| *** sp0cksbeard has quit IRC | 00:01 | |
| *** ViicT has quit IRC | 00:11 | |
| *** J1m has quit IRC | 00:54 | |
| *** alecm has quit IRC | 01:01 | |
| *** alecm has joined #zope | 01:01 | |
| *** alecm has joined #zope | 01:01 | |
| *** TresEquis has quit IRC | 01:21 | |
| *** evilbungle has quit IRC | 01:22 | |
| *** TomBlockley has quit IRC | 01:22 | |
| *** Arfrever has quit IRC | 01:35 | |
| *** kiorky_ has quit IRC | 01:57 | |
| *** kiorky_ has joined #zope | 01:58 | |
| *** alexpilz has quit IRC | 02:15 | |
| *** alexpilz1 has joined #zope | 02:15 | |
| *** rockfruit has quit IRC | 02:21 | |
| *** alga has quit IRC | 02:33 | |
| *** MrTango has quit IRC | 02:44 | |
| *** ccomb has quit IRC | 02:56 | |
| *** daMaestro has quit IRC | 02:57 | |
| *** purserj has quit IRC | 03:09 | |
| *** tote has quit IRC | 03:09 | |
| *** yac has quit IRC | 03:09 | |
| *** f10w has quit IRC | 03:09 | |
| *** cwarner has quit IRC | 03:09 | |
| *** raydeo has quit IRC | 03:09 | |
| *** CIA-90 has quit IRC | 03:09 | |
| *** kiorky_ has quit IRC | 03:09 | |
| *** jham has quit IRC | 03:09 | |
| *** bigkevmcd has quit IRC | 03:09 | |
| *** allisterb has quit IRC | 03:09 | |
| *** mitchell`off has quit IRC | 03:09 | |
| *** gawel has quit IRC | 03:09 | |
| *** mgedmin has quit IRC | 03:09 | |
| *** alecm has quit IRC | 03:09 | |
| *** supton has quit IRC | 03:09 | |
| *** [Arfrever] has quit IRC | 03:09 | |
| *** ajmitch has quit IRC | 03:09 | |
| *** dixond has quit IRC | 03:09 | |
| *** zenwryly has quit IRC | 03:09 | |
| *** tiwula has quit IRC | 03:09 | |
| *** kiorky has quit IRC | 03:09 | |
| *** River_Rat has quit IRC | 03:09 | |
| *** BGaddie has quit IRC | 03:09 | |
| *** markvandenborre has quit IRC | 03:09 | |
| *** kosh has quit IRC | 03:09 | |
| *** avn has quit IRC | 03:09 | |
| *** planetzopebot has quit IRC | 03:09 | |
| *** lewellyn has quit IRC | 03:09 | |
| *** rodgort has quit IRC | 03:09 | |
| *** BeeBob has quit IRC | 03:09 | |
| *** espent_ has quit IRC | 03:09 | |
| *** strichter has quit IRC | 03:09 | |
| *** chaoflow has quit IRC | 03:09 | |
| *** sm has quit IRC | 03:09 | |
| *** moo-_- has quit IRC | 03:09 | |
| *** do3cc_ has quit IRC | 03:09 | |
| *** betabug has quit IRC | 03:09 | |
| *** Spanktar has quit IRC | 03:09 | |
| *** mcdonc has quit IRC | 03:09 | |
| *** JT has quit IRC | 03:09 | |
| *** astoon has quit IRC | 03:09 | |
| *** waldi has quit IRC | 03:09 | |
| *** _mup_ has quit IRC | 03:09 | |
| *** kiorky_ has joined #zope | 03:13 | |
| *** alecm has joined #zope | 03:13 | |
| *** strichter has joined #zope | 03:13 | |
| *** Spanktar has joined #zope | 03:13 | |
| *** tiwula has joined #zope | 03:13 | |
| *** supton has joined #zope | 03:13 | |
| *** sm has joined #zope | 03:13 | |
| *** astoon has joined #zope | 03:13 | |
| *** avn has joined #zope | 03:13 | |
| *** planetzopebot has joined #zope | 03:13 | |
| *** bigkevmcd has joined #zope | 03:13 | |
| *** kiorky has joined #zope | 03:13 | |
| *** raydeo has joined #zope | 03:13 | |
| *** kosh has joined #zope | 03:13 | |
| *** zenwryly has joined #zope | 03:13 | |
| *** moo-_- has joined #zope | 03:13 | |
| *** waldi has joined #zope | 03:13 | |
| *** River_Rat has joined #zope | 03:13 | |
| *** BGaddie has joined #zope | 03:13 | |
| *** allisterb has joined #zope | 03:13 | |
| *** tote has joined #zope | 03:13 | |
| *** _mup_ has joined #zope | 03:13 | |
| *** [Arfrever] has joined #zope | 03:13 | |
| *** lewellyn has joined #zope | 03:13 | |
| *** yac has joined #zope | 03:13 | |
| *** ajmitch has joined #zope | 03:13 | |
| *** mitchell`off has joined #zope | 03:13 | |
| *** mcdonc has joined #zope | 03:13 | |
| *** purserj has joined #zope | 03:13 | |
| *** f10w has joined #zope | 03:13 | |
| *** rodgort has joined #zope | 03:13 | |
| *** do3cc_ has joined #zope | 03:13 | |
| *** CIA-90 has joined #zope | 03:13 | |
| *** cwarner has joined #zope | 03:13 | |
| *** BeeBob has joined #zope | 03:13 | |
| *** jham has joined #zope | 03:13 | |
| *** mgedmin has joined #zope | 03:13 | |
| *** gawel has joined #zope | 03:13 | |
| *** betabug has joined #zope | 03:13 | |
| *** markvandenborre has joined #zope | 03:13 | |
| *** espent_ has joined #zope | 03:13 | |
| *** chaoflow has joined #zope | 03:13 | |
| *** dixond has joined #zope | 03:13 | |
| *** JT has joined #zope | 03:13 | |
| *** Spanktar has quit IRC | 03:19 | |
| *** tiwula has quit IRC | 03:44 | |
| *** Spanktar has joined #zope | 04:33 | |
| *** River-Rat has joined #zope | 05:12 | |
| *** River_Rat has quit IRC | 05:14 | |
| *** dayne has joined #zope | 06:16 | |
| *** dayne has quit IRC | 06:24 | |
| *** astoon has quit IRC | 06:29 | |
| *** sm has quit IRC | 06:39 | |
| *** tiwula has joined #zope | 06:45 | |
| *** rfw has joined #zope | 07:16 | |
| *** rfwalrus has joined #zope | 07:24 | |
| *** rfwalrus has quit IRC | 07:24 | |
| *** rfwalrus has joined #zope | 07:24 | |
| *** rfw has quit IRC | 07:24 | |
| *** rfwalrus is now known as rfw | 07:24 | |
| *** cwarner_ has joined #zope | 07:25 | |
| *** cwarner has quit IRC | 07:27 | |
| *** tiwula has quit IRC | 08:48 | |
| *** zagy has joined #zope | 08:52 | |
| *** wosc has joined #zope | 08:53 | |
| *** __mac__ has joined #zope | 09:01 | |
| *** strichter has quit IRC | 09:08 | |
| *** hever has joined #zope | 09:18 | |
| *** alecm_ has joined #zope | 09:20 | |
| *** alecm_ has joined #zope | 09:20 | |
| *** hever has quit IRC | 09:20 | |
| *** hever has joined #zope | 09:22 | |
| *** tisto has joined #zope | 09:24 | |
| *** espent_ has quit IRC | 09:24 | |
| *** alecm has quit IRC | 09:25 | |
| *** alecm_ is now known as alecm | 09:25 | |
| *** espent has joined #zope | 09:25 | |
| *** MrTango has joined #zope | 09:48 | |
| *** Wu has joined #zope | 09:49 | |
| *** planetzopebot has quit IRC | 10:08 | |
| *** planetzopebot has joined #zope | 10:08 | |
| *** alga has joined #zope | 10:14 | |
| *** __mac__ has quit IRC | 10:16 | |
| *** menesis has joined #zope | 10:20 | |
| *** goschtl has joined #zope | 10:32 | |
| *** ccomb has joined #zope | 10:35 | |
| *** avoinea has joined #zope | 10:35 | |
| betabug | was anywhere mentioned which zope versions the security fix will affect? (the one coming out at 15:00UTC) | 10:36 |
|---|---|---|
| *** gwik has joined #zope | 10:40 | |
| *** kleist has joined #zope | 10:42 | |
| *** kfoo has joined #zope | 10:45 | |
| *** benji has joined #zope | 10:45 | |
| *** kfoo has left #zope | 10:46 | |
| bigkevmcd | betabug: "All recent versions of Zope are affected." isn't terribly helpful :-) | 10:50 |
| betabug | yeah, that's what I thought | 10:58 |
| *** espent has quit IRC | 10:58 | |
| *** espent has joined #zope | 10:59 | |
| *** __mac__ has joined #zope | 11:04 | |
| *** mitchell`off is now known as mitchell` | 11:09 | |
| *** ccomb has quit IRC | 11:15 | |
| *** mcdonc has quit IRC | 11:19 | |
| *** mcdonc has joined #zope | 11:20 | |
| *** menesis has quit IRC | 11:46 | |
| *** benji has quit IRC | 11:47 | |
| *** gwik has quit IRC | 11:48 | |
| *** gwik has joined #zope | 11:53 | |
| *** ccomb has joined #zope | 11:54 | |
| *** sylvain has joined #zope | 11:54 | |
| *** sunew has joined #zope | 11:54 | |
| *** TomBlockley has joined #zope | 12:00 | |
| planetzopebot | How to inject template code in Plone? (active questions tagged zope - Stack Overflow) http://stackoverflow.com/questions/6503861/how-to-inject-template-code-in-plone | 12:08 |
| *** gwik has quit IRC | 12:14 | |
| *** gwik has joined #zope | 12:16 | |
| *** alexpilz1 has left #zope | 12:20 | |
| *** TomBlockley has quit IRC | 12:24 | |
| *** TomBlockley has joined #zope | 12:24 | |
| *** __mac__1 has joined #zope | 12:27 | |
| *** __mac__ has quit IRC | 12:27 | |
| *** __mac__1 has quit IRC | 12:32 | |
| *** wosc has quit IRC | 12:32 | |
| *** sashav has joined #zope | 12:34 | |
| *** gwik has quit IRC | 12:38 | |
| *** gwik has joined #zope | 12:38 | |
| *** wosc has joined #zope | 12:39 | |
| *** teix has joined #zope | 12:44 | |
| *** menesis has joined #zope | 12:47 | |
| *** evilbungle has joined #zope | 12:50 | |
| *** eperez has joined #zope | 12:54 | |
| *** marche1990 has joined #zope | 12:55 | |
| marche1990 | Is there a newer MySQL adapter for zope than http://www.zope.org/Members/adustman/Products/ZMySQLDA ?? | 12:57 |
| *** marche1990 has quit IRC | 13:03 | |
| *** evilbungle has quit IRC | 13:06 | |
| *** evilbungle has joined #zope | 13:06 | |
| *** __mac__ has joined #zope | 13:07 | |
| *** benji has joined #zope | 13:08 | |
| *** __mac__ has quit IRC | 13:11 | |
| betabug | hmmm, not waiting even 15 minutes for an answer? great | 13:11 |
| mcdonc | double question marks at the end of a sentence means "i really want to know" | 13:35 |
| mcdonc | just in case you were wondering | 13:36 |
| betabug | yeah, but leaving right after would mean "I don't want to know really" | 13:36 |
| betabug | oh oh | 13:37 |
| betabug | sorry, that was for another # | 13:37 |
| *** __mac__ has joined #zope | 13:40 | |
| *** menesis has quit IRC | 13:47 | |
| *** J1m has joined #zope | 13:57 | |
| *** m8 has joined #zope | 13:57 | |
| *** rfw has quit IRC | 14:01 | |
| *** evilbungle has quit IRC | 14:12 | |
| *** menesis has joined #zope | 14:17 | |
| *** evilbungle has joined #zope | 14:18 | |
| *** tisto is now known as tisto|lunch | 14:20 | |
| *** hever has quit IRC | 14:24 | |
| *** dayne has joined #zope | 14:29 | |
| *** Spanktar has quit IRC | 14:45 | |
| *** Wu has quit IRC | 14:48 | |
| *** benji has quit IRC | 14:59 | |
| *** J1m has quit IRC | 14:59 | |
| *** gwik has left #zope | 15:00 | |
| *** kleist_ has joined #zope | 15:04 | |
| *** evilbungle is now known as evilbungle|out | 15:05 | |
| *** kleist has quit IRC | 15:08 | |
| *** victor_ has joined #zope | 15:14 | |
| *** victor_ has quit IRC | 15:14 | |
| *** victor_ has joined #zope | 15:14 | |
| *** victor_ is now known as ViicT | 15:14 | |
| *** tisto|lunch is now known as tisto | 15:28 | |
| *** strichter has joined #zope | 15:28 | |
| *** m8 has quit IRC | 15:32 | |
| *** eperez has quit IRC | 15:35 | |
| * kosh sets betabug on fire | 15:47 | |
| *** sp0cksbeard has joined #zope | 16:05 | |
| *** J1m has joined #zope | 16:08 | |
| *** evilbungle|out is now known as evilbungle | 16:10 | |
| betabug | "Zope 2.10 and 2.11 users who have not installed PloneHotfix20110720 are not affected by this vulnerability" | 16:13 |
| betabug | which probably means older versions will be fine too | 16:14 |
| kosh | it is interesting | 16:15 |
| kosh | that still means that most of my servers are probably affected since they are 2.12 but none run plone | 16:15 |
| betabug | reading in the tea leaves, seems to be something that went wrong with an older security hotfix | 16:15 |
| betabug | http://pypi.python.org/pypi/Products.PloneHotfix20110720/1.0 this one | 16:16 |
| kosh | what is also interesting is a mention of PluggableAuthService which is related to the same vulnerability | 16:16 |
| do3cc_ | betabug, is there a not too much? | 16:16 |
| betabug | do3cc_: what? | 16:16 |
| betabug | I bet the problem is in this part: "a patch to the ZPublisher to fix an issue with the checking of whether traversed methods are publishable" | 16:16 |
| betabug | do3cc_: I couldn't parse "is there a not too much?" | 16:17 |
| kosh | pretty good call on that one | 16:17 |
| do3cc_ | "Zope 2.10 and 2.11 users who have not installed PloneHotfix20110720 are not affected by this vulnerability" <- is there a not too much in this sentence? | 16:17 |
| betabug | do3cc_: no | 16:18 |
| betabug | to me this means that PloneHotfix20110720 introduced the bug | 16:18 |
| kosh | so no security hotfixes since august 2008 and now we get one because of a plone fix ;) | 16:19 |
| betabug | haha | 16:19 |
| betabug | *if* my theory is right - I might be totally off | 16:19 |
| do3cc_ | seeing the announcement now | 16:19 |
| do3cc_ | I'd bet a beer for it | 16:19 |
| kosh | the patch should be out in about 1 hour and 40 minutes | 16:20 |
| betabug | well, if 2.9 and 2.10 are not affected, I'm off the hook | 16:21 |
| betabug | another win for slacking | 16:22 |
| *** hever has joined #zope | 16:22 | |
| kosh | I went to 2.12 though because it was so much faster and blob support | 16:23 |
| kosh | it is amazing how secure older versions of zope are though | 16:24 |
| *** hever has quit IRC | 16:24 | |
| betabug | of course it might be that older versions are actually affected and "secrecy" or lack of interest in old stuff results in us not learning the details | 16:24 |
| kosh | can you imagine take any other older version of any other web framework and using that? | 16:24 |
| *** evilbungle has quit IRC | 16:24 | |
| *** hever has joined #zope | 16:24 | |
| kosh | a 2 year old version of rails, php, other python frameworks, java frameworks etc would fall in seconds | 16:24 |
| betabug | kosh: sure I can imagine, but I can also imagine the consequences :-) | 16:24 |
| betabug | well, the PloneHotfix20110720 said in its code "# patch not needed in Zope 2.9", so there is hope for me | 16:32 |
| *** dayne has quit IRC | 16:33 | |
| *** wosc has quit IRC | 16:44 | |
| betabug | ok, so 2.9 is not affected | 16:51 |
| * kosh blames betabug for that | 16:53 | |
| betabug | you blame me for 2.9 *not* being affected? | 16:53 |
| do3cc_ | for 2.10 being | 16:53 |
| kosh | yeah you should have to do all this patching also! :) | 16:54 |
| kosh | while your country melts down from financial problems | 16:54 |
| betabug | do3cc_: 2.10 is only if you've put on that previous fix | 16:55 |
| kosh | 2.10 only if you use plone pretty much | 16:55 |
| betabug | which goes in the category "mistakes I've learned to avoid a *long* time ago" for me | 16:56 |
| kosh | what I wonder about is how serious is the security issue if plone is not involved | 16:57 |
| *** evilbungle has joined #zope | 16:58 | |
| betabug | I guess there is some trick to get access to something in the acquisition path | 16:58 |
| kosh | betabug: because when I have tried to access restricted resources they still all seem to be restricted but I have explicit security permissions on every method | 16:58 |
| kosh | yeah probably | 16:58 |
| betabug | you could compare the publisher.py patch from the old hotfix to what's in the zope source and see what you get | 16:59 |
| betabug | but the new patch will come out any minute and probably with some explanations | 16:59 |
| kosh | nope an hour from now | 16:59 |
| betabug | oh? | 17:00 |
| betabug | damn time zone conversion, haha | 17:01 |
| *** libero has joined #zope | 17:01 | |
| kosh | I just did a serach for current time UTC on google :) | 17:02 |
| betabug | yeah | 17:02 |
| *** libero has left #zope | 17:03 | |
| *** RichardBarrell has joined #zope | 17:05 | |
| *** dayne has joined #zope | 17:06 | |
| planetzopebot | Security announcement update (gmane.comp.web.zope.announce) http://permalink.gmane.org/gmane.comp.web.zope.announce/1502 | 17:08 |
| *** sm has joined #zope | 17:13 | |
| *** MrWu has joined #zope | 17:20 | |
| *** benji has joined #zope | 17:30 | |
| *** jakke has joined #zope | 17:30 | |
| *** ViicT has quit IRC | 17:33 | |
| *** victor_ has joined #zope | 17:40 | |
| *** victor_ has joined #zope | 17:40 | |
| *** victor_ is now known as ViicT | 17:40 | |
| *** kleist_ is now known as kleist_LulzSec | 17:41 | |
| *** hannosch has joined #zope | 17:41 | |
| kosh | greetings evil hannosch | 17:43 |
| hannosch | greetings, 15 minutes to new Zope releases | 17:43 |
| kosh | yup | 17:44 |
| kosh | yeah betabug has been snickering that since he is on 2.9 he gets to ignore this security problem :) | 17:44 |
| * kosh beats betabug with a stick | 17:44 | |
| *** sunew has quit IRC | 17:45 | |
| *** Arfrever has joined #zope | 17:47 | |
| betabug | slacking pays off | 17:47 |
| betabug | "my" servers are either on 2.9 or 2.10 and ofcoz no plone anywhere | 17:48 |
| hannosch | betabug: you do know that Python has security fixes witch aren't in 2.4 anymore, right? Python 2.4 and Zope < 2.12 are unsupported and it's only a question of time until someone finds an exploitable issue | 17:48 |
| betabug | sure | 17:49 |
| *** MrWu is now known as Wu | 17:49 | |
| betabug | but I'm not doing this for a hobby - if the server's owners don't pay for upgrading their apps, I can't force them | 17:49 |
| kosh | there is certainly that | 17:50 |
| hannosch | sure, wait until they got hacked :) | 17:50 |
| kosh | I keep all my apps on the same codebase so when I do codebase testing for a new version of zope I move them all up | 17:50 |
| kosh | hannosch: well that is what most people do on any other web framework at least | 17:50 |
| kosh | hannosch: I have noticed that very few customers will pay for prevention and real maintenance | 17:50 |
| hannosch | it depends on what they are aiming for and how critical the site is to their business | 17:51 |
| hannosch | I think we have solved support/maintenance agreements to most customers after doing project work for them | 17:51 |
| betabug | last month I helped "fix" an old app built on 2.9/CMF and some weird code base - what should I tell them? "pay to build it all from scratch"? | 17:53 |
| betabug | or "you should have made a service contract with whoever made that app" ? | 17:54 |
| kosh | I have dealt with many companies that don't have the money they once did and have had to cut things back | 17:54 |
| kosh | even some pretty big companies have cut way back on spending and that includes maintenance | 17:54 |
| betabug | that app went through 3 hands or so | 17:54 |
| kosh | thankfully zope stands up vastly better then other frameworks even on little maintenance | 17:54 |
| betabug | yeah, that's good luck for those companies | 17:55 |
| betabug | other than that I have no easy solution for them, since new zope releases puts blocks in their way, requiring code to be rewritten | 17:56 |
| betabug | in case of an old CMF app, I can't even start to imagine how much work it would involve | 17:56 |
| *** daMaestro has joined #zope | 17:57 | |
| *** runyaga has joined #zope | 18:00 | |
| *** runyaga has quit IRC | 18:00 | |
| *** runyaga has joined #zope | 18:00 | |
| kosh | hmm zope.org won't load for me, the browser is just spinning on it | 18:01 |
| betabug | zope.org is ooold too | 18:01 |
| kosh | I wish more things would use my unique urls it provides such an insane speedup | 18:02 |
| kosh | I have sites that went from 3 seconds to render to .5 seconds | 18:02 |
| kosh | that is a big saving in server load and it means you can serve more people on the same hardware | 18:02 |
| kosh | hmm so far I don't see the file to download anywhere | 18:03 |
| betabug | kosh: http://plone.org/products/plone-hotfix/releases/20110622/Zope_Hotfix_20110622-1.0.zip | 18:06 |
| *** ChrisW has joined #zope | 18:06 | |
| kosh | just got it | 18:06 |
| ChrisW | so, where's the code for this security fix then? | 18:06 |
| ChrisW | it only affect PAS? | 18:07 |
| hannosch | full details at http://zope2.zope.org/news/security-vulnerability-announcement-privilege-escalation | 18:07 |
| ChrisW | hannosch: ...which doesn't give any details. | 18:07 |
| ChrisW | guess I'll just have a nose around the hotfix... | 18:08 |
| hannosch | if that's still cached try http://plone.org/products/plone/security/advisories/20110622 | 18:08 |
| ChrisW | ...which still doesn't give much detail of what the affected components are | 18:10 |
| *** mitchell` is now known as mitchell`off | 18:11 | |
| hannosch | ChrisW: look at the svn-commits if you want more detail | 18:11 |
| ChrisW | when were those commits made and where? | 18:12 |
| ChrisW | looked for them after the announcement last week and found nothing... | 18:12 |
| hannosch | ChrisW: there were made 15 minutes ago | 18:13 |
| hannosch | not much point in pre-announcing a hotfix if you can see the result a week before | 18:13 |
| ChrisW | personally, I find the withholding of patches in general to be offensive | 18:14 |
| hannosch | withholding? we are only doing a coordinated release, as this is such a critical flaw | 18:15 |
| hannosch | I'd call that responsible | 18:15 |
| ChrisW | shrugs, potato potato | 18:15 |
| kosh | wel I have all my systems patching | 18:18 |
| betabug | pre-announcing was ok for me, but I would have preferred the exact version info earlier - I understand that those infos would have given the issue away to a determined attacker though | 18:19 |
| kosh | I will watch my error logs to see if I run into any bugs but I got all of my servers patched and everything seems to be working | 18:20 |
| betabug | kosh: leave your email address on the server, so the evil hax0rs can send you a notice when they pwned you ;-) | 18:22 |
| kosh | hehe | 18:23 |
| kosh | however it does seem that this bug ahs been treated far more seriously then more serious bugs I have seen in other framework which barely make the patchnotes | 18:28 |
| *** alexpilz has joined #zope | 18:28 | |
| kosh | of course if you had as many security issues to refer to as most web frameworks you could never cover them like this | 18:28 |
| hannosch | well, being able to read any data from your database and file system (with enough expertise) sounds dangerous to me | 18:29 |
| kosh | yes very dangerous | 18:29 |
| ChrisW | isn't that what PHP does by design? ;-) | 18:29 |
| kosh | but not any worse then all the sql injection exploits that routinely show up in minor patches | 18:29 |
| kosh | however this is a big deal for zope since zope is supposed to fail closed when almost all other web systems are fail open | 18:30 |
| ChrisW | for the Zope2-only patch, I'm still trying to figure out what the vulterability is.. | 18:30 |
| kosh | hannosch: my point is that zope seems to take security far far more seriously | 18:30 |
| kosh | ChrisW: there is a way to construct a url such that you can read any resource without authentication is my understanding | 18:31 |
| ChrisW | also, how can I run the log checker over a whole dir of .gzip'ed logs... | 18:31 |
| kosh | what log checker? | 18:31 |
| ChrisW | http://plone.org/products/plone-hotfix/releases/CVE-2011-0720/logchecker.py | 18:31 |
| hannosch | kosh: sure, we don't have a security issue every week or months. one of the strong selling points | 18:31 |
| kosh | hannosch: or even ever year | 18:31 |
| kosh | hannosch: the last hotfix was auguest 2008 | 18:31 |
| hannosch | ChrisW: you are looking at the wrong one. that's an older vulnerability | 18:32 |
| ChrisW | hannosch: it was linked from the latest entry on plone.org | 18:32 |
| ChrisW | hannosch: not correct on 2008: http://svn.zope.org/repos/main/Zope/hotfixes | 18:32 |
| *** jakke has quit IRC | 18:33 | |
| *** alga has quit IRC | 18:33 | |
| kosh | ChrisW: ah I did not see the 2010 one when I was looking through the list of hotfixes | 18:34 |
| betabug | kosh: yeah, it's the one that this one was referring to | 18:34 |
| kosh | what was that one about? | 18:36 |
| *** avoinea has quit IRC | 18:36 | |
| *** zagy has quit IRC | 18:37 | |
| *** bernie has joined #zope | 18:38 | |
| hannosch | the last one was about missing security declarations, so for example all data stored in any catalog could be read by anyone | 18:38 |
| kosh | ah | 18:38 |
| *** __mac__ has quit IRC | 18:38 | |
| bernie | hello... has anyone succeeded at installing the 20110622 Plone hotfix? | 18:38 |
| *** __mac__ has joined #zope | 18:39 | |
| bernie | buildout fails saying that it can't find the setup.py script... | 18:39 |
| ChrisW | hannosch: by url access or by writing code through the zmi? | 18:39 |
| hannosch | ChrisW: url access | 18:40 |
| ChrisW | so how did the privilege escalation work on that one? was it announced through zope-announce? | 18:40 |
| *** __mac__ has quit IRC | 18:41 | |
| *** goschtl has quit IRC | 18:41 | |
| *** __mac__ has joined #zope | 18:42 | |
| *** __mac__ has quit IRC | 18:46 | |
| *** tiwula has joined #zope | 18:50 | |
| *** kleist_LulzSec is now known as kleist | 19:01 | |
| planetzopebot | Security Hotfix 20110622 released (gmane.comp.web.zope.announce) http://permalink.gmane.org/gmane.comp.web.zope.announce/1503 | 19:08 |
| *** bernie has left #zope | 19:14 | |
| *** m8 has joined #zope | 19:21 | |
| *** menesis has quit IRC | 19:24 | |
| *** hannosch has quit IRC | 19:25 | |
| *** ChrisW has left #zope | 19:42 | |
| *** redir has joined #zope | 19:45 | |
| *** m8 has quit IRC | 19:50 | |
| *** jpfarias has joined #zope | 19:52 | |
| jpfarias | hello there! | 19:52 |
| jpfarias | anyone knows if it is possible to copy objects from one zodb to another? | 19:52 |
| *** dayne has quit IRC | 19:52 | |
| jpfarias | basically | 19:52 |
| jpfarias | I have one zodb file (Data.fs) | 19:52 |
| jpfarias | but pack is failing on it for some reason I dont know | 19:53 |
| jpfarias | so I want to make a new Data.fs | 19:53 |
| jpfarias | and copy all important objects to it | 19:53 |
| *** m8 has joined #zope | 19:53 | |
| do3cc_ | jpfarias: thats not how it works | 19:55 |
| jpfarias | do3cc_: yeah I know | 19:55 |
| kosh | export and then import and you can see if your failed objects are in the ones you care about | 19:55 |
| kosh | however if you have a damaged Data.fs file you better find out if your hardware is failing because outside of hardware failures a damaged Data.fs file is extremely rare | 19:56 |
| jpfarias | so this is not a zope application, it is running on pyramid framework | 19:56 |
| do3cc_ | do you have a traceback_ | 19:56 |
| do3cc_ | ? | 19:56 |
| jpfarias | I just figured zope developers have a lot of experience with zodb, so I could ask here | 19:56 |
| jpfarias | darn, I had the traceback | 19:56 |
| betabug | well, probably you want to truncate the Data.fs | 19:56 |
| jpfarias | I would need to pack again to get it | 19:57 |
| jpfarias | the db is now 83GB | 19:57 |
| jpfarias | and it takes forever to get to the error when I try to pack | 19:57 |
| jpfarias | lol | 19:57 |
| jpfarias | it was failing with KeyError | 19:57 |
| jpfarias | not PosKeyError | 19:57 |
| jpfarias | the key was 'Defaul' if I remember well | 19:58 |
| jpfarias | I can figure the line the error was happening | 19:58 |
| do3cc_ | that sounds like you changed your data structures and now you have pickles for objects from your old class and your new classes try to work on them | 19:59 |
| jpfarias | ZODB/FileStorage/fspack.py | 19:59 |
| *** sylvain has quit IRC | 19:59 | |
| jpfarias | line 267 | 19:59 |
| *** strichter has quit IRC | 19:59 | |
| kosh | we need a full traceback, not just part of one line of a traceback | 20:00 |
| jpfarias | ok | 20:01 |
| jpfarias | lemme try to reproduce it | 20:01 |
| *** tisto has quit IRC | 20:02 | |
| jpfarias | anyway | 20:03 |
| jpfarias | it looks like I can navigate thru the whole tree of objects | 20:04 |
| jpfarias | and they work fine | 20:04 |
| jpfarias | so if I could just get the most recent copy of them | 20:04 |
| jpfarias | and store on another Data.fs | 20:04 |
| jpfarias | that would save my ass | 20:04 |
| jpfarias | :) | 20:04 |
| jpfarias | is that not an option? | 20:04 |
| *** RichardB_ has joined #zope | 20:05 | |
| kosh | somewhere in that tree something is damaged, since it is 83GB and you could not check that much by hand you have just not found the broken objects | 20:05 |
| kosh | you need to find and fix the problem | 20:06 |
| kosh | also find out why your ZODB is 83GB | 20:06 |
| jpfarias | yeah I made a walker that goes thru every branch of the objects tree | 20:06 |
| jpfarias | it takes a while to finish | 20:06 |
| jpfarias | but it gets there | 20:06 |
| jpfarias | so my application is a crawler | 20:06 |
| do3cc_ | do you have biig objects in there? | 20:06 |
| jpfarias | that gets data from some sites on the web | 20:07 |
| *** RichardB_ is now known as RichardBarrell_ | 20:07 | |
| jpfarias | so it has like 10k updates a day | 20:07 |
| *** RichardBarrell has quit IRC | 20:07 | |
| jpfarias | and I didn't pack for a few weeks now | 20:07 |
| *** RichardBarrell_ is now known as RichardBarrell | 20:07 | |
| jpfarias | because of this error I am getting | 20:07 |
| jpfarias | usually it would stay around 12~15GB after a pack | 20:07 |
| *** strichter has joined #zope | 20:08 | |
| do3cc_ | when you touch EACH object in the zodb, you do not get an error? | 20:09 |
| jpfarias | nope | 20:09 |
| do3cc_ | nope as in yes, I do not get an error? | 20:09 |
| jpfarias | yeah, no error | 20:10 |
| jpfarias | the application is running too | 20:10 |
| jpfarias | and it doesnt give any error | 20:10 |
| jpfarias | so it really confuses me | 20:10 |
| jpfarias | why pack() is not working | 20:11 |
| jpfarias | where can I paste the traceback? | 20:11 |
| do3cc_ | pastie.or | 20:12 |
| do3cc_ | pastie.org | 20:12 |
| do3cc_ | if I understand it correctly, the code starts with the oldest object in zodb and looks, if it is somehow reachable. If it is, it cannot be removed | 20:12 |
| jpfarias | http://pastie.org/2135186 | 20:12 |
| do3cc_ | so it will touch objects you can't | 20:13 |
| jpfarias | I have this error too | 20:14 |
| jpfarias | it might be the source of my problems | 20:14 |
| jpfarias | http://stackoverflow.com/questions/5144164/zope-zodb-pack-error | 20:14 |
| jpfarias | if I do something similar to what is suggested on this post | 20:14 |
| jpfarias | I get past this error | 20:14 |
| jpfarias | but then the other error comes up | 20:14 |
| *** benji has quit IRC | 20:17 | |
| do3cc_ | https://mail.zope.org/pipermail/zodb-dev/2010-June/013464.html | 20:17 |
| jpfarias | yeah | 20:17 |
| jpfarias | I am getting picklingError tho | 20:18 |
| jpfarias | not attributeerror | 20:18 |
| jpfarias | you think it is safe to ignore that error too? | 20:18 |
| jpfarias | I would like to understand why I get that error tho | 20:19 |
| *** sm has quit IRC | 20:28 | |
| jpfarias | http://pastie.org/2135275 | 20:32 |
| jpfarias | this is what I get if I do the try/except trick | 20:32 |
| *** menesis has joined #zope | 20:33 | |
| *** Wu has quit IRC | 20:36 | |
| *** sm has joined #zope | 20:38 | |
| jpfarias | hmm, jim says the pack can be done without gc | 20:40 |
| jpfarias | since zodb 3.9 | 20:40 |
| jpfarias | how do I do that? | 20:40 |
| jpfarias | or was that removed in 3.10? | 20:41 |
| jpfarias | only options I see for pack() it t and days | 20:41 |
| *** alga has joined #zope | 20:53 | |
| *** Spanktar has joined #zope | 20:55 | |
| *** zagy has joined #zope | 21:01 | |
| jpfarias | guess I will have to do some export / import script | 21:01 |
| jpfarias | to start with a fresh db | 21:02 |
| *** alecm has quit IRC | 21:02 | |
| *** alecm has joined #zope | 21:03 | |
| *** alecm has joined #zope | 21:03 | |
| *** evilbungle has quit IRC | 21:38 | |
| *** RichardBarrell has quit IRC | 21:38 | |
| *** TomBlockley has quit IRC | 21:40 | |
| *** mizzmetal has joined #zope | 21:59 | |
| mizzmetal | Would anyone be able to guide me to where I could see if http://plone.org/products/plone/security/advisories/20110622 is applicable for zope2.7.4 (I know, its old, but sometimes thats just life.) The article mentions that zope 2.8 and 2.9 aren't affected. | 22:01 |
| kosh | well if 2.8 is not affected then 2.7 would not be either | 22:02 |
| kosh | unless it is runnong one of the affected versions of plone | 22:03 |
| mizzmetal | Thanks, Kosh. | 22:06 |
| mizzmetal | I'm not familiar with zope; but that security bulletin was something I was asked to investigate. Is there a quick way I can determine the version of plone running on my zope stacks? | 22:06 |
| kosh | that I have no idea about, I don't use plone I just know about the zope version itself | 22:08 |
| kosh | however as someone pointed out earlier running a version of zope that old does have security issues already since it is running on an old python also | 22:08 |
| mizzmetal | Good point, Kosh. | 22:09 |
| mizzmetal | I appreciate the help! | 22:09 |
| mizzmetal | take care. | 22:09 |
| *** mizzmetal has quit IRC | 22:09 | |
| *** hever has quit IRC | 22:21 | |
| *** menesis has quit IRC | 22:25 | |
| *** teix has quit IRC | 22:45 | |
| *** hever has joined #zope | 22:47 | |
| *** hever has quit IRC | 22:51 | |
| *** kleist has quit IRC | 23:04 | |
| *** alecm_ has joined #zope | 23:24 | |
| *** alecm_ has joined #zope | 23:24 | |
| *** alexpilz has left #zope | 23:26 | |
| *** alecm has quit IRC | 23:29 | |
| *** alecm_ is now known as alecm | 23:29 | |
| *** m8 has quit IRC | 23:29 | |
| *** evilbungle has joined #zope | 23:51 | |
| *** evilbungle has quit IRC | 23:53 | |
Generated by irclog2html.py 2.15.1 by Marius Gedminas - find it at mg.pov.lt!