- xwiki-devs@xwiki.org - lists.xwiki.org

[xwiki-devs] [proposal] Deprecate XWikiHibernateStore internal methods.

by Caleb James DeLisle

There are a number of public methods in XWikiHibernateStore which are either nolonger used, unused outside of XWikiHibernateStore, or used in only a few places in old code. To make maintainence easier I propose deprecating them to discourage outside code from using them so they can later be removed or made private. Here is a list: saveXWikiObject used 1 place in c.x.x.XWiki#addUserToGroup which appears to be easily fixed. saveXWikiCollection used 3 places in the stats plugin. loadXWikiObject used 1 place in the old query plugin. loadXWikiCollection used 3 places in the stats plugin. deleteXWikiCollection used 1 place in stats plugin. deleteXWikiCollection used 1 place in stats plugin. deleteXWikiClass used nowhere. loadXWikiProperty used nowhere (outside of XWikiHibernateStore). saveXWikiClass used nowhere (outside of XWikiHibernateStore). loadXWikiClass used nowhere (outside of XWikiHibernateStore). saveXWikiClassProperty used nowhere. loadAttachmentList used nowhere (outside of XWikiHibernateStore). saveAttachmentList used nowhere (outside of XWikiHibernateStore). saveAttachment used nowhere (outside of XWikiHibernateStore). injectCustomMappingsInSessionFactory used nowhere (outside of XWikiHibernateStore). injectInSessionFactory used nowhere (outside of XWikiHibernateStore). isValidCustomMapping used nowhere (outside of XWikiHibernateStore). getBatcherStats used nowhere. resetBatcherStats used nowhere. WDYT? Caleb

15 years

3
3
0 0

[xwiki-devs] [proposal] Cancelable events and refactoring script macros

by Alex Busenius

Hello, I'd like to refactor AbstractScriptMacro in order to be able to change script behavior in the future without fanout violations. Here is the plan emerged after several discussions with ThomasM: Introduce a notion of cancelable events. Such events can be canceled by the receiver (providing an optional reason), the actual canceling is performed by the sender. http://dev.xwiki.org/xwiki/bin/view/Design/CancelableEvents Send a cancelable event ScriptEvaluationStartsEvent in AbstractScriptMacro just before evaluating the script and a ScriptEvaluationFinishedEvent right after evaluation has finished (in finally block). Add the following 3 listeners to those events (into rendering.internal.macro.script) and move the corresponding code from AbstractScriptMacro there: ScriptClassLoaderHandlerListener * does class loader manipulations currently performed by AbstractScriptMacro#getClassLoader & Co PermissionCheckerListener * Aborts execution of scripts that need PR if the document is not saved with PR * To distinguish velocity and PR scripts, introduce a new interface PrivilegedScriptMacro extends ScriptMacro and let AbstractJSR223ScriptMacro implement it NestedScriptMacroValidatorListener * Replaces NestedScriptMacroValidator (ScriptMacroValidator component is removed completely) The refactoring will remove the following methods (breaks API): AbstractJSR223ScriptMacro: * protected boolean canExecuteScript() * public List execute(JSR223ScriptMacroParameters, String, MacroTransformationContext) AbstractScriptMacro: * protected boolean canHaveJarsParameters() * protected ClassLoader getClassLoader(String, ClassLoader) WDYT? Alex

15 years, 1 month

6
6
0 0

[xwiki-devs] [proposal] Remove flickr plugin from CORE

by Sorin Burjan

Hello. It seems that platform/trunks/core/xwiki-core/src/main/java/com/xpn/xwiki/plugin/flickr plugin is not used by anything in XWiki. It seems to be old and deprecated. I propose to remove it from xwiki-core. The things to discuss would be : Topic I. Where to move it: 1.Deprecate it (move it to contrib retired) 2.Remove it from everywhere (delete code) 3.Move it to CORE plugins 4.Rewrite it nicely as a service and have it : 1.as core module 2.in contrib sandbox Topic II. Relation to the platform 1.bundle it by default 2.not bundle it by default I am +1 for I.2 and II.2 . WDYT? Thanks, Sorin

15 years, 1 month

6
6
0 0

Re: [xwiki-devs] IMPORTANT: WYSIWYG editor language in user interface

by Marius Dumitru Florea

Hi Ramon, First of all sorry for the late reply, I've been in holidays for the past two weeks. On 08/18/2010 09:05 PM, Ramon Gomes Brandão - SERINT wrote: > Hi Marius, > > I’m a long-time enthusiast of XWiki and I think it’s the best wiki tool I'm happy to hear that! > ever. However, I feel some lack of updated documentation on how to > build it. I’m implementing a large instance of XWiki Enterprise 2.4 in > my work here in Brazil, and I’m facing an issue: detailed instructions > on how to build the new WYSIWYG editor. I’ve translated the > Strings.properties file in Portuguese, and I’m trying to use Eclipse > with m2eclipse to build it, but I definitively don’t know how to > proceed. I saw your messages on xwiki-users archives about this build. > Could you help me sending detailed steps on how to do this? Here are my > questions: > > 1) I’ve installed Eclipse+m2eclipse+subclipse and checked out the > platform/web/trunk folder. It contains the following sub-folders (modules): > > -gwt > > -standard > > -xwiki-gwt-dom > > -xwiki-gwt-user > > -xwiki-gwt-wysiwyg-client > > -xwiki-gwt-wysiwyg-server > > Do I need all the modules to proceed? The WYSIWYG editor code is split between xwiki-gwt-wysiwyg-client and xwiki-gwt-wysiwyg-server. The server side depends on the XWiki core, while the client side depends on xwiki-gwt-user and xwiki-gwt-dom. You can ignore the other two modules (gwt and standard). You can ignore xwiki-gwt-dom too if you don't plan to change/enhance the DOM API. > Where should I place > Strings_pt.properties ? Do I need to modify “extended-property …” both > on xwiki-gwt-user and > xwiki-gwt-wysiwyg-client/resources/…/Wysiwyg.gwt.xml or only in this > last one? There are three translation files as indicated on http://l10n.xwiki.org/xwiki/bin/view/Wysiwyg/ . One is included in xwiki-gwt-user and the other two are in xwiki-gwt-wysiwyg-client: http://svn.xwiki.org/svnroot/xwiki/platform/web/trunk/xwiki-gwt-user/src/ma… http://svn.xwiki.org/svnroot/xwiki/platform/web/trunk/xwiki-gwt-wysiwyg-cli… http://svn.xwiki.org/svnroot/xwiki/platform/web/trunk/xwiki-gwt-wysiwyg-cli… Best is to translate all these files. You should place the translated file (e.g. Strings_pt.properties) in the same directory as the corresponding source file (e.g. Strings.properties). Then you have to modify both: http://svn.xwiki.org/svnroot/xwiki/platform/web/trunk/xwiki-gwt-user/src/ma… and http://svn.xwiki.org/svnroot/xwiki/platform/web/trunk/xwiki-gwt-wysiwyg-cli… in order to update the locale property: <extend-property name="locale" values="...,pt"/> > > 2) Which modules do I need to build (with right click - > Run as -> > Maven build or Maven install)? In which order? I don't build from eclipse although I have m2eclpse installed. I prefer the console. The right build order is: xwiki-gwt-user > xwiki-gwt-wysiwyg-client > xwiki-gwt-wysiwyg-server xwiki-gwt-user and xwiki-gwt-wysiwyg-client generate jars that are used by xwiki-gwt-wysiwyg-server which generates a war. Note that building xwiki-gwt-wysiwyg-server takes a long time because GWT compilation is costly. > > 3) Does this build generates a war automatically? Where does it > generates the war (where I can find it)? The war generated by xwiki-gwt-wysiwyg-server is placed in the target directory (e.g. target/xwiki-web-gwt-wysiwyg-server-2.5-SNAPSHOT.war). I know this happens when you build from command line. Might be different when you build from eclipse, but you should be able to find the war anyway. In the worst case, if you run "mvn install" the war will be installed in your local repository: ~/.m2/repository/com/xpn/xwiki/platform/xwiki-web-gwt-wysiwyg-server/2.5-SNAPSHOT/xwiki-web-gwt-wysiwyg-server-2.5-SNAPSHOT.war > > 4) How to load the new build into my running XWiki Enterprise 2.4 > instance? You have to replace (don't merge!) webapps/xwiki/resources/js/xwiki/wysiwyg/xwe directory from your XWiki installation with the one from the previously generated war. If you change code on the WYSIWYG sever side then you have to update the jars from WEB-INF/lib (copy those from the generated war) but that's not your case from what I can see. Don't forget to clear the browser cache. > How to force always the WYSIWYG editor to be shown in Portuguese? > You can either configure the Portuguese language as the default language in XWiki (the clean way) or, the hard way, you can build the WYSIWYG editor only for Portuguese language by replacing: <extend-property name="locale" values="...,pt"/> with <set-property name="locale" value="pt" /> in the descriptors of the xwiki-gwt-user and xwiki-gwt-wysiwyg-client GWT modules. > Hope you can help me. Note that the best way to contribute a translation is to add it to l10n.xwiki.org . This way all the previous steps are done by us. The downside is that you have to wait for the next release to see the Portuguese translation in action. Hope this mail doesn't come too late, Marius > > Regards, > > *Ramon Gomes Brandão* >

15 years, 1 month

1
0
0 0

[xwiki-devs] [proposal] Migrate database to store passwords in LargeStringClass and begin using crypto.passwd#protectPassword

by Caleb James DeLisle

Because protectPassword generates a base-64 encoded java serialized form, the size is quite a bit larger than the 255 character limit of StringProperty and thus PasswordProperty. The use of java serialization is central to the upgradability of the password verification function because any new class which implements PasswordVerificationFunction automatically works. Given this, I want to migrate the database to move password hashes into the xwikilargestrings table and change PasswordProperty to extend LargeStringProperty. During this migration, any passwords still stored in plaintext will be ported to the scrypt function, passwords stored as a hash will have an exclamation mark pretended to the text (this is invalid base64) and be inserted into the table as is. PasswordClass will keep the sha-512 hash function for legacy passwords but will port passwords to the new format as users log in. These changes will allow us to close http://jira.xwiki.org/jira/browse/XWIKI-70 and http://jira.xwiki.org/jira/browse/XWIKI-582 WDYT? Caleb

15 years, 1 month

6
14
0 0

[xwiki-devs] [Proposal] Add new methods for manipulating properties to DocumentAccessBridge

by Alex Busenius

Hi devs, It seems that currently there is no good way to manipulate XWiki objects and properties in documents without depending on old core. DocumentAccessBridge defines some methods for changing properties, but they are very limited, in particular, there is no way to: * add a new property (except the first one) * set a property of n-th object (getting it is possible) * remove an object * get the number of objects Therefore I propose to add the following methods to DocumentAccessBridge: // returns index of the new object int addObject(ObjectReference obj) throws Exception; // returns false if there was no object, throws on access error boolean removeObject(ObjectReference obj, int index) throws Exception; // number of objects of the given class int getObjectCount(ObjectReference obj); // returns index of the object that was modified, adds a new object if // index is out of range int setProperty(ObjectReference obj, int idx, String prop, Object val) throws Exception; // just to have all needed methods taking object reference Object getProperty(ObjectReference obj, int index, String propertyName); I've chosen ObjectReference because it contains (almost) all needed information, including class name and document reference. It would be better to have the object index stored in the reference too, like in org.xwiki.annotation.reference.IndexedObjectReference, but this class is annotation-specific. I need those methods to store certificates in user profile, see https://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-signedscripts WDYT? Thanks, Alex

15 years, 1 month

3
4
0 0

[xwiki-devs] [Proposal] Code names for XWiki release cycles

by Jerome Velociter

Hello friends, I would like to propose introducing the use of code names for each release cycle of XWiki (2.x, 3.x, etc.), using a agreed-on scheme (a la Ubuntu [1]). The main reason behind this proposal is that : A. it's groovy :) B. there is no B. As for the code name scheme, with regard to recent events involving a fair portion of the XWiki Development team [2], I would like to propose the use of cocktail names as code names. Some examples - for the sake of illustration : XWiki "Cuba Libre" 2.5, XWiki "White Russian" 2.6, XWiki "Bloody Mary" 3.0, etc. you name it! [3]. Virgin cocktails tolerated :) The release manager for each cycle would have the honor to pick up the release code name. Isn't that an awesome incentive ? +1 for all that Jerome. [1] https://wiki.ubuntu.com/DevelopmentCodeNames [2] http://www.xwiki.com/xwiki/bin/view/Blog/XWiki+Seminar'10 [3] http://en.wikipedia.org/wiki/List_of_cocktails

15 years, 1 month

13
13
0 0

[xwiki-devs] [Vote][Proposal] Action Menus Improvements part 2

by Ecaterina Valica

Hi, After gathering some Action Menus feedback, we decided to go for another iteration for them. Please give your feedback on this proposal and *cast your vote* for this items (described at http://incubator.myxwiki.org/xwiki/bin/view/Improvements/ActionMenuProposal…): 1. New "Add" menu 2. Wiki/Space/Page separation 3. New "Delete" Space entry and relocation of some Page actions 4. Better Wiki/Space naming representation (WIKI: Wikiname) 5. Uppercase menu usage just for top entries/labels 6. "TYPE: Name" pattern Screenshots and proposal: http://incubator.myxwiki.org/xwiki/bin/view/Improvements/ActionMenuProposal2 Partial prototype: http://incubator.myxwiki.org/xwiki/bin/view/Skins/SkinMenu Thanks, Caty P.S. Thanks to Gregory for all opinions / ideas

15 years, 1 month

8
15
0 0

[xwiki-devs] [UX] Action Menus: What menu items we have into "Simple/Advanced" mode

by Ecaterina Valica

Hi, "Simple/Advanced" mode definition http://platform.xwiki.org/xwiki/bin/view/Features/PageEditing#HSimpleandAdv… After discussing Action Menu Improvements part 2 ( http://incubator.myxwiki.org/xwiki/bin/view/Improvements/ActionMenuProposal2) we changed the position of "Access rights" from "Edit" submenu to "Page" submenu. Until now, changes done by "Advanced" mode were located only in "Edit" submenu. A. The question is: what other items do you think should go under "Simple"/"Advanced" mode? Do we keep the same items? Do we add more? Do we simplify? B. Another idea is to change "Simple"/"Advanced" mode into "User"/"Developer"/"Admin" in the structure we also have the documentation written. Obs1. The problem with menus is that they don't rely only on these modes, but also on the rights the users has to do some actions (like edit, delete, admin). Obs2. The ideal way for this topic would be to let administrators decide what goes into what mode, but even like that, we should still have some standards values for the modes. Thanks, Caty

15 years, 1 month

2
1
0 0

[xwiki-devs] [proposal] A separate hudson project for escaping tests

by Alex Busenius

Hi devs, The new escaping tests I recently proposed generate a quite large number of tests and take noticeable amount of time to run. There are currently 782 escaping tests, they need 8 minutes on my core duo (for comparision, there are about 1800 tests in enterprise/ in total, they need 1 hour). Caleb had an idea about adding a separate Hudson project for them, this would make it possible to see the cause of failures or, in ideal case, run functional tests in parallel with escaping tests (if the hardware is good enough). WDYT? Alex

15 years, 1 month

4
4
0 0

[xwiki-devs] Find current mode of the document through Velocity

by xManish

Hello All, Through Velocity, is it possible to find whether we are in the "Edit" mode of the document or "View" mode ? Actually, I wanted to make few changes in the content of the document when its in View mode. So if I could know the mode of the document, I could just use some if/else statement. Thanks in advance for the help. Manish -- View this message in context: http://xwiki.475771.n2.nabble.com/Find-current-mode-of-the-document-through… Sent from the XWiki- Dev mailing list archive at Nabble.com.

15 years, 1 month

2
2
0 0

[xwiki-devs] [proposal] add to XWikiStoreInterface List<T> getEntities(T entityType, List<EntityReference> references)

by Caleb James DeLisle

The proposal is straightforward, add a method which allows for getting multiple entities at once. List<T> getEntities(T entityType, List<EntityReference> references) The reason for wanting to have a bulk getter is because optimizations can be made at the database level and there are a number of places where multiple documents are loaded at once eg: panels. For the moment I intend to use an if statement to determine what it's getting and load each of the entities using the current loader. As usage increases I will begin looking at ways to bulk load. WDYT? Caleb

15 years, 1 month

1
0
0 0

[xwiki-devs] Deploying on JBoss 5+

by Eric Lentz

Be advised that deploying on JBoss 5 has an issue in using jython scripts. I created a patch to fix the problem and submitted it to jython development to be implemented. That issue can be viewed at http://bugs.jython.org/issue1639. In short, the problem is that JBoss 5 introduced the vfszip protocol for jar files which prefixes "SomeJarFileClass.class.getName()" with "vfszip:" versus "jar:file:" (which happens in containers like Tomcat) and jython uses the latter string to obtain the jar filename in order to produce a classpath for jython. That classpath would point to the jar file for python modules, like re.py. When using a macro, like the code macro, you get the error, "ImportError: No module named re". I made a personal fix by applying the patch to jython 2.5.1 source (the patch provided to jython maintainers is for version 2.5.2b1, but might work) and performed a build up to the point where the class PySystemState.class was created. I then did jar -uvf jython... org/python/core/PySystemState.class to update that one class. As a side effect of that command (I guess) I then also had to include jna-posix.jar from the extlibs directory of the jython distro. in xwiki's lib directory. Let me know if you have questions by e-mailing directly (if that's an option). I may not be monitoring this list much longer. I just wanted to let people know about this.

15 years, 1 month

3
2
0 0

[xwiki-devs] Mouse Listener Events

by Melanie

Hello, How does XWiki capture mouse events? For example in annotations, you can select text and a pop-up menu appears. What code captures the text highlighting and causes a popup to appear? Is it done in javascript or in the java plugin? -Melanie

15 years, 1 month

1
0
0 0

[xwiki-devs] [XACALENDAR] Commit rights

by Raluca Stavro

Hello, Can someone please give me commit rights for the calendar application? See http://jira.xwiki.org/jira/browse/XACALENDAR-14 (I attached a patch there, but I would like to be able to commit). Thank you, Raluca.

15 years, 1 month

2
1
0 0

[xwiki-devs] Contributing MediaWiki to XWiki migration toolkit

by Kirst Martin Wolfgang

Hi, I'm near to finish my MediaWiki2XWiki migration "toolkit". I've developed such, to migrate our homegrown MediaWiki installation to XWiki. The footprint of our Wiki is about 230 pages with around 570 attachments. This will end up in round about 150MB of data. Not that big, but to much to migrate it manually ;-) I'm dumping the MediaWiki content (exported XML) into wikimodel and wrote a XWiki/2.0 serializer. After resolving all templates and downloading the attachments, they get renamed to fit the XWiki rules. Afterwards they are uploaded automatically (including all files and images) to your XWiki instance. The process is splitted into two steps: "extraction and preparation" and "uploading". Everyone with some basic skills in Java and Eclipse can use this "toolkit". But it doesn't claim to be an end user ready to use product ;-) I want to contribute it to your XWiki Code section (apache license). Any doubts from your side or I'm free to do so? Regards Martin

15 years, 1 month

4
7
0 0

[xwiki-devs] Offtopic: someone able to commit patches for wikimodel, please?

by Kirst Martin Wolfgang

Hi there, it seems, that some of you XWiki developers are also committers for the wikimodel project hosted on Google Code. I've added some small patches there and some more patches are queued in my workspace but are almost twisted to much with the posted ones. Cause I want to avoid huge monster patches I pleasantly want to ask if anyone could commit them please? Thanks & Regards Martin PS: Sorry for offtopic disturbing.

15 years, 1 month

2
2
0 0

[xwiki-devs] What takes so long when XWiki first starts up.

by Caleb James DeLisle

After determining that the database gets worked pretty hard on start-up, I decided to add an error log to the XWikiHibernateStore.loadXWikiDoc command to see what was actually being loaded. I fed the result to sed and converted it into the following: Maybe things would go faster if lucene were made hold off for the first few minutes or pause for some number of milliseconds between page loads. [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiGlobalRights [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiPreferences [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.JavaScriptExtension [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.StyleSheetExtension [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.AggregatorURLClass [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.FeedEntryClass [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.SchedulerJobClass [Lucene Index Rebuilder] ColorThemes.ColorThemeClass [Lucene Index Rebuilder] ColorThemes.Nature [Lucene Index Rebuilder] Blog.BlogClass [Lucene Index Rebuilder] Blog.WebHome [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.WatchListJobClass [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiRights [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Scheduler.WatchListWeeklyNotifier [Lucene Index Rebuilder] XWiki.XWikiSkins [Lucene Index Rebuilder] XWiki.DefaultSkin [Lucene Index Rebuilder] XWiki.TagClass [Lucene Index Rebuilder] XWiki.WebPreferences [Lucene Index Rebuilder] XWiki.OfficeImporterAdmin [Lucene Index Rebuilder] Stats.Referrer [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Scheduler.WatchListDailyNotifier [Lucene Index Rebuilder] Panels.PanelClass [Lucene Index Rebuilder] Panels.TagCloud [Lucene Index Rebuilder] AnnotationCode.Settings [Lucene Index Rebuilder] IRC.IRCArchiveClassTemplate [Lucene Index Rebuilder] XWiki.WatchListClass [Lucene Index Rebuilder] Blog.CategoryClass [Lucene Index Rebuilder] Blog.Personal [Lucene Index Rebuilder] XWiki.AdminExportSheet [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Scheduler.WatchListHourlyNotifier [Lucene Index Rebuilder] Stats.WebPreferences [Lucene Index Rebuilder] Stats.Visit [Lucene Index Rebuilder] XWiki.WikiMacros [Lucene Index Rebuilder] Main.WebSearch [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.Mail [Lucene Index Rebuilder] IRC.IRCBot [Lucene Index Rebuilder] Blog.Archive [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiUsers [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiGroups [Lucene Index Rebuilder] XWiki.LiveTableResultsMacros [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiGroupTemplate [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.XWikiComments [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.SheetClass [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.WikiMacroClass [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.WikiMacroParameterClass [Lucene Index Rebuilder] XWiki.ConfigurableClass [Lucene Index Rebuilder] XWiki.SearchAdmin [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Sandbox.WebHome [Lucene Index Rebuilder] XWiki.ResetPasswordRequestClass [Lucene Index Rebuilder] ColorThemes.WebHome [Lucene Index Rebuilder] Main.TestPage [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Sandbox.WebPreferences [Lucene Index Rebuilder] Main.WebRss [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Main.WebHome [Lucene Index Rebuilder] Sandbox.TestPage2 [Lucene Index Rebuilder] Panels.NewPage [Lucene Index Rebuilder] XWiki.XWikiAllGroup [Lucene Index Rebuilder] XWiki.WebHome [Lucene Index Rebuilder] Panels.Shortcuts [Lucene Index Rebuilder] Main.Tags [Lucene Index Rebuilder] Stats.Style [Lucene Index Rebuilder] Stats.CurrentYearActivity [Lucene Index Rebuilder] Panels.PanelWizard [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.Admin [Lucene Index Rebuilder] ColorThemes.DefaultColorTheme [Lucene Index Rebuilder] XWiki.AdminRegistrationSheet [Lucene Index Rebuilder] Main.Spaces [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] ColorThemes.WebPreferences [Lucene Index Rebuilder] AnnotationCode.Script [Lucene Index Rebuilder] XWiki.RegistrationHelp [Lucene Index Rebuilder] Blog.RecentPostsPanel [Lucene Index Rebuilder] XWiki.Registration [Lucene Index Rebuilder] XWiki.AdminPresentationSheet [Lucene Index Rebuilder] XWiki.AdminInlineSheet [Lucene Index Rebuilder] Stats.Activity [Lucene Index Rebuilder] Main.RssFeeds [Lucene Index Rebuilder] IRC.IRCBotlet [Lucene Index Rebuilder] Invitation.InvitationMailClass [Lucene Index Rebuilder] XWiki.XWikiUserWatchListSheet [Lucene Index Rebuilder] Main.SpaceIndex [Lucene Index Rebuilder] XWiki.AdminProgrammingSheet [Lucene Index Rebuilder] AnnotationCode.AnnotationClass [Lucene Index Rebuilder] AnnotationCode.AnnotationConfig [Lucene Index Rebuilder] XWiki.TemplateProviderSheet [Lucene Index Rebuilder] Stats.MostEditedPages [Lucene Index Rebuilder] XWiki.Treeview [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Panels.QuickLinks [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Panels.WebPreferences [Lucene Index Rebuilder] XWiki.AllAttachmentsResults [Lucene Index Rebuilder] IRC.IRCArchiveClass [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] Panels.MyRecentModifications [Lucene Index Rebuilder] IRC.sandboxArchive20100810 [Lucene Index Rebuilder] XWiki.ForgotUsername [Lucene Index Rebuilder] Blog.Other [Lucene Index Rebuilder] Blog.UnpublishedPanel [Lucene Index Rebuilder] Panels.Tags [Lucene Index Rebuilder] XWiki.ObjectSheet [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] XWiki.WebDAV [Lucene Index Rebuilder] XWiki.ResetPasswordMailContent [http://127.0.0.1:8081/xwikiTrunk/bin/view/Sandbox/] AnnotationCode.Style [Lucene Index Rebuilder] Panels.ClassSwitcher [Lucene Index Rebuilder] XWiki.SearchCode [Lucene Index Rebuilder] XWiki.AdminGroupsSheet [Lucene Index Rebuilder] Panels.RightsEditorWelcome [Lucene Index Rebuilder] Invitation.InvitationMembersCommon [Lucene Index Rebuilder] Stats.LeastActiveContributors [Lucene Index Rebuilder] Panels.AddClassProperty [Lucene Index Rebuilder] AnnotationCode.Tab [Lucene Index Rebuilder] Scheduler.WebPreferences [Lucene Index Rebuilder] ColorThemes.Nightfall [Lucene Index Updater] XWiki.SchedulerJobClass [Lucene Index Updater] ColorThemes.Nature [Lucene Index Rebuilder] XWiki.AdminSheet [Lucene Index Updater] XWiki.WatchListJobClass [Lucene Index Updater] Scheduler.WatchListWeeklyNotifier [Lucene Index Updater] Blog.BlogClass [Lucene Index Updater] Blog.WebHome [Lucene Index Updater] XWiki.OfficeImporterAdmin [Lucene Index Rebuilder] XWiki.AllAttachments [Lucene Index Rebuilder] XWiki.AdminFieldsDisplaySheet [Lucene Index Rebuilder] XWiki.SearchConfigClass [Lucene Index Rebuilder] Panels.GlobalRightsEditorWelcome [Lucene Index Rebuilder] XWiki.XWikiUserSheet [Lucene Index Rebuilder] XWiki.TemplateProviderClass [Lucene Index Rebuilder] Panels.Members [Lucene Index Rebuilder] XWiki.XWikiUserPreferencesSheet [Lucene Index Rebuilder] IRC.Admin [Lucene Index Rebuilder] Panels.Navigation [Lucene Index Rebuilder] XWiki.AdminTemplatesSheet [Lucene Index Rebuilder] Panels.ClassEditorWelcome [Lucene Index Rebuilder] Blog.ArchivePanel [Lucene Index Rebuilder] XWiki.XWikiUserTemplate [Lucene Index Rebuilder] XWiki.WatchListRss [Lucene Index Rebuilder] XWiki.Tableview [Lucene Index Rebuilder] Panels.PanelTemplate [Lucene Index Rebuilder] Panels.OrphanedPages [Lucene Index Rebuilder] XWiki.ClassSheet [http://127.0.0.1:8081/xwikiTrunk/bin/download/Sandbox/WebHome/XWikiLogo.png] Sandbox.WebHome [Lucene Index Rebuilder] Panels.Spaces [Lucene Index Rebuilder] Invitation.InvitationMemberActions [Lucene Index Rebuilder] Sandbox.TestPage3 [Lucene Index Rebuilder] Panels.RightsTips [Lucene Index Rebuilder] XWiki.XWikiGroupSheet [Lucene Index Rebuilder] XWiki.ConfigurableClass [Lucene Index Rebuilder] Invitation.WebHome [Lucene Index Rebuilder] Panels.WebPreferences [Lucene Index Rebuilder] Panels.Recently Created [Lucene Index Rebuilder] XWiki.AccountValidation [Lucene Index Rebuilder] Main.TagsRss [Lucene Index Updater] Stats.Referrer [Lucene Index Rebuilder] Stats.CurrentMonthActivity [Lucene Index Updater] Panels.TagCloud [Lucene Index Rebuilder] XWiki.XWikiUserWatchListLiveTableResults [Lucene Index Updater] IRC.IRCArchiveClassTemplate [Lucene Index Rebuilder] ColorThemes.BlueSky [Lucene Index Updater] Scheduler.WatchListDailyNotifier [Lucene Index Rebuilder] Main.Search [Lucene Index Updater] XWiki.WatchListClass [Lucene Index Updater] Blog.CategoryClass [Lucene Index Updater] Blog.Personal [Lucene Index Updater] XWiki.AdminExportSheet [Lucene Index Rebuilder] IRC.IRCBot [Lucene Index Updater] Stats.WebPreferences [Lucene Index Updater] Stats.Visit [Lucene Index Rebuilder] IRC.IRCBotlet [Lucene Index Updater] Scheduler.WatchListHourlyNotifier [Lucene Index Rebuilder] IRC.JiraBotlet [Lucene Index Updater] XWiki.WikiMacros [Lucene Index Updater] Main.WebSearch [Lucene Index Rebuilder] IRC.WikiNewsBotlet [Lucene Index Rebuilder] IRC.IRCConfig [Lucene Index Rebuilder] XWiki.LuceneSearchAdmin [Lucene Index Rebuilder] AnnotationCode.CreateForm [Lucene Index Rebuilder] Panels.Recently Modified [Lucene Index Rebuilder] AnnotationCode.DisplayForm [Lucene Index Rebuilder] Panels.WebHome [Lucene Index Rebuilder] Invitation.WebPreferences [Lucene Index Rebuilder] XWiki.ClassTemplate [Lucene Index Rebuilder] XWiki.XWikiClasses [Lucene Index Rebuilder] XWiki.WebDAV [Lucene Index Rebuilder] Panels.CreatePanel [Lucene Index Rebuilder] XWiki.TemplateProviderTemplate [Lucene Index Rebuilder] XWiki.TagCloud [Lucene Index Updater] Blog.Archive [Lucene Index Updater] XWiki.LiveTableResultsMacros [http://127.0.0.1:8081/xwikiTrunk/bin/get/Sandbox/WebHome?xpage=xpart&vm=com…] Main.WebHome [Lucene Index Rebuilder] Panels.MyRecentModifications [Lucene Index Rebuilder] Panels.PanelLayoutUpdate [Lucene Index Rebuilder] Panels.ObjectEditorWelcome [Lucene Index Updater] XWiki.SearchAdmin [Lucene Index Rebuilder] XWiki.Results [Lucene Index Rebuilder] IRC.IRCArchiveClassSheet [Lucene Index Rebuilder] XWiki.XWikiGroups [Lucene Index Rebuilder] Main.DatabaseSearch [Lucene Index Rebuilder] Panels.IncludedDocuments [Lucene Index Rebuilder] Panels.DocumentInformation [Lucene Index Updater] XWiki.ResetPasswordRequestClass [Lucene Index Rebuilder] Panels.Backlinks [Lucene Index Updater] ColorThemes.WebHome [Lucene Index Updater] Main.TestPage [Lucene Index Rebuilder] Main.RecentChanges [Lucene Index Updater] Main.WebRss A bunch more Lucene index rebuilder/updater calls run afterword. The paste of the log which this list was generated from: http://pastebin.com/j6U0MLc0 Caleb

15 years, 1 month

1
0
0 0

[xwiki-devs] Adding xwiki-crypto configuration to xwiki.properties

by Caleb James DeLisle

I wanted to give a heads up to the list that I intend to add configuration for xwiki-crypto to the xwiki.properties file. If nobody has a complaint or correction/improvement, I'll add this in tomorrow. The configuration will read as follows: #------------------------------------------------------------------------------------- # Cryptographic services #------------------------------------------------------------------------------------- #-# [Since 2.5M1] #-# Which cipher should be used for encrypting text with a password. #-# #-# Options are: #-# CAST5PasswordCiphertext (Uses CAST-5 cipher engine with a 128 bit key) #-# AESPasswordCiphertext (Uses AES cipher engine with a 128 bit key) #-# #-# NOTE: Encrypted text can still be decrypted even if the cipher or key function has changed. #-# #crypto.passwd.passwordCiphertext = CAST5PasswordCiphertext #-# [Since 2.5M1] #-# Which key derivation function to use. #-# Since the easiest attack on password encrypted text is to guess passwords, this function ensures that verification #-# of a password takes a long time for the computer and is inherently difficult to parallelize. #-# #-# Options are: #-# ScryptMemoryHardKeyDerivationFunction (Uses the scrypt key function which forces password guessers to expend a #-# a configurable amount of processor time and memory to validate guesses #-# Scrypt is conjectured to be 260 times the strength of PBKDF2 #-# Function definition available here: http://www.tarsnap.com/scrypt.html) #-# PBKDF2KeyDerivationFunction (Uses password based key derivation function 2 (PBKDF2) developed by RSA labs as part #-# of the PKCS#5 standard. This function uses a configurable amount of processor time #-# but an insignificant amount of memory. #-# Function definition available here: http://www.apps.ietf.org/rfc/rfc2898.html#sec-5.2) #-# #crypto.passwd.keyDerivationFunctionClassForEncryption = ScryptMemoryHardKeyDerivationFunction #-# [Since 2.5M1] #-# Define the properties for initializing the dey derivation functions for encryption. #-# #-# millisecondsOfProcessorTimeToSpend is used to test run the key function and decide how many iterations it should #-# use. Remember this amount of time will be required to convert the password to #-# the decryption key every time the text needs to be decrypted. #-# numberOfKilobytesOfMemoryToUse will be ignored unless a memory hard function such as scrypt is chosen in which #-# case it will be used to define how much memory should be required to derive the #-# decryption key from the password. #-# #-# CAUTION: If numberOfKilobytesOfMemoryToUse is set too large, the computer may be able to encrypt a piece of text #-# when it has lots of free memory available, then be unable to decrypt that text when less memory is #-# available. Unless you are very paranoid, 1 megabyte (1024) is plenty of strength. #-# #crypto.passwd.keyDerivationFunctionPropertiesForEncryption = millisecondsOfProcessorTimeToSpend = 200 #crypto.passwd.keyDerivationFunctionPropertiesForEncryption = numberOfKilobytesOfMemoryToUse = 1024 #-# [Since 2.5M1] #-# Which key derivation function to use for protecting (hashing) passwords. #-# Options include: #-# ScryptMemoryHardKeyDerivationFunction (See above for more information) #-# PBKDF2KeyDerivationFunction (See above for more information) #-# #crypto.passwd.keyDerivationFunctionClassForPasswordVerification = ScryptMemoryHardKeyDerivationFunction #-# [Since 2.5M1] #-# Properties to use when initializing key derivation functions for password protection. #-# #-# millisecondsOfProcessorTimeToSpend (See above for description.) #-# numberOfKilobytesOfMemoryToUse (See above for description.) #-# derivedKeyLength is the number of bytes of length which the output key should be. In a password verification #-# context, this is only valid for decreasing the chance of a collision. #-# #-# CAUTION: If numberOfKilobytesOfMemoryToUse is set too large, the computer may be able to protect a password #-# when it has lots of free memory available, then be unable to validate that password when less memory is #-# available. Unless you are very paranoid, 1 megabyte (1024) is plenty of strength. #-# #crypto.passwd.keyDerivationFunctionPropertiesForPasswordVerification = millisecondsOfProcessorTimeToSpend = 200 #crypto.passwd.keyDerivationFunctionPropertiesForPasswordVerification = numberOfKilobytesOfMemoryToUse = 1024 #crypto.passwd.keyDerivationFunctionPropertiesForPasswordVerification = derivedKeyLength = 32 Caleb

15 years, 1 month

1
0
0 0

Re: [xwiki-devs] [Proposal] Code names for XWiki release cycles

by Jerome Velociter

----- "Asiri Rathnayake" <asiri.rathnayake(a)gmail.com> wrote: > Hi, > > On Wed, Aug 11, 2010 at 9:10 PM, Ecaterina Valica <valicac(a)gmail.com> > wrote: > > > I think is a good idea to have code names for the releases, but I'm > not so > > sure about "cocktail names". > > > > +1 > > I'm also not sure if cocktail names are very catchy, may be we should > go for > a scheme that is commonly understood everywhere in the world (i > personally > don't know what different cocktails are out there). May be planets, > elements > of periodic table, different gems, etc. etc. If everybody can understand it, then it's not a good code name ;) More seriously, I think it does not matter if people understand it or not. Personally I don't know what a Warty Warthog is, but if it raises curiosity in me and makes me dig it, then I'll learn something and everybody wins :) For me the cocktail thing is a good scheme because it has a story behind it. Jerome. > > - Asiri > > > > > > The only other naming convention we have is skin names: > > > > > http://dev.xwiki.org/xwiki/bin/view/Community/DevelopmentPractices#HUsingbi… > > > > Also not so sure that should be decided just by the release manager > (there > > is quite a small list of people that do releases) > > > > Thanks, > > Caty > > > > > > > > > Le 11 août 2010 à 17:17, Jerome Velociter <jerome(a)xwiki.com> a > écrit : > > > > > > > Hello friends, > > > > > > > > I would like to propose introducing the use of code names for > each > > > release cycle of XWiki (2.x, 3.x, etc.), using a agreed-on scheme > (a la > > > Ubuntu [1]). The main reason behind this proposal is that : > > > > > > > > A. it's groovy :) > > > > B. there is no B. > > > > > > > > As for the code name scheme, with regard to recent events > involving a > > > fair portion of the XWiki Development team [2], I would like to > propose > > the > > > use of cocktail names as code names. Some examples - for the sake > of > > > illustration : XWiki "Cuba Libre" 2.5, XWiki "White Russian" 2.6, > XWiki > > > "Bloody Mary" 3.0, etc. you name it! [3]. Virgin cocktails > tolerated :) > > > > > > > > The release manager for each cycle would have the honor to pick > up the > > > release code name. Isn't that an awesome incentive ? > > > > > > > > +1 for all that > > > > > > > > Jerome. > > > > > > > > [1] https://wiki.ubuntu.com/DevelopmentCodeNames > > > > [2] > http://www.xwiki.com/xwiki/bin/view/Blog/XWiki+Seminar'10<http://www.xwiki.com/xwiki/bin/view/Blog/XWiki+Seminar%2710> > > <http://www.xwiki.com/xwiki/bin/view/Blog/XWiki+Seminar%2710> > > > > [3] http://en.wikipedia.org/wiki/List_of_cocktails > > > > _______________________________________________ > > > > devs mailing list > > > > devs(a)xwiki.org > > > > http://lists.xwiki.org/mailman/listinfo/devs > > > _______________________________________________ > > > devs mailing list > > > devs(a)xwiki.org > > > http://lists.xwiki.org/mailman/listinfo/devs > > > > > _______________________________________________ > > devs mailing list > > devs(a)xwiki.org > > http://lists.xwiki.org/mailman/listinfo/devs > > > _______________________________________________ > devs mailing list > devs(a)xwiki.org > http://lists.xwiki.org/mailman/listinfo/devs

15 years, 1 month

1
0
0 0

[xwiki-devs] [proposal] Add cryptography api component and script service to xwiki

by Caleb James DeLisle

Hello all, I you have been watching on irc and in the sandbox commit notifications you know Alex and I have been working hard on developing some high quality cryptographic services, I think it is ready to add to the core. What xwiki-crypto provides: * PasswordVerificationFunction provides ability to protect ("hash") a password using functions which require a configurable amount of processor power and RAM. This allows a configurable level of difficulty for password guessing attacks and configurable memory costs even frustrate hardware (GPU) based cracking attempts. This uses a standards conforming implementation of what is a truly state of the art password hashing technology developed by Colin Percival, deputy security officer for FreeBSD operating system. The design paper is here: http://www.tarsnap.com/scrypt/scrypt.pdf This will be able to be used for http://jira.xwiki.org/jira/browse/XWIKI-70 (Safe password storage) * Password based encryption using the function defined above for converting the password to the encryption key. The default encryption algorithm is CAST-5 which has been used by PGP encryption system. * RSA-2048 key generation and text signature. Option #1: Generate key in user's browser (Supports Firefox and Opera, possible to add IE support.) and be able to use the crypto.signText function in javascript allowing for signature which are unforgable even by the administrator (or hacker) of the server. Option #2: Generate key on the server and store password encrypted (see above) allowing for "pretty good" level of signature non-reputability. What this will look like to a script: ## Password Encryption #set($ciphertext = $services.crypto.passwd.encryptText("this is a secret", "hopefully a strong password")) ## Password Decryption #set($plaintext = $services.crypto.passwd.decryptText($ciphertext, "hopefully a strong password")) ## Protecting a password (so can be validated but the original can't be derived from the protected password and it's hard to do password guessing attacks) #set($safePassword = $services.crypto.passwd.protectPassword($userSuppliedPlaintextPassword) ## Validating a password against the "safe password" #if($services.crypto.passwd.isPasswordCorrect($userSuppliedPlaintextPassword, $safePassword) you win! #end ## Generating a key in the user's browser (this won't likely be used often) ## $spkac is a public key given by the browser when the user clicks on the create certificate button, this is compatible with FOAFSSL. ## 365 is the number of days the certificate should be valid for. ## this returns 2 certificate, one is the user's and the other is a self signed authority which trusts it. #set($certAndAuthority = $services.crypto.x509.certsFromSpkac($spkac, 365)) ## Generating a key (x509 certificate + private key) on the server side (this won't likely be used often) ## this returns an XWikiX509KeyPair #set($privateKeyAndCert = $services.crypto.x509.newCertAndPrivateKey(365, "password for protecting private key") ## Serializing a keyPair to a base64 string (this does not conform to any standard because no decent standard was available) #set($keyPairAsString = $privateKeyAndCert.serializeAsBase64()) ## Deserializing the keypair back from the string #set($privateKeyAndCert = $services.crypto.x509.keyPairFromBase64($keyPairAsString) ## Signing text with a "$privateKeyAndCert" ## This outputs a base64 String representing the signature. #set($signature = $services.crypto.x509.signText("this is the text I want to sign", $privateKeyAndCert, "password for protecting private key") ## Verifying text (this verifies text signed with either the above signText function or with the mozilla/opera javascript crypto.signtText function.) ## this outputs an XWikiX509Certificate object which can then be compared to known trusted certificates. #set($signingCertificate = $services.crypto.x509.verifyText("this is the text I want to sign", $signature)) ## Serializing a certificate as a String in conforming PEM format (readable by OpenSSL) #set($pemString = $signingCertificate.toPEMString()) ## Deserializing a certificate from PEM format #set($signingCertificate = $services.crypto.x509.certFromPEM($pemString) The interfaces: http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-crypto/src/main/ja… http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-crypto/src/main/ja… http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-crypto/src/main/ja… http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-crypto/src/main/ja… WDYT? Caleb

15 years, 1 month

5
7
0 0

[xwiki-devs] How to tag pages via XMLRPC (xwiki 2.4)

by Kirst Martin Wolfgang

Hi, I want to automatically tag some pages within our XWiki (v2.4) via XMLRPX API. I've setup my eclipse for automatic uploading of pages and attachments, but I can't find any documentation how to tag pages. Simple question: how can I tag pages via XMLRPC? It seems to me, that the solutions lies within "XWikiXmlRpcClient#storeObject(XWikiObject)". But how are the parameters? Regards Martin

15 years, 1 month

2
3
0 0

[xwiki-devs] Fwd: [xwiki-notifications] XWiki updates, 9 documents have been modified since 2010/08/05 00:00

by Jerome Velociter

Seems some content is missing. The summary refers to "XWiki JavaScript API" and "XWiki API Reference" pages, but they do not appear in the body of the mail. Anyone knows what could cause this ? Jerome. ----- Forwarded Message ----- From: notifications(a)xwiki.org To: notifications(a)xwiki.org Sent: Friday, August 6, 2010 12:00:18 AM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna Subject: [xwiki-notifications] XWiki updates, 9 documents have been modified since 2010/08/05 00:00 Contents • dev • Community • Release Plans • Release Plans Archives • IRC • IRC Archive for channel #xwiki • platform • DevGuide • XWiki API Reference • XWiki JavaScript API • xwiki • XWiki • ChristophDewes • JarbasJunior • guenter • pmarzouk Hello Developers, This message is sent by XWiki. Here are the documents in your watchlist that have been modified since the last notification: dev Community Release Plans Community.ReleasePlans On 2010/08/05 13:49, the document has been modified by Thomas Mortagne * [[API doc>>http://platform.xwiki.org/xwiki/bin/view/DevGuide/API]] ([[core>>http://maven.xwiki.org/releases/com/xpn/xwiki/platform/xwiki-core/]] [[rendering>>http://maven.xwiki.org/releases/org/xwiki/platform/xwiki-core-rendering-api…) doc>>http://platform.xwiki.org/xwiki/bin/view/DevGuide/API]] |= Release notes |= Update download page |= News on OW2 |= News on xwiki.org |= API doc (core rendering) |= Wikipedia |= Freshmeat |= Wikimatrix |= ANN Mail = 2.3.2 = (% style="width: 100%;" %) |=(% colspan="3" %)Update translations |= CORE |= XE |= WYSIWYG | x| x| x (% style="width: 100%;" %) |=Module |= Version |= Jira |= Maven |= OW2 | xwiki-core | 2.3.2| x| x| - | xwiki-plugin-skinx| 1.13.1| x| x| - | xwiki-platform-web | 2.3.2| x| x| - | xwiki-product-enterprise | 2.3.2| x| x|x\\ | xwiki-product-enterprise-manager| 2.3.2| x| x|x (% style="width: 100%;" %) |= Release notes |= Update download page |= News on OW2 |= News on xwiki.org |= API doc (core rendering) |= Wikipedia |= Freshmeat |= Wikimatrix |= ANN Mail |x|x| x|x| x|x| x|x|x author: xwiki:XWiki.Sergiu > xwiki:XWiki.ThomasMortagne Release Plans Archives Community.ReleasePlansArchives On 2010/08/05 13:49, the document has been modified by Thomas Mortagne = 2.3.2 = (% style="width: 100%;" %) |=(% colspan="3" %)Update translations |= CORE |= XE |= WYSIWYG | x| x| x (% style="width: 100%;" %) |=Module |= Version |= Jira |= Maven |= OW2 | xwiki-core | 2.3.2| x| x| - | xwiki-plugin-skinx| 1.13.1| x| x| - | xwiki-platform-web | 2.3.2| x| x| - | xwiki-product-enterprise | 2.3.2| x| x|x\\ | xwiki-product-enterprise-manager| 2.3.2| x| x|x (% style="width: 100%;" %) |= Release notes |= Update download page |= News on OW2 |= News on xwiki.org |= API doc (core rendering) |= Wikipedia |= Freshmeat |= Wikimatrix |= ANN Mail |x|x| x|x| x|x| x|x|x parent: Scheduler.ReleasePlans > ReleasePlans author: xwiki:XWiki.Sergiu > xwiki:XWiki.ThomasMortagne IRC IRC Archive for channel #xwiki IRC.xwikiArchive20100805 Between 2010/08/05 01:24 and 2010/08/05 21:48, the document has been modified 3 times, by 1 user: Sergiu Dumitriu #includeForm("IRC.IRCArchiveClassSheet") IRC.IRCArchiveClass channel: #xwiki content: abusenius left at 01:24 (Quit: Konversation terminated! sdumitriu left at 02:23 (Ping timeout: 240 seconds tsziklay left at 03:12 (Quit: ChatZilla 0.9.86 [Firefox 3.6.8/20100722155716] boscop_ joined #xwiki at 03:53 boscop left at 03:56 (Ping timeout: 265 seconds MartinCleaver left at 04:35 (Quit: MartinCleaver venkatesh joined #xwiki at 05:49 kibahop joined #xwiki at 08:27 LadySerena left at 08:36 (Quit: Time to sharpen my claws! asrfel joined #xwiki at 08:41 sdumitriu joined #xwiki at 08:52 Enygma` joined #xwiki at 08:52 mflorea joined #xwiki at 08:56 lucaa joined #xwiki at 08:56 florinciu joined #xwiki at 09:05 tmortagne joined #xwiki at 09:06 tmortagne left #xwiki at 09:06 mflorea left at 09:21 (Quit: Leaving. tmortagne joined #xwiki at 09:23 mflorea joined #xwiki at 09:24 vmassol joined #xwiki at 09:32 mflorea - (09:36): guys, how can I delete a translation of a wiki page? tmortagne left at 09:36 (Quit: Leaving. sdumitriu - (09:37): mflorea: Add ?language=xz in the /delete/ URL tmortagne joined #xwiki at 09:38 mflorea - (09:38): let me try sdumitriu - (09:38): Works only if that’s not the default language of the document ztane - (09:48): how do I get the password reset dialog working on a private wiki? :) vmassol left at 09:50 (Quit: Leaving. KermitTheFragger joined #xwiki at 09:54 tmortagne - (09:54): sounds like a long proposal :) mangroovie joined #xwiki at 09:54 ztane - (09:56): hmm maybe should go for ldap sdumitriu - (09:56): ztane: Private = forbid unauthenticated view? ztane - (09:57): yes ztane - (09:58): enterprise extranet wiki :)) cjdelisle - (09:59): It has been a long time coming. Oddly enough there aren’t a real lot of services provided. ztane - (09:59): do not want anything to leak out to nonauthorized, except the password reset form jvdrean joined #xwiki at 10:04 sdumitriu - (10:11): ztane: Sorry, that’s not possible yet sdumitriu - (10:12): Preventing unauthenticated access really prevents it abusenius joined #xwiki at 10:21 vmassol joined #xwiki at 10:23 cjdelisle - (10:28): abusenius: Any thing else you need in xwiki-crypto? (working on the proposal) abusenius - (10:32): hm, no, just the methods for storing/loading certs/keys that we might want put elsewhere abusenius - (10:32): *to put cjdelisle - (10:33): Yea, IMO load/store is not really in the scope of crypto. abusenius - (10:35): should I move it to signedscripts? thats the only place it’s used atm cjdelisle - (10:36): *distraction: IPv6 is a joke, 19.0.0.0 - 19.255.255.255 is Ford Motor Company ip space, it is not even announced to the backbone routers. cjdelisle - (10:36): What car company doesn’t need 16,000 unused ips? abusenius - (10:36): *IPv4? cjdelisle - (10:37): IP6 is a joke because like 40% of ip4 numbers are routed, 3% respond to pings. abusenius - (10:37): it’s a good investment, they will be able to sell it for a lot of money quite soon :) cjdelisle - (10:37): Not if arin/ripe catch you. abusenius - (10:37): well, it’s just that nobody uses them abusenius - (10:38): well, thats another question cjdelisle - (10:38): Well not nobody, some halliburton space suddenly started getting announced from eastern europe. cjdelisle - (10:38): spam spam spam spam cjdelisle - (10:41): Halliburton 34.0.0.0 - 34.255.255.255 (to their credit they announce a couple hundred ips in that range and run their site in it.) abusenius - (10:42): I’Ve read somewhere that one of the problems is that they used to give just 2 types of ip ranges, 255.255.255.0 for "small" companies and 255.0.0.0 for "big" companies :) cjdelisle - (10:45): that 255.255.255.0 is called a /24 because 24 of the 32 bits are defined. 255.0.0.0 is a /8, nobody can get a /8 anymore, they gave them out in like 1991. cjdelisle - (10:46): You guys can still get a /24 for like 150€ but arin won’t sell anything smaller than a /20. cjdelisle - (10:48): The problem is provide independent space means you announce your (tiny little) range to all of the backbone routers and the global routing tables get so huge they need bigger routers. cjdelisle - (10:50): What’s easiest for the backbone is if 192 routes to usa, 64 routes to chicago, 32 routes to some isp and 25 routes to the specific computer. Except 192 range is not like that, 192.64.32.1 might be a computer in chicago and 192.64.33.1 might be in estonia. sburjan joined #xwiki at 10:52 cjdelisle - (10:57): humpf... decryption succeeded with wrong password. I think it decrypted to garbage but I have to check... abusenius - (10:57): we might want to check if the output == input cjdelisle - (11:00): yup, repeating the test in loop 0-1000 cjdelisle - (11:01): if the output is the same length, I think the padding scheme doesn’t notice anything is wrong. cjdelisle - (11:01): indeed, I already have a bad decryption. abusenius - (11:03): in theory, a wrong password might decrypt to any meaningful text, but the probability is very very low cjdelisle - (11:04): hmm, actually the key would have to be as long as the original text to decrypt to anything. cjdelisle - (11:05): I remember someone talking about an algorithm which would decrypt to various things based on the password given. cjdelisle - (11:05): It would be pretty obvious to a cryptographer though that there was more to it though. abusenius - (11:06): well, if the key is as long as the text, then you can decrypt to any text of the same length abusenius - (11:07): if the key is shorter, the number of possible decryptions is much smaller cjdelisle - (11:07): But it brings up an interesting topic, if you xor "illegal data" against random and publish the random on one server and the output on another, which server gets the takedown notice? abusenius - (11:07): but one of them might still be meaningful cjdelisle - (11:08): It’s essentially impossible to determine random from something xor’d against random. cjdelisle - (11:09): 4 collisions. abusenius - (11:09): well, you can easily invent any content you want :) abusenius - (11:09): what yre you encrypting? cjdelisle - (11:10): I just rigged the test to repeat trying to decrypt with the wrong password and dump any time it collides. Enygma` left at 11:10 (Ping timeout: 276 seconds cjdelisle - (11:10): decryptWithWrongPasswordTest() * 1000 abusenius - (11:11): so "collision" = successfull decryption to garbage? cjdelisle - (11:11): yup. cjdelisle - (11:11): done. 4/1000 tries. abusenius - (11:11): the only way decryption algorithm can distinguish "meaningful" text from garbage is the padding kibahop left #xwiki at 11:12 cjdelisle - (11:12): IMO it should output garbage every time it fails. Imagine trying to password guess that :D abusenius - (11:12): so if the garbage by chance contains one byte of correct padding, it will succeed abusenius - (11:12): well, you can check for printable character for example cjdelisle - (11:12): yup, check for invalid utf8 cjdelisle - (11:13): imagine encrypting an mp3, basically any text is valid in an mp3 cjdelisle - (11:13): or mpeg4 abusenius - (11:13): there is a header you can trry to match abusenius - (11:14): frames etc. abusenius - (11:14): but it is harder abusenius - (11:14): thats one of the reasons people first compress, then encrypt :) cjdelisle - (11:16): Yea, it would be tough trying to beat this algorithm though, it took like 5 minutes for 2000 cycles of scrypt, I could make it take longer with config too. cjdelisle - (11:27): proposal sent. mangroovie left at 11:29 (Ping timeout: 252 seconds cjdelisle - (11:41): I don’t see the user manager in the sandbox, is it written? (http://dev.xwiki.org/xwiki/bin/view/Design/UsersModule) abusenius - (11:42): it is very new imo, probably not yet cjdelisle - (11:45): The proposed interface looks like it can only be implemented using some sort of String USER_CLASS = "XWiki.XWikiUsers"; cjdelisle - (11:47): Maybe I should propose a best practice that we never make the core depend on the content of the database. AKA hardcoding document names. abusenius - (11:51): which interface? cjdelisle - (11:53): defined here http://dev.xwiki.org/xwiki/bin/view/Design/UsersModule mangroovie joined #xwiki at 11:53 venkatesh left at 11:53 (Ping timeout: 265 seconds abusenius - (11:54): ah, ok abusenius - (11:56): maybe, I "never ever" rule is quite unrealistic though abusenius - (11:56): s/I/a/ cjdelisle - (11:58): Well that’s how all best practices are, sometimes you are just plain painted into a corner. cjdelisle - (11:58): I usually end up throwing away code when that happens. abusenius - (12:01): moved cert storage methods out of crypto, about to commit cjdelisle - (12:01): there was storage in crypto? cjdelisle - (12:02): I don’t see it... abusenius - (12:03): well, user document utils were misused for that abusenius - (12:04): I mean listinf fingerprints etc. abusenius - (12:04): *listing venkatesh joined #xwiki at 12:04 cjdelisle - (12:04): Oh, I haven’t looked there in a while. thanks ;) cjdelisle - (12:04): k I think I know how you can validate a cert. cjdelisle - (12:05): Take the webid and do a http get on it, you’ll get the foafssl stuff. cjdelisle - (12:06): We can also set it up so you get a list of signed permissions granted to the user. abusenius - (12:07): yea, we could do that cjdelisle - (12:07): parse those permissions, extract cert from signature, recurse. cjdelisle - (12:08): It will be awesome but slooooooow. cjdelisle - (12:09): hmm, maybe not if the user pages get cached. abusenius - (12:09): the recursion would not be very deep abusenius - (12:09): unless we overdo it :) venkatna joined #xwiki at 12:10 abusenius - (12:10): it should be something like admin -> user permission -> cert cjdelisle - (12:10): What’s awesome about it is I can be on one wiki and give you permission on another, you can then give permissions to people on my wiki. venkatesh left at 12:10 (Ping timeout: 248 seconds abusenius - (12:11): not that everybody was waiting to do that all their life, but yea, would be possible :) cjdelisle - (12:12): I don’t expect anyone beating a path to the door for it but I can see in the future there might be applications. cjdelisle - (12:13): If I grant admin authority to an admin of another wiki, all of their wiki’s users get defacto permissions on mine. cjdelisle - (12:15): the escaping test makes a nice DoS engine. abusenius - (12:16): :) cjdelisle - (12:17): Have you seen Websecurity? abusenius - (12:18): not sure what you mean abusenius - (12:18): afk for lunch cjdelisle - (12:19): http://www.websecurify.com/ cjdelisle - (12:19): I’ll go find something to eat too. florinciu1 joined #xwiki at 12:39 florinciu left at 12:44 (Ping timeout: 276 seconds florinciu1 left at 12:46 (Read error: Connection reset by peer florinciu joined #xwiki at 12:47 sylviarusu joined #xwiki at 12:56 florinciu left at 13:05 (Ping timeout: 240 seconds florinciu joined #xwiki at 13:08 tmortagne - (13:10): cjdelisle: i’m not sure i understand what you mean in XWIKI-5390 cjdelisle - (13:10): http://maven.xwiki.org/site/xwiki-core-parent/xwiki-core/apidocs/com/xpn/xw… cjdelisle - (13:11): all still version 1.7 tmortagne - (13:12): cjdelisle: there is a hudson project for it already, that’s http://hudson.xwiki.org/job/xwiki-platform-core-site-job/ but it has been disabled some time ago because we had issue with javadoc plugin think tmortagne - (13:12): s/think/I think/ cjdelisle - (13:13): I see, I can try to see if I can get it working again. tmortagne - (13:13): yep cjdelisle - (13:13): It’s pretty important because that’s the only place to get javadoc for XWikiDocument etc. tmortagne - (13:14): cjdelisle: well there is m2Eclipse automatically downloading javadoc/source too ;) tmortagne - (13:14): which is very usefull tmortagne - (13:15): but it’s only for released projects cjdelisle - (13:15): When I wrote the DevGuide.Scripting I had to reference some javadoc so I chose that. cjdelisle - (13:15): Because it’s hosted. cjdelisle - (13:16): If I can get this working then I see no reason to keep uploading .zip files to xwiki.org so that will close another issue. cjdelisle - (13:16): Make any sense? tmortagne - (13:17): cjdelisle: it’s not the same thing tmortagne - (13:17): this job deploy trunk jaavadoc tmortagne - (13:17): in xwiki.org we provide specific releases javadoc cjdelisle - (13:17): hmm. good point. Maybe we can have hudson build from branches? tmortagne - (13:17): what should be done in xwiki.org is having something more dynamic that get the proper javadoc from maven.xwiki.org files instead of having to attach tmortagne - (13:18): i want to add this since a long time in zip plugin but never had the time cjdelisle - (13:18): in the zip plugin? tmortagne - (13:19): the xwiki plugin which is used to view the javadoc inside the zip file attached to the page tmortagne - (13:19): http://platform.xwiki.org/xwiki/bin/download/DevGuide/API/xwiki-core-render… cjdelisle - (13:19): make it able to load a page hosted somewhere else? cjdelisle - (13:19): s/load a page/read a zip/ tmortagne - (13:20): yes make it able to work with a zip from anywhere and not only an attached file cjdelisle - (13:20): hmm, as long as it can’t be exploited to... say open really big zips somewhere? abusenius - (13:21): re websecurity, no, haven’t seen it before cjdelisle - (13:22): I was talking to a guy who mentioned if you can convince a bot to download a file, feed it a linux .iso tmortagne - (13:23): cjdelisle: you can always indicate a maximum size abusenius - (13:23): we should try some tools like websecurity on xwiki at some point, but not now (would be too disappointing ^^) florinciu left at 13:23 (Ping timeout: 258 seconds cjdelisle - (13:23): abusenius: I see a bunch of FATAL: not escaping single quote. cjdelisle - (13:23): I don’t think even escapetoo.xml escapes single quotes. tmortagne - (13:24): checking something: i think there is something abut javadoc in nexus actually abusenius - (13:24): it does abusenius - (13:24): getXMLEncoded doesn’t cjdelisle - (13:24): That’s right :) abusenius - (13:24): afaik abusenius - (13:24): it is technically correct to not escape single quotes in URL abusenius - (13:25): but not secure, because a href=’bla’ is also correct cjdelisle - (13:25): no getXMLEncoded escapes ’ to and it becomes ’ which breaks everything abusenius - (13:25): ah, right tmortagne - (13:25): cjdelisle: http://nexus.xwiki.org/nexus/service/local/repositories/releases/archive/co… tmortagne - (13:25): tadaa cjdelisle - (13:25): cool. I wish it said something like /latest/ tmortagne - (13:26): maybe there is something tmortagne - (13:27): i will at least modify the API page to go there and stop attaching files abusenius - (13:27): is it possible to link javadocs for *all* components on DevGuide/API ? abusenius - (13:28): currently it only lists core tmortagne - (13:28): abusenius: and rendering ;) tmortagne - (13:28): but yes it should be more that theses two tmortagne - (13:28): should be at least important components abusenius - (13:28): yea, but you need to do voodoo magic to find other docs :) cjdelisle - (13:29): That was a nice thing about maven.xwiki.org was everything was linked together. tmortagne - (13:31): cjdelisle: you mean maven.xwiki.org/site ? cjdelisle - (13:31): yup cjdelisle - (13:32): *idea* What if we added the svn location to the class javadoc comment in each class, then it will make a link in each javadoc pointing to the source. cjdelisle - (13:32): Maybe svn config will do the trick. abusenius - (13:33): wasn’t there a configuration option for javadoc for that? tmortagne - (13:34): cjdelisle: there is probably some maven javadoc plugin configuration we could use for it cjdelisle - (13:34): I don’t know that the javadoc would know where the files are hosted in svn, it sure would be nice though to have a docjar style [source] button abusenius - (13:35): (but maybe I saw it in doxygen, not sure) cjdelisle - (13:36): I really like this format everything is linked from there. http://maven.xwiki.org/site/xwiki-core-parent/xwiki-core/apidocs/index.html… abusenius - (13:38): http://download.oracle.com/javase/1.4.2/docs/tooldocs/windows/javadoc.html#… ? cjdelisle - (13:39): abusenius: I see three tests in error: Blog/Publisher.xml Panels/CreatePanel.xml templates/createinline.vm Do you want to do something to them before putting the tests in the tree? abusenius - (13:40): let me see cjdelisle - (13:40): Creates an HTML version of each source file (with line numbers) argh.. hate line numbers. abusenius - (13:41): well, better than nothing abusenius - (13:43): I could put those tests in error onto ignore list cjdelisle - (13:43): also I like the idea of pointing to the actual svn server. abusenius - (13:43): 2 of them fail because the xredirect is properly escaped, but my test string isn’t a URL abusenius - (13:43): 1 fails with 409, no idea why abusenius - (13:44): there are allready a dozen or so ignored tests in error cjdelisle - (13:46): Hmm, you really ought to have commit access so you can work on this once it’s in the tree, unfortunately it’s tough to get a quorum on anything right now. florinciu joined #xwiki at 13:46 venkatna left at 13:47 (Quit: Leaving abusenius - (13:48): can it be (sym)linked to sandbox? cjdelisle - (13:50): I don’t know what svn does with symlinks. abusenius - (13:51): I think on all decent operating systems it works fine :) cjdelisle - (13:51): Websecurity is a pretty good DoS cannon, when I ran it locally, my wiki eventually just ceased up and refused to serve anything. abusenius - (13:52): checkout on windows would create a copy of the directory tmortagne - (13:53): i doubt svn will support sym links anyway tmortagne - (13:53): especially svn 1.4 abusenius - (13:53): ok, if the svn server is 1.4 then we can forget it abusenius - (13:54): why is it 1.4 btw? it’s like stone age... tmortagne - (13:55): i agree tmortagne - (13:55): i’m aking for an upgrade since ages cjdelisle - (13:55): blah, hudson ceased up in wysiwyg test. Lets see if I can kill the build... cjdelisle - (13:56): yay I did something. cjdelisle - (13:58): last time the javadoc build ran out of swap space (so it says). I’ll try running it and see what happens this time. vmassol left at 13:58 (Quit: Leaving. sburjan - (14:08): cjdelisle, : was the implementation hard ? I mean .. understanding that technical paper and then implementing cjdelisle - (14:08): re scrypt? sburjan - (14:08): We had to implement DES and AES from specs like these..and it was HORRIBLE sburjan - (14:08): yes cjdelisle - (14:08): It wasn’t too bad because there was a reference implementation in c sburjan - (14:09): oh, so you didn;t wrote if from scratch cjdelisle - (14:09): It definitly is not AES. sburjan - (14:09): it’s stronger than AES, right sburjan - (14:09): AES is totally hard (at least for me) cjdelisle - (14:09): It does something different. sburjan - (14:09): yeah, I know cjdelisle - (14:10): The point is that there is no way to go from the password to the key without using x amount of ram for y cpu cycles of time. cjdelisle - (14:10): Fortunately it uses PBKCS2 which I could rip from bouncycastle. sburjan - (14:10): but basically this is a much more complex hash function, right ? cjdelisle - (14:11): yup. sburjan - (14:11): md5 is birthday paradox vulnerable sburjan - (14:11): I guess this isn;t :) cjdelisle - (14:11): It uses PBKCS2, and it uses salsa20 cjdelisle - (14:11): ahh, PBKCS2(Sha-256) :) cjdelisle - (14:12): yea md5 is bad. sburjan - (14:12): oh :)) sburjan - (14:12): md5 is obsolete sburjan - (14:12): intresting sburjan - (14:12): I never understood properly the algebra behind crypto systems sburjan - (14:13): although i wanted to :) cjdelisle - (14:13): This isn’t really crypto. cjdelisle - (14:13): It’s just designed to take a long time. cjdelisle - (14:13): So it generates an absurd amount of data. Then it takes an int from 4 bytes of a hash output and gets the data at the location of that int. cjdelisle - (14:14): The idea is you can’t safely throw away any of that data because you might need it. sburjan - (14:14): I see sburjan - (14:14): so this happens for all the new passwords ? sburjan - (14:14): new user accounts, etc ? sburjan - (14:15): I nea this happens for every password cjdelisle - (14:15): So it keeps seeding the hash with pieces of the big block of data, then it takes the output and feeds it to PBKDF2 again. sburjan - (14:15): *mean cjdelisle - (14:16): No it it’s just a service at the moment, once I convince everyone to include it in the tree, then we can think about using it for the user accounts. sburjan - (14:16): so what do you hash with these service more exactly ? cjdelisle - (14:16): Passwords. sburjan - (14:16): so only user passwords. or are there another type of passwords ? sburjan - (14:17): that are used in xwiki cjdelisle - (14:17): It is intended to be useable for the user accounts, I just want to put the code there before we even talk about implementing it for user passwords. cjdelisle - (14:17): Sure, any password can be handles by this. sburjan - (14:17): I see cjdelisle - (14:17): s/handles/handled/ abusenius - (14:17): btw, XWIKI-70 is the oldest bug (i.e. not feature request or task) atm sburjan - (14:18): so it is collision free ? or you made it like this in order to take as far as possible advante of collisions Enygma` joined #xwiki at 14:18 cjdelisle - (14:18): It is as collision resistant as pbkdf2(sha256) cjdelisle - (14:19): because the password is included in the final hash. sburjan - (14:19): yeah, but the time to find another string that hashes the same... requires much more time due to y ram and x cpu cycles, right ? cjdelisle - (14:20): Well the main attack vector is password guessing with word lists. cjdelisle - (14:20): so it’s not really a collision but the real password that is most likely to be found. sburjan - (14:20): hmmm sburjan - (14:21): dictionary attack ? :) cjdelisle - (14:21): This makes it difficult because it occupies 1MB of ram for about 100milliseconds. sburjan - (14:21): i see cjdelisle - (14:21): These numbers are configurable. sburjan - (14:21): but the actual auth mechanism is comparing the hash from db with the hash(typed password), right ? cjdelisle - (14:21): The default scrypt takes 200MB for 5 seconds. sburjan - (14:22): like md5 is still used cjdelisle - (14:22): It’s a little more complicated than that, but that’s the idea. sburjan - (14:22): I see cjdelisle - (14:22): You have a PasswordVerificationFunction which is Serializable and includes all of the information to recreate the same output given the same password. cjdelisle - (14:23): that is the salt, the memory cost number, and the processor cost number. sburjan - (14:23): yeah.. sburjan - (14:23): intresting cjdelisle - (14:24): So you load the code from the database, deserialize, and feed it the password to validate. cjdelisle - (14:24): If we decide in the future to change the function, all we need to do is create a new function and start using it for all new passwords. sburjan - (14:24): so each password is serialized in an object that is stored in the db ? cjdelisle - (14:25): the ourtput from hashing the password is a byte[] in the object yes. sburjan - (14:25): I see sburjan - (14:25): pretty cool cjdelisle - (14:26): http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-crypto/src/main/ja… sburjan - (14:26): and what is the memory and cpu cost going in the ecuation? sburjan - (14:26): when "hashing" the inputed password in order to compare it from the serialized object ? cjdelisle - (14:27): Configurable, but I have it set to 1Mb for 100ms by default. sburjan - (14:28): yeas, but what operation is slowed down intensionally with the ram and CPU thing ? cjdelisle - (14:28): indeed, you can’t have everything :) boscop_ is now known as boscop (~boscop(a)g227154161.adsl.alicedsl.de sburjan - (14:30): no no .. where is the slow down come in place ? sburjan - (14:30): this this slows down .. you wanted this.. cpu cycles, etc cjdelisle - (14:31): ? sburjan - (14:32): you force the system to work in time. to be limited by ram and CPU sburjan - (14:32): not to take advance of the full computational powers of a possible attacker cjdelisle - (14:32): If the system is under heavy load when the user registers, then their crypted password will be weaker. cjdelisle - (14:33): decrypting the password will always take the same amount of cpu cycles. sburjan - (14:33): oh sburjan - (14:33): so decrypting is the operation that takes advantage of the intentional slowness sburjan - (14:33): got it cjdelisle - (14:34): When crypting the password, It does a test run to get the desired number of cycles from the desired time to crypt. cjdelisle - (14:34): It’s not all that accurate but within 100% according to the tests. sburjan - (14:35): I see cjdelisle - (14:35): I noticed it usually takes a little more time than it is asked to take. sburjan - (14:36): and isnt there a disk if someone tries a dictionary attack to block the server (DDOS) due to heavy platform load in order to decrypt the passwd ? sburjan - (14:36): *risk, not disk cjdelisle - (14:37): Well if you’re trying to ddos the server then you can use infinite loops etc. if you are trying to guess the password, then you want a graphics processor. cjdelisle - (14:37): Anyway if you have a botnet (DDoS) then you can get thousands of windows boxes to try passwords locally. cjdelisle - (14:39): However I think you can cease up an xwiki installation just by trying to log in with a million threads right now. cjdelisle - (14:41): bbiab... tmortagne left at 14:43 (Read error: Connection reset by peer tmortagne joined #xwiki at 14:43 sburjan - (14:46): wait, you lost me :) sburjan - (14:47): the decrypt function is GPU dependant ? MartinCleaver joined #xwiki at 14:57 abusenius - (14:59): sburjan: he is talking about using GPGPU to speedup breaking hashes sburjan - (15:01): so it uses graphics card to break hashes ? abusenius - (15:01): the bad guys use them sburjan - (15:01): I;m a little bit confused sburjan - (15:01): yeah, the bad guys abusenius - (15:01): yes, 1000 threads are better than 4 sburjan - (15:02): a gpu has 1000 threads ? abusenius - (15:02): new ones yes sburjan - (15:02): I see abusenius - (15:02): light-weight threads sburjan - (15:02): and the other thing I didn’t understand sburjan - (15:02): Anyway if you have a botnet (DDoS) then you can get thousands of windows boxes to try passwords locally. sburjan - (15:03): but how do you get locally the serialized objects that contain the passwdz ? abusenius - (15:03): well, assuming you have DB dump or something sburjan - (15:03): but for that you already need privileges abusenius - (15:03): sure abusenius - (15:04): the idea is, if the attacker can get access to the server, he still can’t find out your password abusenius - (15:05): otherwise you might as well just sleep(10) on the server side abusenius - (15:06): having a password in cleartext is bad, because people reuse them for example cjdelisle - (15:06): privileges lol. All you need for database dumps is bobby tables. cjdelisle - (15:06): we’re better than some but never trust the db. cjdelisle - (15:07): Actually, the password hashes are right in the XWikiUsers object. sburjan - (15:07): bobby tables ? cjdelisle - (15:08): http://xkcd.com/327/ cjdelisle - (15:09): It’s a dumb joke but it has sort of turned into a meme. sburjan - (15:09): yea :)) sburjan - (15:09): but we’re still vulnerable to sql injection ? cjdelisle - (15:10): hmmmmmmm yes. mflorea left at 15:11 (Quit: Leaving. lucaa left at 15:13 (Quit: Leaving. cjdelisle - (15:13): We’re looking into a way to use encryption to make it so sql injection is pointless. sburjan - (15:14): parameterization doesnt work in our case ? cjdelisle - (15:14): If everything used it then it would work. I’m talking about cases where there is a registered user and he has access to searchDocuments etc. sburjan - (15:15): and making them be used everywhere is hard ? cjdelisle - (15:16): Well even if they are used everywhere all the adversary has to do is register and write their own vulnerable queries. cjdelisle - (15:19): We have been talking about having a root "superadmin" certificate stored in a file on the hard disk. That cert signs the admin’s permissions and the admin signs the user permissions. cjdelisle - (15:20): you can dump (or alter) the database but all you get is certificates and password encrypted private keys cjdelisle - (15:20): change a cert, break the cert chain, change a key, then it doesn’t match the cert. cjdelisle - (15:38): oh sburjan Cryptography (at least public key RSA) works because it’s fast to raise something to the 65537th power and slow to get the 65537th root. cjdelisle - (15:39): that’s the "one way trap function" sylviarusu left at 15:40 (Quit: Leaving. sburjan - (15:43): I see sburjan - (15:43): I started to read more about sql injection sburjan - (15:43): too bad that htere isn;t a "training" site :) sburjan - (15:43): so I can actually see it work abusenius - (15:44): try xwiki.org ^^ cjdelisle - (15:45): lol sburjan - (15:45): i’m sure it’s not vulnerable :)) sburjan - (15:45): you guys fixed it sburjan - (15:45): :D sburjan - (15:45): at least the most vital places cjdelisle - (15:45): actually yea, you’d just end up spamming zipe’s logs with your attempts. cjdelisle - (15:45): *xipe cjdelisle - (15:46): Do you have a local installation on your computer? sburjan - (15:46): of XWiki ? cjdelisle - (15:46): yea. sburjan - (15:46): of course sburjan - (15:46): I’m writing automatic tests, so i have to test them :P cjdelisle - (15:47): Well you can play with that. Try using websecurity against it, just run it over night and see what you get abusenius - (15:47): sburjan, there are training apps actually, http://insecurewebapp.sourceforge.net/main/index.html sburjan - (15:48): hmmm sburjan - (15:48): I’ll take a look cjdelisle - (15:49): http://labs.oracle.com/projects/crypto/HowECCWorks-USLetter.pdf cjdelisle - (15:50): McEllice is a bit more interesting because it can’t be parallelized (quantum computer proof) but it’s also a lot more complicated. sburjan - (15:50): lots of math :) sburjan - (15:50): so this is what your srypto implementation use ? cjdelisle - (15:51): it doesn’t use any public key (not for password derivation.) sburjan - (15:52): cjdelisle, : do you have some masters in computer security ? :) sburjan - (15:52): I know abusenius has cjdelisle - (15:52): xwiki-crypto does have a public key component, it just uses rsa. cjdelisle - (15:52): haha masters in what? sburjan - (15:52): information security :) sburjan - (15:53): computer security cjdelisle - (15:53): I took like 2 semesters of programming in college. abusenius - (15:53): there are no special security degrees afaik sburjan - (15:54): abusenius, : There are masters in all the europe on Information/Computer Security abusenius - (15:54): not in my university :) one can just specialize on that cjdelisle - (15:54): My professors were all ex-nsa, one recommended I apply there. sburjan - (15:54): they teach you the algebra behind the cryptosystems abusenius - (15:54): it is still called "computer science" sburjan - (15:55): things like chinese remainder theorem cjdelisle - (15:55): Yea, I read about it a little, I’m sure I’ll learn it sooner or later. abusenius - (15:56): we got this in the introduction lecture to crypto sburjan - (15:56): abusenius, : but your internship is in Security here at X, right ? abusenius - (15:56): yes cjdelisle - (15:57): hey, I have a masters in breakeology. sburjan - (15:57): so you learned the security stuff all by yourself ? abusenius - (15:57): me? sburjan - (15:57): yes, you abusenius :) cjdelisle - (15:57): breakeology, when you learn by breaking stuff. sburjan - (15:57): breakeology is like .. sociology, antropology ? :)) sburjan - (15:58): so you do have a masters in that :D abusenius - (15:58): no, I’ve learned everything I could find, but I also took all lectures on crypto/security we have abusenius - (15:58): if you’re interested in something, it happens naturally :) sburjan - (15:59): true sburjan - (15:59): but that math is pretty hard :)) sburjan - (15:59): all the modulo stuff sburjan - (15:59): remainders, etc cjdelisle - (15:59): I have 5 pdfs in my system tray. sburjan - (15:59): about ? sburjan - (16:00): security ? cjdelisle - (16:00): How to get ips, DDoS defense, anycast, conficker, and ecc. sburjan - (16:00): they should make a book on crypto. Computer Security for retards. and they should dedicate it to me :)) sburjan - (16:01): Well known idiot’s guide is too high level .. I need something lower abusenius - (16:01): :D cjdelisle - (16:01): hah, I noticed that the math all just looks hard with the weird symbols, read the implementation if you want to understand. cjdelisle - (16:01): Look at this: http://cr.yp.to/salsa20.html abusenius - (16:02): I find probability theory harder, groups are not that bad cjdelisle - (16:02): salsa20 is a full cipher implementation in 22 lines. that is why Bernstein is full of win. cjdelisle - (16:03): no stupid s-boxes, no obfuscation. it’s either secure or it’s not and that doesn’t really depend on how hard it is to understand. abusenius - (16:04): thats just because it doesn’t include the implementation of the hash function ;) cjdelisle - (16:04): yea well it’s actually a cipher. Converting it to a hash which is collision resistant and such is a bigger task. cjdelisle - (16:05): but that function placed well in the eurocrypt contest. abusenius - (16:09): in any case, understanding what you can do (and what not) with some type of encryption is more important than implementation details cjdelisle - (16:10): Yea, the devil really is in the details. cjdelisle - (16:12): I remember reading that people were surprised when joanna rutkowska showed that a computer with full disk encryption can still be attacked by putting malware in the mbr. abusenius - (16:12): less related question, how can I change log4j settings of xwiki instance I use for escaping-tests/ abusenius - (16:12): ? abusenius - (16:13): it seems to use debug logging level cjdelisle - (16:14): take a look at start-wiki and start-wiki-debug.sh there might be something there about it. abusenius - (16:15): hm, not really cjdelisle - (16:16): I don’t know, you could google log4j "-D" cjdelisle - (16:17): I’m sure there is a -Dsomething which will change it. abusenius - (16:18): googling... mflorea joined #xwiki at 16:20 sburjan - (16:21): in java a char is 2 bytes, right ? so a 64 bytes string is actually a 32 char string ? cjdelisle - (16:22): yes a char is two bytes :/ sburjan - (16:23): in the link you gave me , it says that it takes a 64 bytes strin. about salsa20 cjdelisle - (16:23): String has a few other components which occupy some space but you’re pretty much correct. sburjan - (16:23): but if the input string is less than 64 bytes/32 chars ? it’s getting padded ? cjdelisle - (16:24): Well the function will run on much larger pieces of data by breaking them up, and yes it pads at the end. cjdelisle - (16:26): The neat thing about salsa is it’s auto seeking. You give it a key and say block 1000, then you input 1000 along with the key and salt, and it generates some output which you can use to decrypt the data. cjdelisle - (16:27): salsa20 doesn’t actually decrypt your data, it generates psudorandom which you then xor against your data. lucaa joined #xwiki at 16:28 sburjan - (16:28): hmmm sburjan - (16:28): so it can be decrypted sburjan - (16:29): afaik md5 is one way hash sburjan - (16:29): alsa is reversible ? cjdelisle - (16:29): yea. cjdelisle - (16:29): Imagine you take a key and md5 it. sburjan - (16:29): oh... big diffrence cjdelisle - (16:30): Actually imagine you take a key, append a number (0) then md5 it. cjdelisle - (16:30): then you take your plain text and xor it against the output from md5. sburjan - (16:31): this is how you decrypt it ? _______________________________________________ notifications mailing list notifications(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/notifications

15 years, 1 month

2
2
0 0

[xwiki-devs] [proposal] add getDocumentURL to DocumentAccessBridge with boolean isFullURL to specify whether the url should be the external document url.

by Caleb James DeLisle

I discovered that there is no way to get the full (external) document url from DocumentAccessBridge. Alex informed me that xwiki-crypto was creating certificates with only a partial url when it should be using the full url. I would like to add this to DocumentAccessBridge: String getDocumentURL(DocumentReference documentReference, String action, String queryString, String anchor, boolean isFullURL); which mimics String getAttachmentURL(AttachmentReference attachmentReference, boolean isFullURL); WDYT? Caleb

15 years, 1 month

2
2
0 0

[xwiki-devs] Syntax highlighter for XWiki!

by Asiri Rathnayake

Hello XWikiers! If you have used syntax highlighter ( http://code.google.com/p/syntaxhighlighter/) in wordpress, blogger etc. you are going to like this one: http://asiri.rathnayake.org/xwiki/bin/view/Macro/MCode Now because of the flexibility of XWiki SSX and JSX, you can easily customize this macro (if you wish to extend it). There are few things I wish if I could improve (implementation details) but I hope this would be useful the way it is now :) Let me know if it looks good. Thanks. - Asiri

15 years, 1 month

2
7
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

xwiki-devs