3DX3oDMTM0NWdzanQ3BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3=
BJZAMxNzA3MjgxOTQyBG1zZ0lkAzM3ODUEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzM0OTExM=
zQwBHRwY0lkAzM3NzA-">Messages in this topic</a>
          (<span style=3D"font-weight: 700;">16</span>)
          </div>=20
<!------- Start Nav Bar ------>

<!-- |**|begin egp html banner|**| -->
<div id=3D"ygrp-vital" style=3D"background-color: #e0ecee; font-family: Ver=
dana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
      <span id=3D"vithd" style=3D"font-weight: bold; color: #333; text-tran=
sform: uppercase; ">Recent Activity:</span>

    <ul style=3D"list-style-type: none; margin: 0; padding: 0; display: inl=
ine;">
                                                    </ul>
=20=20=20=20
  <div style=3D"clear: both; padding-top: 2px; color: #1e66ae;">
    <a href=3D"http://groups.yahoo.com/group/zms-developers;_ylc=3DX3oDMTJl=
NDhudXQ2BF9TAzk3MzU5NzE0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN=
2dGwEc2xrA3ZnaHAEc3RpbWUDMTMzNDkxMTM0MA--" style=3D"text-decoration: none;"=
>Visit Your Group</a>
  </div>
</div>

=20=20
<div id=3D"ft" style=3D"font-family: Arial; font-size: 11px; margin-top: 5p=
x; padding: 0 2px 0 0; clear: both;">
  <a href=3D"http://groups.yahoo.com/;_ylc=3DX3oDMTJkdnU3MjUwBF9TAzk3MzU5Nz=
E0BGdycElkAzg0NzA4MjEEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZ=
QMxMzM0OTExMzQw" style=3D"float: left;"><img src=3D"http://l.yimg.com/a/i/u=
s/yg/logo/us.gif" height=3D"15" width=3D"137" alt=3D"Yahoo! Groups" style=
=3D"border: 0;"/></a>
  <div style=3D"color: #747575; float: right;">Switch to: <a href=3D"mailto=
:[email protected]?subject=3DChange Delivery Forma=
t: Traditional" style=3D"text-decoration: none;">Text-Only</a>, <a href=3D"=
mailto:[email protected]?subject=3DEmail Delivery: Dige=
st" class=3D"margin-rt" style=3D"text-decoration: none;">Daily Digest</a> &=
bull; <a href=3D"mailto:[email protected]?subject=
=3DUnsubscribe" style=3D"text-decoration: none;">Unsubscribe</a> &bull; <a =
href=3D"http://docs.yahoo.com/info/terms/" style=3D"text-decoration: none;"=
>Terms of Use</a></div>
</div>

<!-- |**|end egp html banner|**| -->

  </div> <!-- ygrp-msg -->

  <!-- Sponsor -->
  <!-- |**|begin egp html banner|**| -->
  <div id=3D"ygrp-sponsor" style=3D"width:160px; float:right; clear:none; m=
argin:0 0 25px 0; background: #fff;">

<!-- Start Recommendations -->
<div id=3D"ygrp-reco">
     </div>
<!-- End Recommendations -->



  </div>   <!-- |**|end egp html banner|**| -->

  <div style=3D"clear:both; color: #FFF; font-size:1px;">.</div>
</div>

  <img src=3D"http://geo.yahoo.com/serv?s=3D97359714/grpId=3D8470821/grpspI=
d=3D1707281942/msgId=3D3785/stime=3D1334911340/nc1=3D4836041/nc2=3D4507179/=
nc3=3D3848643" width=3D"1" height=3D"1"> <br>

<div style=3D"color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->

</body>

<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
  <style type=3D"text/css">
  <!--
  #ygrp-mkp {
  border: 1px solid #d8d8d8;
  font-family: Arial;
  margin: 10px 0;
  padding: 0 10px;
}

#ygrp-mkp hr {
  border: 1px solid #d8d8d8;
}

#ygrp-mkp #hd {
  color: #628c2a;
  font-size: 85%;
  font-weight: 700;
  line-height: 122%;
  margin: 10px 0;
}

#ygrp-mkp #ads {
  margin-bottom: 10px;
}

#ygrp-mkp .ad {
  padding: 0 0;
}

#ygrp-mkp .ad p {
  margin: 0;
}

#ygrp-mkp .ad a {
  color: #0000ff;
  text-decoration: none;
}
  #ygrp-sponsor #ygrp-lc {
  font-family: Arial;
}

#ygrp-sponsor #ygrp-lc #hd {
  margin: 10px 0px;
  font-weight: 700;
  font-size: 78%;
  line-height: 122%;
}

#ygrp-sponsor #ygrp-lc .ad {
  margin-bottom: 10px;
  padding: 0 0;
}

  a {
    color: #1e66ae;
  }

  #actions {
    font-family: Verdana;
    font-size: 11px;
    padding: 10px 0;
  }

  #activity {
    background-color: #e0ecee;
    float: left;
    font-family: Verdana;
    font-size: 10px;
    padding: 10px;
  }

  #activity span {
    font-weight: 700;
  }

  #activity span:first-child {
    text-transform: uppercase;
  }

  #activity span a {
    color: #5085b6;
    text-decoration: none;
  }

  #activity span span {
    color: #ff7900;
  }

  #activity span .underline {
    text-decoration: underline;
  }

  .attach {
    clear: both;
    display: table;
    font-family: Arial;
    font-size: 12px;
    padding: 10px 0;
    width: 400px;
  }

  .attach div a {
    text-decoration: none;
  }

  .attach img {
    border: none;
    padding-right: 5px;
  }

  .attach label {
    display: block;
    margin-bottom: 5px;
  }

  .attach label a {
    text-decoration: none;
  }
=20=20
  blockquote {
    margin: 0 0 0 4px;
  }

  .bold {
    font-family: Arial;
    font-size: 13px;
    font-weight: 700;
  }

  .bold a {
    text-decoration: none;
  }

  dd.last p a {
    font-family: Verdana;
    font-weight: 700;
  }

  dd.last p span {
    margin-right: 10px;
    font-family: Verdana;
    font-weight: 700;
  }

  dd.last p span.yshortcuts {
    margin-right: 0;
  }

  div.attach-table div div a {
    text-decoration: none;
  }

  div.attach-table {
    width: 400px;
  }

  div.file-title a, div.file-title a:active, div.file-title a:hover, div.fi=
le-title a:visited {
    text-decoration: none;
  }

  div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div=
.photo-title a:visited {
    text-decoration: none;
  }

  div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
    font-family: Verdana;
    font-size: 10px;
    font-weight: normal;
  }

  .green {
    color: #628c2a;
  }

  .MsoNormal {
    margin: 0 0 0 0;
  }

  o {
    font-size: 0;
  }

  #photos div {
    float: left;
    width: 72px;
  }

  #photos div div {
    border: 1px solid #666666;
    height: 62px;
    overflow: hidden;
    width: 62px;
  }

  #photos div label {
    color: #666666;
    font-size: 10px;
    overflow: hidden;
    text-align: center;
    white-space: nowrap;
    width: 64px;
  }

  #reco-category {
    font-size: 77%;
  }

  #reco-desc {
    font-size: 77%;
  }

  .replbq {
    margin: 4px;
  }

  #ygrp-actbar div a:first-child {
   /* border-right: 0px solid #000;*/
    margin-right: 2px;
    padding-right: 5px;
  }

  #ygrp-mlmsg {
    font-size: 13px;
    font-family: Arial, helvetica,clean, sans-serif;
    *font-size: small;
    *font: x-small;
  }

  #ygrp-mlmsg table {
    font-size: inherit;
    font: 100%;
  }

  #ygrp-mlmsg select, input, textarea {
    font: 99% Arial, Helvetica, clean, sans-serif;
  }

  #ygrp-mlmsg pre, code {
    font:115% monospace;
    *font-size:100%;
  }

  #ygrp-mlmsg * {
    line-height: 1.22em;
  }

  #ygrp-mlmsg #logo {
    padding-bottom: 10px;
  }

  #ygrp-mlmsg a {
    color: #1E66AE;
  }

  #ygrp-msg p a {
    font-family: Verdana;
  }

  #ygrp-msg p#attach-count span {
    color: #1E66AE;
    font-weight: 700;
  }

  #ygrp-reco #reco-head {
    color: #ff7900;
    font-weight: 700;
  }

  #ygrp-reco {
    margin-bottom: 20px;
    padding: 0px;
  }

  #ygrp-sponsor #ov li a {
    font-size: 130%;
    text-decoration: none;
  }

  #ygrp-sponsor #ov li {
    font-size: 77%;
    list-style-type: square;
    padding: 6px 0;
  }=20

  #ygrp-sponsor #ov ul {
    margin: 0;
    padding: 0 0 0 8px;
  }

  #ygrp-text {
    font-family: Georgia;
  }

  #ygrp-text p {
    margin: 0 0 1em 0;
  }

  #ygrp-text tt {
    font-size: 120%;
  }

  #ygrp-vital ul li:last-child {
    border-right: none !important;=20
  }=20
  -->
  </style>
</head>

<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->


--cjgWfts3ZzDJ9MQduUbM74kug3umGBfDJLKOSIt--