September 2016 - Pharo-users

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Johan Brichau

> On 21 Sep 2016, at 12:31, Petr Fischer <petr.fischer(a)me.com> wrote: > > Hello, two questions about Seaside sessions: > > 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :( If this is a concern, you can use a cookie for session tracking, but that means you cannot have multiple Seaside sessions running in the same browser at the same time. There are probably other ways, but I think the solution is not to rely on a session key for authentication. Hereâs a strategy: Keep the Seaside session key in the url for session tracking but use an authorization cookie for authorization. Put that cookie when the user logs in and check its presence when requests come in for a session. I think that using a filter for that is a good choice. Whenever another user copy/pastes the url, he cannot âhijackâ the session because he lacks the correct authentication cookie. > 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > Some trick with WAApplication subclass is actual? Iâm not sure what the question is. Do you want to redirect users to a page whenever the session is expired? cheers Johan

Sept. 21, 2016

Re: [Pharo-users] GLMPanePort hold instances of my classes?

by Bernardo Ezequiel Contreras

everything was closed, i was using the simple workspace. but anyways there were references. it was a stupid question, i solved it starting from a fresh image. thanks On Wed, Sep 21, 2016 at 1:16 AM, Tudor Girba <tudor(a)tudorgirba.com> wrote: > Hi, > > You should close the respective Glamour browser. Could it be that you have > an opened inspector? If so, try closing it and see what happens. > > Doru > > > > On Sep 21, 2016, at 3:28 AM, Bernardo Ezequiel Contreras < > vonbecmann(a)gmail.com> wrote: > > > > Hi, > > is there a way to tell to GLMPanePort to release my stupid objects and > classes? > > because i want to change a class and i can't. there's another bug when > migrating > > instances (not easy to reproduce). so im trying to release all the > references. > > is it possible?? > > > > thanks. > > > > example: > > Port (pane=#evaluator name=#entity value=([A = A, AÂ·. @ [45, 127]])) > > Port (pane='root' name=#selection value=([A = A, AÂ·. @ [45, 127]])) > > JEPackedNode(ProtoObject)>>gtInspectorActionBrowse > > [ :aPresentation | each gtInspectorActions asOrderedCollection ] > > etc. > > > > > > Image > > ----- > > Pharo5.0 > > Latest update: #50761 > > Unnamed > > > > Virtual Machine > > --------------- > > CoInterpreter VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: > 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > StackToRegisterMappingCogit VMMaker.oscog-HolgerHansPeterFreyther.1880 > uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > https://github.com/pharo-project/pharo-vm.git Commit: > 3daf6cb181c8332cf6993b07430e0d5f0886fda9 Date: 2016-07-16 18:01:23 +0200 > By: GitHub <noreply(a)github.com> Jenkins build #597 > > > > Unix built on Jul 18 2016 16:36:31 Compiler: 4.6.3 > > VMMaker versionString https://github.com/pharo-project/pharo-vm.git > Commit: 3daf6cb181c8332cf6993b07430e0d5f0886fda9 Date: 2016-07-16 > 18:01:23 +0200 By: GitHub <noreply(a)github.com> Jenkins build #597 > > CoInterpreter VMMaker.oscog-HolgerHansPeterFreyther.1880 uuid: > 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > StackToRegisterMappingCogit VMMaker.oscog-HolgerHansPeterFreyther.1880 > uuid: 16138eb3-2390-40f5-a6c8-15f0494936f8 Jul 18 2016 > > > > > > > > -- > > Bernardo E.C. > > > > Sent from a cheap desktop computer in South America. > > -- > www.tudorgirba.com > www.feenk.com > > "Every thing has its own flow." > > > > > > > -- Bernardo E.C. Sent from a cheap desktop computer in South America.

Sept. 21, 2016

Re: [Pharo-users] Get implementors list window from Spotter

by Johan Fabry

> On Sep 21, 2016, at 01:14, Tudor Girba <tudor(a)tudorgirba.com> wrote: > >> Speaking for myself, I honestly would not think about clicking on the ? icon to expect these kinds of instructions. I cannot say exactly why, I only have a feeling that the ? does not transmit to me that there are âpower userâ tips, and I expect a ? icon to just tell me basic things. > > Thanks for the feedback. Still, my question remains: is the help explanatory enough or do we need to improve it? After reading through everything, I think itâs actually too long. There is too much information and it is structured as a story. You could read all of this once (although I think many people will give up after a few pages), but there is no way to remember all of this information. My suggestion is to add something like a quick reference card (remember those?) for Spotter. For example like http://marc-abramowitz.com/archives/2006/04/10/emacs-22-reference-card/ This has to be manually curated, something like the âExtensions installed in the imageâ is not right because again itâs too much info and not ordered in sequence of importance. Then add a button to the UI so that this can be shown when needed. -- Does this mail seem too brief? Sorry for that, I donât mean to be rude! Please see http://emailcharter.org . Johan Fabry - http://pleiad.cl/~jfabry PLEIAD and RyCh labs - Computer Science Department (DCC) - University of Chile

Sept. 21, 2016

Re: [Pharo-users] Using a Unix filedescriptor in a FileStream?

by Mariano Martinez Peck

On Wed, Sep 21, 2016 at 3:55 AM, Holger Freyther <holger(a)freyther.de> wrote: > > > On 20 Sep 2016, at 20:38, Mariano Martinez Peck <marianopeck(a)gmail.com> > wrote: > > > > Hi Holger, > > > Good Morning, > > thank you for your reply. > > Good morning. > > | reader | > > reader := OSSAttachableFileStream name:'myStream' attachTo: aFileID > writable: false. > > reader setNonBlocking "optional" > > the only issue is that i have a "int fd" and not a SQFile. In > >>#name:attachToCFile:writable: you create a SQFile* out of a FILE* > (OSSCFile) but judging the comment it doesn't work. Thanks! That was the method I was trying to remember and I was failing! hahahaha. > The 32/64 bit issue can be solved by using FFIExternalStructure to model > SQFile but the question if the VM was built with large file support on > GNU/Linux is a tricky one. > > Yes exactly. The basic scenario was working, but having it working in all the different flavors of OS and VMs was tricky as the comment says. My conclusion in this case was that it's not worth trying to do this from image side via UFFI and that instead we should have a VM primitive. > So maybe we create another primitive to convert a FILE* to a SQFile* (and > have it manage the lifetime of that memory?)? And maybe another primitive > to do the same for a Socket? > > Exactly. I have been wanting this a couple of times while doing OSSubprocess. > > > I still didn't understand why do you mean with a). What do you mean by > "monitor it from being readable" ? > > Imagine you want to exit the image in case the file /exit changes. You > will charge inotify to watch this filepath and if the fd becomes readable > you already know the answer, you don't have to read the event. But true if > I have a Socket or FileStream I can do blocking read on it as well. > OK, now I understand. But if you do blocking read, wouldn't be locking the rest of the image by that read? Of course, you can do busy waiting with none blocking reads.... but for that, inotify may be more performant? > > > > I think you could dig a bit in OSSPipe, OSSAttachableFileStream and > their usage. All classes have class comments, all methods are also > documented, and there is quite some documentation in [1]. > > Will look again but I didn't see anything obvious. E.g. primCreatePipe > seems to already return two SQFile* ("fileId")? > > Yes, exactly. I remember now. And as I said, I also wanted to be able to work at fd or FILE* level and I failed. Cheers, -- Mariano http://marianopeck.wordpress.com

Sept. 21, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Mariano Martinez Peck

On Wed, Sep 21, 2016 at 7:31 AM, Petr Fischer <petr.fischer(a)me.com> wrote: > Hello, two questions about Seaside sessions: > > 1) URL sharing between different users - what if "boss" shares URL from > his browser and send it to another regular user - of course, easy way, > whole URL with session (_s=xxxx) - when another/regular user opens that > link -> whole "boss" session opens in regular user's browser, with all > "boss" permissions, UI state etc etc - very bad, is there any solution for > this? Rewrite every (!) URL with updateURL: is not solution :( > > Probably it's not what you need, but in my case I wanted to forbid (show an error) what you call "URL sharing" because of security issues. Anyway, if you want this, let me know and I show you how I did it. > 2) What is the actual way for "session expiration/login page"? There is > few tutorials and books on the inet - but info about session expiration is > obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > Some trick with WAApplication subclass is actual? > > Thanks very much! pf > > -- Mariano http://marianopeck.wordpress.com

Sept. 21, 2016

Re: [Pharo-users] Pharo not running with macOS Sierra

by MartinW

Thank you, Henrik. This VM first shows a black window too, but it comes alive, once you click one time into the window. Best regards, Martin. Henrik Sperre Johansen wrote >> i just updated to macOS Sierra, and Pharo now starts with an empty black >> window and 100% CPU load and stays like this forever. > > It's not an "official" official release, but the following link to a new > VM build was posted on Slack yesterday; two user have reported it working > ("briefly" and "for several hours" respectively) on Sierra so far: > https://bintray.com/estebanlm/pharo-vm/build/201609201407#files > <https://bintray.com/estebanlm/pharo-vm/build/201609201407#files> -- View this message in context: http://forum.world.st/Pharo-not-running-with-macOS-Sierra-tp4916468p4916474… Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Sept. 21, 2016

Re: [Pharo-users] Pharo not running with macOS Sierra

by Henrik Johansen

> On 21 Sep 2016, at 2:07 , MartinW <wm(a)fastmail.fm> wrote: > > Hello, > > i just updated to macOS Sierra, and Pharo now starts with an empty black > window and 100% CPU load and stays like this forever. > Any ideas? > > Best regards, > Martin. It's not an "official" official release, but the following link to a new VM build was posted on Slack yesterday; two user have reported it working ("briefly" and "for several hours" respectively) on Sierra so far: https://bintray.com/estebanlm/pharo-vm/build/201609201407#files <https://bintray.com/estebanlm/pharo-vm/build/201609201407#files> Cheers, Henry

Sept. 21, 2016

Pharo not running with macOS Sierra

by MartinW

Hello, i just updated to macOS Sierra, and Pharo now starts with an empty black window and 100% CPU load and stays like this forever. Any ideas? Best regards, Martin. -- View this message in context: http://forum.world.st/Pharo-not-running-with-macOS-Sierra-tp4916468.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Sept. 21, 2016

Re: [Pharo-users] doesNotUnderstand: infinit loop

by Denis Kudriashov

2016-09-21 12:11 GMT+02:00 Guille Polito <guillermopolito(a)gmail.com>: > > I'm still taking a look at what would cause this. And I also think we > still have this bug in pharo 6 (and thus pharo 5) because I found it lately > very often. > > In the meantime, if you find that your image is causing you these > problems, you can workaround it by executing: > > UIManager default spawnNewProcess. But be careful. It could lead to multiple UI processes which will cause strange things on screen.

Sept. 21, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Esteban A. Maringolo

1) If you share the url with the _s parameter, then you can continue that session in other browser/machine. This is so because by the default the application uses WAQueryFieldHandlerTrackingStrategy as the #trackingStrategy config. But you can override it and use any of the WAHandlerTrackingStrategy concrete subclasses, to make it cookie based or IP based. 2) There is no special trick regarding the session, but it is true there is no default "authentication/login" component ready to be used. All sessions have an instance of WASession, preferably one subclass of your own, which you must "login" or "logout" based on your own criteria. You can modify the expiration time as well as completely remove it explicitly by sending #unregister to the session object, usually as part of a "logout" or "signout" method of your own. I hope this helps. Regards, Esteban A. Maringolo 2016-09-21 7:31 GMT-03:00 Petr Fischer <petr.fischer(a)me.com>: > Hello, two questions about Seaside sessions: > > 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :( > > 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > Some trick with WAApplication subclass is actual? > > Thanks very much! pf >

Sept. 21, 2016