- Pharo-users - lists.pharo.org

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Mariano Martinez Peck

On Wed, Sep 21, 2016 at 7:31 AM, Petr Fischer <petr.fischer(a)me.com> wrote: > Hello, two questions about Seaside sessions: > > 1) URL sharing between different users - what if "boss" shares URL from > his browser and send it to another regular user - of course, easy way, > whole URL with session (_s=xxxx) - when another/regular user opens that > link -> whole "boss" session opens in regular user's browser, with all > "boss" permissions, UI state etc etc - very bad, is there any solution for > this? Rewrite every (!) URL with updateURL: is not solution :( > > Probably it's not what you need, but in my case I wanted to forbid (show an error) what you call "URL sharing" because of security issues. Anyway, if you want this, let me know and I show you how I did it. > 2) What is the actual way for "session expiration/login page"? There is > few tutorials and books on the inet - but info about session expiration is > obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > Some trick with WAApplication subclass is actual? > > Thanks very much! pf > > -- Mariano http://marianopeck.wordpress.com

Sept. 21, 2016

Re: [Pharo-users] Pharo not running with macOS Sierra

by MartinW

Thank you, Henrik. This VM first shows a black window too, but it comes alive, once you click one time into the window. Best regards, Martin. Henrik Sperre Johansen wrote >> i just updated to macOS Sierra, and Pharo now starts with an empty black >> window and 100% CPU load and stays like this forever. > > It's not an "official" official release, but the following link to a new > VM build was posted on Slack yesterday; two user have reported it working > ("briefly" and "for several hours" respectively) on Sierra so far: > https://bintray.com/estebanlm/pharo-vm/build/201609201407#files > <https://bintray.com/estebanlm/pharo-vm/build/201609201407#files> -- View this message in context: http://forum.world.st/Pharo-not-running-with-macOS-Sierra-tp4916468p4916474… Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Sept. 21, 2016

Re: [Pharo-users] Pharo not running with macOS Sierra

by Henrik Johansen

> On 21 Sep 2016, at 2:07 , MartinW <wm(a)fastmail.fm> wrote: > > Hello, > > i just updated to macOS Sierra, and Pharo now starts with an empty black > window and 100% CPU load and stays like this forever. > Any ideas? > > Best regards, > Martin. It's not an "official" official release, but the following link to a new VM build was posted on Slack yesterday; two user have reported it working ("briefly" and "for several hours" respectively) on Sierra so far: https://bintray.com/estebanlm/pharo-vm/build/201609201407#files <https://bintray.com/estebanlm/pharo-vm/build/201609201407#files> Cheers, Henry

Sept. 21, 2016

Pharo not running with macOS Sierra

by MartinW

Hello, i just updated to macOS Sierra, and Pharo now starts with an empty black window and 100% CPU load and stays like this forever. Any ideas? Best regards, Martin. -- View this message in context: http://forum.world.st/Pharo-not-running-with-macOS-Sierra-tp4916468.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

Sept. 21, 2016

Re: [Pharo-users] doesNotUnderstand: infinit loop

by Denis Kudriashov

2016-09-21 12:11 GMT+02:00 Guille Polito <guillermopolito(a)gmail.com>: > > I'm still taking a look at what would cause this. And I also think we > still have this bug in pharo 6 (and thus pharo 5) because I found it lately > very often. > > In the meantime, if you find that your image is causing you these > problems, you can workaround it by executing: > > UIManager default spawnNewProcess. But be careful. It could lead to multiple UI processes which will cause strange things on screen.

Sept. 21, 2016

Re: [Pharo-users] Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Esteban A. Maringolo

1) If you share the url with the _s parameter, then you can continue that session in other browser/machine. This is so because by the default the application uses WAQueryFieldHandlerTrackingStrategy as the #trackingStrategy config. But you can override it and use any of the WAHandlerTrackingStrategy concrete subclasses, to make it cookie based or IP based. 2) There is no special trick regarding the session, but it is true there is no default "authentication/login" component ready to be used. All sessions have an instance of WASession, preferably one subclass of your own, which you must "login" or "logout" based on your own criteria. You can modify the expiration time as well as completely remove it explicitly by sending #unregister to the session object, usually as part of a "logout" or "signout" method of your own. I hope this helps. Regards, Esteban A. Maringolo 2016-09-21 7:31 GMT-03:00 Petr Fischer <petr.fischer(a)me.com>: > Hello, two questions about Seaside sessions: > > 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :( > > 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. > Some trick with WAApplication subclass is actual? > > Thanks very much! pf >

Sept. 21, 2016

Sharing Seaside URLs between users (security) + what is actual way for session expiration page

by Petr Fischer

Hello, two questions about Seaside sessions: 1) URL sharing between different users - what if "boss" shares URL from his browser and send it to another regular user - of course, easy way, whole URL with session (_s=xxxx) - when another/regular user opens that link -> whole "boss" session opens in regular user's browser, with all "boss" permissions, UI state etc etc - very bad, is there any solution for this? Rewrite every (!) URL with updateURL: is not solution :( 2) What is the actual way for "session expiration/login page"? There is few tutorials and books on the inet - but info about session expiration is obsolete :( Methods from tutorials not exists in Seaside 3.2.0. Some trick with WAApplication subclass is actual? Thanks very much! pf

Sept. 21, 2016

Re: [Pharo-users] doesNotUnderstand: infinit loop

by Guille Polito

Hi Hilaire, all, I started digging this morning on this issue, and I see why we can have such problems. Apparently, there is some strange case that produces a bug in UIManager. To explain it with code, the UIManager should satisfy allways the following invariant. "If executed from a workspace/playground. i.e., the UI process itself:" UIManager default uiProcess == Processor activeProcess. => true Somehow, in the image you provided me, it is not the case. I'm still taking a look at what would cause this. And I also think we still have this bug in pharo 6 (and thus pharo 5) because I found it lately very often. In the meantime, if you find that your image is causing you these problems, you can workaround it by executing: UIManager default spawnNewProcess. Once you do that, the ui process should come back to a correct state and the debugger should behave as expected. Guille -------- Original Message -------- > Guille, > > Can you send me your email at hilaire [at] drgeo.eu, I can't have it > through the Gmane news forum. > > Hilaire > > Le 19/09/2016 Ã 10:21, Guille Polito a Ã©crit : >> Hillaire, if you have an image with the problem, can you forward it to >> me? I'm looking forward to kill this bug with my axe.

Sept. 21, 2016

Re: [Pharo-users] Using a Unix filedescriptor in a FileStream?

by Holger Freyther

> On 20 Sep 2016, at 20:38, Mariano Martinez Peck <marianopeck(a)gmail.com> wrote: > > Hi Holger, Good Morning, thank you for your reply. > | reader | > reader := OSSAttachableFileStream name:'myStream' attachTo: aFileID writable: false. > reader setNonBlocking "optional" the only issue is that i have a "int fd" and not a SQFile. In >>#name:attachToCFile:writable: you create a SQFile* out of a FILE* (OSSCFile) but judging the comment it doesn't work. The 32/64 bit issue can be solved by using FFIExternalStructure to model SQFile but the question if the VM was built with large file support on GNU/Linux is a tricky one. So maybe we create another primitive to convert a FILE* to a SQFile* (and have it manage the lifetime of that memory?)? And maybe another primitive to do the same for a Socket? > I still didn't understand why do you mean with a). What do you mean by "monitor it from being readable" ? Imagine you want to exit the image in case the file /exit changes. You will charge inotify to watch this filepath and if the fd becomes readable you already know the answer, you don't have to read the event. But true if I have a Socket or FileStream I can do blocking read on it as well. > I think you could dig a bit in OSSPipe, OSSAttachableFileStream and their usage. All classes have class comments, all methods are also documented, and there is quite some documentation in [1]. Will look again but I didn't see anything obvious. E.g. primCreatePipe seems to already return two SQFile* ("fileId")? cheers holger

Sept. 21, 2016

Synectique is recruiting

by stepharo

Synectique provides comprehensive and sophisticated analysis tools to improve the quality of software, reduce maintenance costs, and thus enable easier software evolution. The company was created in 2013 and already got some renowned customers. To sustain our growth we are looking for a full-time Smalltalk (Pharo) developer with some additional non Smalltalk skills. 2+ years OO programming experience or equivalent, with strong skills in OO design, front-end JavaScript and back-end Seaside/Pharo. The ideal candidate should be comfortable with meta-model approaches, client-side web technologies (HTML, CSS, JavaScript), be familiar with code parsing and master different languages (Java, C++, C#, ADA, Smalltalk). The job is based in Lille, which is centrally located with good connections by train to everywhere (one hour from Paris, 1h20 from London, 35 min from Brussels). Duration: Permanent (CDI) Starting date: September 2016 Salary: depending on skill set/experience Ready to travel if needed. Additional Skills: Object-oriented design/programming Agile Methodologies Fluent in French and/or English Please send your applications to philippe.valenza(a)synectique.eu.

Sept. 21, 2016