<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Saving the Band &#187; software</title>
	<atom:link href="http://george.savetheband.net/tag/software/feed/" rel="self" type="application/rss+xml" />
	<link>http://george.savetheband.net</link>
	<description>The sporadic online life of an information superhighwayman</description>
	<lastBuildDate>Fri, 18 Jun 2010 07:56:32 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Vulnerable Code: MoinMoin User</title>
		<link>http://george.savetheband.net/2010/06/07/vulnerable-code-moinmoin-user/</link>
		<comments>http://george.savetheband.net/2010/06/07/vulnerable-code-moinmoin-user/#comments</comments>
		<pubDate>Mon, 07 Jun 2010 21:12:44 +0000</pubDate>
		<dc:creator>duplico</dc:creator>
				<category><![CDATA[Programming]]></category>
		<category><![CDATA[moinmoin]]></category>
		<category><![CDATA[python]]></category>
		<category><![CDATA[secure coding]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[software]]></category>
		<category><![CDATA[software development]]></category>
		<category><![CDATA[vulnerable code]]></category>

		<guid isPermaLink="false">http://george.savetheband.net/?p=272</guid>
		<description><![CDATA[I&#8217;ve just started posting code samples from the wonderful SpotTheVuln.com on the walls in our building on 11&#215;17 cardstock behind thin plexiglass panes so they can be annotated with dry erase marker when people solve them or have comments:

I love the site but wanted to branch out a little bit into some samples outside of [...]]]></description>
			<content:encoded><![CDATA[<p>I&#8217;ve just started posting code samples from the wonderful <a href="http://spotthevuln.com/" target="_self">SpotTheVuln.com</a> on the walls in our building on 11&#215;17 cardstock behind thin plexiglass panes so they can be annotated with dry erase marker when people solve them or have comments:</p>
<p><a href="http://george.savetheband.net/wp-content/uploads/2010/06/stv.jpg"><img class="alignnone size-medium wp-image-282" title="SpotTheVuln on the Wall" src="http://george.savetheband.net/wp-content/uploads/2010/06/stv-225x300.jpg" alt="" width="225" height="300" /></a></p>
<p>I love the site but wanted to branch out a little bit into some samples outside of the PHP and Wordpress world. In my first attempt, I didn&#8217;t branch very far, and it&#8217;s a bit longer than I would have preferred, but here it is &#8212; from MoinMoin. Hopefully I included enough information to find the issue.</p>

<div class="wp_syntax"><div class="code"><pre class="python" style="font-family:monospace;"><span style="color: #ff7700;font-weight:bold;">def</span> getUserId<span style="color: black;">&#40;</span>request, searchName<span style="color: black;">&#41;</span>:
    <span style="color: #483d8b;">&quot;&quot;&quot;
    Get the user ID for a specific user NAME.
&nbsp;
    @param searchName: the user name to look up
    @rtype: string
    @return: the corresponding user ID or None
    &quot;&quot;&quot;</span>
    <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #ff7700;font-weight:bold;">not</span> searchName:
        <span style="color: #ff7700;font-weight:bold;">return</span> <span style="color: #008000;">None</span>
    cfg = request.<span style="color: black;">cfg</span>
    <span style="color: #ff7700;font-weight:bold;">try</span>:
        _name2id = cfg._name2id
    <span style="color: #ff7700;font-weight:bold;">except</span> <span style="color: #008000;">AttributeError</span>:
        arena = <span style="color: #483d8b;">'user'</span>
        key = <span style="color: #483d8b;">'name2id'</span>
        cache = caching.<span style="color: black;">CacheEntry</span><span style="color: black;">&#40;</span>request, arena, key<span style="color: black;">&#41;</span>
        <span style="color: #ff7700;font-weight:bold;">try</span>:
            _name2id = <span style="color: #dc143c;">pickle</span>.<span style="color: black;">loads</span><span style="color: black;">&#40;</span>cache.<span style="color: black;">content</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
        <span style="color: #ff7700;font-weight:bold;">except</span> <span style="color: black;">&#40;</span><span style="color: #dc143c;">pickle</span>.<span style="color: black;">UnpicklingError</span>, <span style="color: #008000;">IOError</span>, <span style="color: #008000;">EOFError</span>, <span style="color: #008000;">ValueError</span><span style="color: black;">&#41;</span>:
            _name2id = <span style="color: black;">&#123;</span><span style="color: black;">&#125;</span>
        cfg._name2id = _name2id
    <span style="color: #008000;">id</span> = _name2id.<span style="color: black;">get</span><span style="color: black;">&#40;</span>searchName, <span style="color: #008000;">None</span><span style="color: black;">&#41;</span>
    <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">id</span> <span style="color: #ff7700;font-weight:bold;">is</span> <span style="color: #008000;">None</span>:
        <span style="color: #ff7700;font-weight:bold;">for</span> userid <span style="color: #ff7700;font-weight:bold;">in</span> getUserList<span style="color: black;">&#40;</span>request<span style="color: black;">&#41;</span>:
            name = User<span style="color: black;">&#40;</span>request, <span style="color: #008000;">id</span>=userid<span style="color: black;">&#41;</span>.<span style="color: black;">name</span>
            _name2id<span style="color: black;">&#91;</span>name<span style="color: black;">&#93;</span> = userid
        cfg._name2id = _name2id
        arena = <span style="color: #483d8b;">'user'</span>
        key = <span style="color: #483d8b;">'name2id'</span>
        cache = caching.<span style="color: black;">CacheEntry</span><span style="color: black;">&#40;</span>request, arena, key<span style="color: black;">&#41;</span>
        cache.<span style="color: black;">update</span><span style="color: black;">&#40;</span><span style="color: #dc143c;">pickle</span>.<span style="color: black;">dumps</span><span style="color: black;">&#40;</span>_name2id, PICKLE_PROTOCOL<span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
        <span style="color: #008000;">id</span> = _name2id.<span style="color: black;">get</span><span style="color: black;">&#40;</span>searchName, <span style="color: #008000;">None</span><span style="color: black;">&#41;</span>
    <span style="color: #ff7700;font-weight:bold;">return</span> <span style="color: #008000;">id</span>
&nbsp;
<span style="color: #ff7700;font-weight:bold;">class</span> User:
    <span style="color: #483d8b;">&quot;&quot;&quot;A MoinMoin User&quot;&quot;&quot;</span>
&nbsp;
    <span style="color: #ff7700;font-weight:bold;">def</span> <span style="color: #0000cd;">__init__</span><span style="color: black;">&#40;</span><span style="color: #008000;">self</span>, request, <span style="color: #008000;">id</span>=<span style="color: #008000;">None</span>, name=<span style="color: #483d8b;">&quot;&quot;</span>, password=<span style="color: #008000;">None</span>,
                 auth_username=<span style="color: #483d8b;">&quot;&quot;</span>, <span style="color: #66cc66;">**</span>kw<span style="color: black;">&#41;</span>:
        <span style="color: #483d8b;">&quot;&quot;&quot; Initialize User object
&nbsp;
        @param request: the request object
        @param id: (optional) user ID
        @param name: (optional) user name
        @param password: (optional) user password (unicode)
        @param auth_username: (optional) already authenticated user name
                              (e.g. when using http basic auth) (unicode)&quot;&quot;&quot;</span>
        <span style="color: #008000;">self</span>._cfg = request.<span style="color: black;">cfg</span>
        <span style="color: #008000;">self</span>.<span style="color: black;">valid</span> = <span style="color: #ff4500;">0</span>
        <span style="color: #008000;">self</span>.<span style="color: black;">trusted</span> = <span style="color: #ff4500;">0</span>
        <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> = <span style="color: #008000;">id</span>
        <span style="color: #008000;">self</span>.<span style="color: black;">auth_username</span> = auth_username
        <span style="color: #008000;">self</span>.<span style="color: black;">auth_method</span> = kw.<span style="color: black;">get</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'auth_method'</span>, <span style="color: #483d8b;">'internal'</span><span style="color: black;">&#41;</span>
        <span style="color: #008000;">self</span>.<span style="color: black;">auth_attribs</span> = kw.<span style="color: black;">get</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'auth_attribs'</span>, <span style="color: black;">&#40;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
&nbsp;
        <span style="color: #808080; font-style: italic;"># we got an already authenticated username:</span>
        check_pass = <span style="color: #ff4500;">0</span>
        <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #ff7700;font-weight:bold;">not</span> <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> <span style="color: #ff7700;font-weight:bold;">and</span> <span style="color: #008000;">self</span>.<span style="color: black;">auth_username</span>:
            <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> = getUserId<span style="color: black;">&#40;</span>request, <span style="color: #008000;">self</span>.<span style="color: black;">auth_username</span><span style="color: black;">&#41;</span>
            <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #ff7700;font-weight:bold;">not</span> password <span style="color: #ff7700;font-weight:bold;">is</span> <span style="color: #008000;">None</span>:
                check_pass = <span style="color: #ff4500;">1</span>
        <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span>:
            <span style="color: #008000;">self</span>.<span style="color: black;">load_from_id</span><span style="color: black;">&#40;</span>check_pass<span style="color: black;">&#41;</span>
            <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">self</span>.<span style="color: black;">name</span> == <span style="color: #008000;">self</span>.<span style="color: black;">auth_username</span>:
                <span style="color: #008000;">self</span>.<span style="color: black;">trusted</span> = <span style="color: #ff4500;">1</span>
        <span style="color: #ff7700;font-weight:bold;">elif</span> <span style="color: #008000;">self</span>.<span style="color: black;">name</span>:
            <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> = getUserId<span style="color: black;">&#40;</span><span style="color: #008000;">self</span>._request, <span style="color: #008000;">self</span>.<span style="color: black;">name</span><span style="color: black;">&#41;</span>
            <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span>:
                <span style="color: #008000;">self</span>.<span style="color: black;">load_from_id</span><span style="color: black;">&#40;</span><span style="color: #ff4500;">1</span><span style="color: black;">&#41;</span>
            <span style="color: #ff7700;font-weight:bold;">else</span>:
                <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> = <span style="color: #008000;">self</span>.<span style="color: black;">make_id</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
        <span style="color: #ff7700;font-weight:bold;">else</span>:
            <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> = <span style="color: #008000;">self</span>.<span style="color: black;">make_id</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
&nbsp;
    <span style="color: #ff7700;font-weight:bold;">def</span> __filename<span style="color: black;">&#40;</span><span style="color: #008000;">self</span><span style="color: black;">&#41;</span>:
        <span style="color: #483d8b;">&quot;&quot;&quot; Get filename of the user's file on disk
        @rtype: string
        @return: full path and filename of user account file
        &quot;&quot;&quot;</span>
        <span style="color: #ff7700;font-weight:bold;">return</span> <span style="color: #dc143c;">os</span>.<span style="color: black;">path</span>.<span style="color: black;">join</span><span style="color: black;">&#40;</span><span style="color: #008000;">self</span>._cfg.<span style="color: black;">user_dir</span>, <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span> <span style="color: #ff7700;font-weight:bold;">or</span> <span style="color: #483d8b;">&quot;...NONE...&quot;</span><span style="color: black;">&#41;</span>
&nbsp;
    <span style="color: #ff7700;font-weight:bold;">def</span> save<span style="color: black;">&#40;</span><span style="color: #008000;">self</span><span style="color: black;">&#41;</span>:
        <span style="color: #483d8b;">&quot;&quot;&quot; Save user account data to user account file on disk.
&nbsp;
        This saves all member variables, except &quot;id&quot; and &quot;valid&quot; and
        those starting with an underscore.
        &quot;&quot;&quot;</span>
        <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #ff7700;font-weight:bold;">not</span> <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span>:
            <span style="color: #ff7700;font-weight:bold;">return</span>
&nbsp;
        user_dir = <span style="color: #008000;">self</span>._cfg.<span style="color: black;">user_dir</span>
        filesys.<span style="color: black;">makeDirs</span><span style="color: black;">&#40;</span>user_dir<span style="color: black;">&#41;</span>
&nbsp;
        <span style="color: #008000;">self</span>.<span style="color: black;">last_saved</span> = <span style="color: #008000;">str</span><span style="color: black;">&#40;</span><span style="color: #dc143c;">time</span>.<span style="color: #dc143c;">time</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
&nbsp;
        data = <span style="color: #dc143c;">codecs</span>.<span style="color: #008000;">open</span><span style="color: black;">&#40;</span><span style="color: #008000;">self</span>.__filename<span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>, <span style="color: #483d8b;">&quot;w&quot;</span>, config.<span style="color: black;">charset</span><span style="color: black;">&#41;</span>
        data.<span style="color: black;">write</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">&quot;# Data saved '%s' for id '%s'<span style="color: #000099; font-weight: bold;">\n</span>&quot;</span> <span style="color: #66cc66;">%</span> <span style="color: black;">&#40;</span>
            <span style="color: #dc143c;">time</span>.<span style="color: black;">strftime</span><span style="color: black;">&#40;</span><span style="color: #008000;">self</span>._cfg.<span style="color: black;">datetime_fmt</span>, <span style="color: #dc143c;">time</span>.<span style="color: black;">localtime</span><span style="color: black;">&#40;</span><span style="color: #dc143c;">time</span>.<span style="color: #dc143c;">time</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>,
            <span style="color: #008000;">self</span>.<span style="color: #008000;">id</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
        attrs = <span style="color: #008000;">vars</span><span style="color: black;">&#40;</span><span style="color: #008000;">self</span><span style="color: black;">&#41;</span>.<span style="color: black;">items</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
        attrs.<span style="color: black;">sort</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
        <span style="color: #ff7700;font-weight:bold;">for</span> key, value <span style="color: #ff7700;font-weight:bold;">in</span> attrs:
            <span style="color: #ff7700;font-weight:bold;">if</span> key <span style="color: #ff7700;font-weight:bold;">not</span> <span style="color: #ff7700;font-weight:bold;">in</span> <span style="color: #008000;">self</span>._cfg.<span style="color: black;">user_transient_fields</span> <span style="color: #ff7700;font-weight:bold;">and</span> key<span style="color: black;">&#91;</span><span style="color: #ff4500;">0</span><span style="color: black;">&#93;</span> <span style="color: #66cc66;">!</span>= <span style="color: #483d8b;">'_'</span>:
                <span style="color: #808080; font-style: italic;"># Encode list values</span>
                <span style="color: #ff7700;font-weight:bold;">if</span> key <span style="color: #ff7700;font-weight:bold;">in</span> <span style="color: black;">&#91;</span><span style="color: #483d8b;">'quicklinks'</span>, <span style="color: #483d8b;">'subscribed_pages'</span><span style="color: black;">&#93;</span>:
                    value = encodeList<span style="color: black;">&#40;</span>value<span style="color: black;">&#41;</span>
                line = u<span style="color: #483d8b;">&quot;%s=%s<span style="color: #000099; font-weight: bold;">\n</span>&quot;</span> <span style="color: #66cc66;">%</span> <span style="color: black;">&#40;</span>key, <span style="color: #008000;">unicode</span><span style="color: black;">&#40;</span>value<span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
                data.<span style="color: black;">write</span><span style="color: black;">&#40;</span>line<span style="color: black;">&#41;</span>
        data.<span style="color: black;">close</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
&nbsp;
        <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #ff7700;font-weight:bold;">not</span> <span style="color: #008000;">self</span>.<span style="color: black;">disabled</span>:
            <span style="color: #008000;">self</span>.<span style="color: black;">valid</span> = <span style="color: #ff4500;">1</span></pre></div></div>

]]></content:encoded>
			<wfw:commentRss>http://george.savetheband.net/2010/06/07/vulnerable-code-moinmoin-user/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Life skills (part 2)</title>
		<link>http://george.savetheband.net/2009/01/25/life-skills-part-2/</link>
		<comments>http://george.savetheband.net/2009/01/25/life-skills-part-2/#comments</comments>
		<pubDate>Mon, 26 Jan 2009 01:44:57 +0000</pubDate>
		<dc:creator>duplico</dc:creator>
				<category><![CDATA[life skills]]></category>
		<category><![CDATA[booze]]></category>
		<category><![CDATA[charts]]></category>
		<category><![CDATA[commuting]]></category>
		<category><![CDATA[cycling]]></category>
		<category><![CDATA[finance]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[magic]]></category>
		<category><![CDATA[math]]></category>
		<category><![CDATA[money]]></category>
		<category><![CDATA[presentations]]></category>
		<category><![CDATA[sales]]></category>
		<category><![CDATA[software]]></category>

		<guid isPermaLink="false">http://george.savetheband.net/?p=19</guid>
		<description><![CDATA[http://finance.yahoo.com/family-home/article/103216/the-cheapest-days-to-buy-certain-items &#8211; The cheapest days of the week to buy particular items. Books, clothes, and airplane tickets are my favorites.
http://firedoglake.com/2008/05/24/come-saturday-morning-bike-commuting-for-newbies/ &#8211; Bike commuting for newbies. In spite of some interestingly wrong predictions about gas prices at the beginning, it&#8217;s full of good information.
http://www.flickr.com/photos/amit-agarwal/3196386402/sizes/l/ &#8211; Chart types for different tasks. A great way to pick the [...]]]></description>
			<content:encoded><![CDATA[<p><a href="http://finance.yahoo.com/family-home/article/103216/the-cheapest-days-to-buy-certain-items">http://finance.yahoo.com/family-home/article/103216/the-cheapest-days-to-buy-certain-items</a> &#8211; The cheapest days of the week to buy particular items. Books, clothes, and airplane tickets are my favorites.</p>
<p><a href="http://firedoglake.com/2008/05/24/come-saturday-morning-bike-commuting-for-newbies/">http://firedoglake.com/2008/05/24/come-saturday-morning-bike-commuting-for-newbies/</a> &#8211; Bike commuting for newbies. In spite of some interestingly wrong predictions about gas prices at the beginning, it&#8217;s full of good information.</p>
<p><a href="http://www.flickr.com/photos/amit-agarwal/3196386402/sizes/l/">http://www.flickr.com/photos/amit-agarwal/3196386402/sizes/l/</a> &#8211; Chart types for different tasks. A great way to pick the most appropriate type of chart for showing the right kind of data.</p>
<p><a href="http://www.sloshspot.com/blog/06-24-2008/Ten-Cool-and-Free-Magic-Bar-Tricks-23">http://www.sloshspot.com/blog/06-24-2008/Ten-Cool-and-Free-Magic-Bar-Tricks-23</a> &#8211; Ten bar tricks. It&#8217;s maaagic!</p>
<p>Now a pair of nerdy ones:</p>
<p><a href="http://www.cs.trinity.edu/About/The_Courses/cs301/math-for-the-layman/">http://www.cs.trinity.edu/About/The_Courses/cs301/math-for-the-layman/</a> &#8211; Math for the layman. Written by the eminent Kenneth Iverson of IBM and APL fame, this is a ground-up course in theoretical mathematics from the basics of numbers to differential and integral calculus.</p>
<p><a href="http://www.linuxalt.com/">http://www.linuxalt.com/</a> &#8211; The Linux Alternative Project. This site basically provides a table where one looks up a piece of Windows software whose functionality one wants to replace in a GNU/Linux environment.</p>
]]></content:encoded>
			<wfw:commentRss>http://george.savetheband.net/2009/01/25/life-skills-part-2/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
