June 2000 - Zope-Announce

Zwiki security alert!
by Simon Michael 08 Jun '00

08 Jun '00

I've added some 0.6 release notes on zwikiweb (http://joyful.com/zwiki) and also a Security Alert! summary: upgrade to 0.6.1 now! DTML trojans: Zwiki versions before 0.6 allowed executable DTML content by default, with a big vulnerability: a hostile anonymous or unprivileged user could add harmful DTML code to a page - eg to delete all zope objects - which could get successfully executed by the next privileged user to view that page. Zwiki 0.6.1 has changes to alleviate this. HTML trojans: The trojan issue is still a problem even with non-DTML pages which are editable, because most of zwiki's page types are rendered as HTML. This means hostile users could add harmful HTML or javascript to be executed by others who view the page. What this means: If you manage a zwiki web that is editable by untrusted users, you should (a) upgrade to 0.6.1 or greater (b) familiarize yourself with this issue (c) choose a policy you are comfortable with and change your page types and your view/edit/manage permissions if necessary For more details, see the commentary on the trojan issue below and http://www.zope.org/Members/jim/ZopeSecurity/TrojanIssueOverview Regards, -Simon

1 0

CachePool-0.2.2
by neli 08 Jun '00

08 Jun '00

Hi, all CachePool 0.2.1 had a bug where it would always render index_html if one existed... 0.2.2 fixes this :) http://www.zope.org/Members/neli/CachePool -- neli

1 0

CachePool 0.2.1
by neli 07 Jun '00

07 Jun '00

Ok, I have been working on this, but now I have no real way of testing it, so... If you want/need a Cache engine wich is able to cache pages depedent of the way they are called (URL,QueryString), try this out. I, of course, believe it is stable. But wouldn't bet my pants... URL: http://www.zope.org/Members/neli/CachePool -- neli

1 0

Zope Weekly News for June 7th
by ethan mindlace fremen 07 Jun '00

07 Jun '00

This week's somewhat abbreviated ZWN includes Zope at LinuxTag and the Open Source Convention, lots of documentation progress, including a chat, a new home for Zope Studio and more! The opinions expressed in Zope Weekly news are solely the author's, and not the opinions of Digital Creations, The Zope Community at-large, or the Spanish Inquisition. The Zope Weekly News now has a "permanent home", http://www.zope.org/Documentation/ZWN. And Now For Something Completely Different: Coming Events LinuxTag There will be a Zope booth at the "LinuxTag", http://www.linuxtag.de in Stuttgart, Germany from June 29th to July 2nd. In addition to the booth that will be there for the whole conference, there will be 2 rooms available for talks and discussions on the business day, Thursday 29th. We are still looking for people who want help organizing the conference, give some talks and attend the booth. Generally, it would also be great to know who is planning to be at the conference. Please send feedback to "Stephan Richter", mailto:srichter@plandepot.com See "Zope at Linuxtag", http://www.zope.org/Members/Linuxtag/ for the most up-to-date information. The Open Source Convention This "enormous convention", http://conferences.oreilly.com/oscon2000/ hosted by O'reilly, is shaping up to be pretty interesting. Aside from the State of Python, given by Guido von Rossum, there's also going to be a "talk on the CERT Advisory", http://www.oreillynet.com/pub/w/evening_events.html about cross-site scripting, a web-wide security issue that the Zope Community was among the first to begin implementing security policies for: they'll land with zope 2.2. Zope is going to be at the conference in force, with: - Paul "opening eyes to the Zope-Mozilla initiative", http://www.oreillynet.com/pub/e_sess/853 - Ryan telling the world "you can have web IMAP and collaboration", http://www.oreillynet.com/pub/e_sess/725 - Christopher, as always, concentrating on the "edification of the community", http://www.oreillynet.com/pub/w/python_tutorials.html Documentation -- by Amos Lattier This Week * Stephan Richter finished reviewing, fixing, and expanding online help content for the Zope management screens. We hope to get him set up with CVS and get this checked in later this week or next week. In addition to brining the help content up to date, he is converting it to use Structured-Text. This will make editing help pages much easier and will eliminate the two step process of editing XML, rendering to HTML and then checking the HTML into CVS. This should make life much easier for the Zope team when they are documenting their work. * Amos released updated "Zope training material", http://www.zope.org/Members/Amos/TrainingSlidesAnnounce that he and Michel Pelletier have been working on for the past couple weeks. There are twenty slide presentations which cover such topics as DTML, application design, and developing Python products. Note: the PowerPoint slides are built by a Python script that reads Structured Text and talks to PowerPoint over COM - cool. * Michel and Amos participated in an IRC chat about documentation. A transcript of the chat "is availiable", http://www.zope.org/Documentation/Chats Thanks to everyone who participated and posed great questions. We even got a volunteer commitment out of the chat - way to go ZDP folks! * Amos is putting together a wiki that details all official Zope documentation projects, their schedules and status. Look for an announcement before the end of the week. We hope that this along with weekly ZWN summaries will give folks a much better idea of what were doing on the documentation front. * Michel is working on turning his in progress O'Reilly book on Zope into a piece of official Zope documentation. If all goes well the book will replace the current Guides. We are really excited about this and think that if we are successful that this will do a tremendous amount for Zope documentation. Next Week * We plan to complete and make public the Wiki that describes all official Zope documentation projects, their schedules and status. * We plan to focus on getting docs in shape for Zope 2.2 Specifically this means shoring up the help system docs, API docs, and tutorial. This all won't get done next week, but hopefully we can make some good progress and stay on track to have everything up to date for the 2.2 final release. If we are really fast we may even sneak a DTML reference into the Zope 2.2 final release. * Hopefully we will have final word on the status of converting Michel's Book into official documentation. That means we can start the process of making the Book public and opening it up to community critique and contributions. Zope Status -- by Brian Lloyd Summary o More collector issues resolved, made progress on the todo list for the 2.2 beta. Last week highlights A somewhat shorter list this week since we have changed the scheduling of the ZWN :) 12 more collector issues were closed and the changes to the ownership model were checked in (move and rename operations no longer affect ownership, a knob was added to the import screen to allow retaining existing ownership on import). The online help for ownership and import were updated and expanded as well. This week's friends of the core: o Jeff Rush contributed several patches from his RPM distribution. o Chris Withers gets the bug-writer-o-the-week award :^) o Sam Rushing clarified the license for the medusa files underlying ZServer. Next week Finish the outstanding issues for 2.2 beta 1: o Some basic hooks to support virtual hosting (a la SiteAccess) have been designed and will be added to allow product authors to write virtual hosting support without fragile dependencies on parts of the Zope core. o Finish changes to the undo machinery that will expose a more appropriate subset of undo-able transactions to the user. The set exposed now was fine at one time, but as the line between "site management" and "site user" continues to blur, a more restricted subset will make undo easier to delegate to a broader range of users. (I think that this is actually in testing now). o Get the minimal Observable default implemention checked in to the Zope core. Note that for 2.2 at least, the only impact of this will be that ZClasses will be able to subclass the default Observable implementation. While we suspect that many builtin Zope objects could benefit from being Observable in the longer run, we want to let the interface and default implementation shake out in application usage before taking that step. o Some misc. catalog bugs need to be closed. In other news, there is now a "zope-dev wiki", http://www.zope.org/Wikis/zope-dev/FrontPage where we will begin capturing discussions on future Zope development. Zope Studio -- by Martjin Pieters - Zope Studio has "a new home", http://www.zope.org/Products/ZopeStudio/. - With the new home comes a new and improved front door, with better access to the resources. This also includes a Tracker! - I fixed the Zope Studio install issues. This should be in CVS by the time you read this. Looking ahead - More fixes to unbreak Zope Studio against the current Mozilla codebase. - Start implementation of a object handling component architecture, where new object types can be supported with installing new Zope Studio components. Zope Web -- by Ethan Fremen - The Spotlight has been altered in a mostly behind-the-scenes fashion, but they should be easier to maintain. - The second Zope Chat went over well. I want to do them every week: Tell me what the topics "should be", http://www.zope.org/Documentation/Chats/ChatTopics If you want to speak, "tell me", mailto:mindlace@digicool.com - The came_from bug "was squished", http://www.zope.org/Tracker/37 - ZopeNews properly "formats structured text", http://www.zope.org/Tracker/39

1 0

Updated Compilation of Zope Howtos and Tips
by Alexandre Ratti 07 Jun '00

07 Jun '00

Hello, I updated the compilations of Zope Howtos and Tips in PDF format. The new PDF files contain 185 Howtos and 65 Tips. You can download them from here: <http://www.zope.org/Members/AlexR/ZopeDocs/> Secondary download site (where uncompressed PDFs are also available): <http://alexandre.ratti.free.fr/ZopeDocs/> Cheers. Alexandre

1 0

Project Work Available: Export Zope DB to MS SQL or Access
by NYNewMedia 06 Jun '00

06 Jun '00

Hello! I have a client who wants to export their zope DB to MS SQL or MS Access. I need someone who could do this job on a contract basis. If any of you have the experience to do the above, please email me directly - your contact information (tel & email address), - your charge for this project, - and references. This project needs to be done in the next few days. Wilbert nynewmedia(a)yahoo.com __________________________________________________ Do You Yahoo!? Yahoo! Photos -- now, 100 FREE prints! http://photos.yahoo.com

1 0

HappySession 0.1.0 released!
by Hung Jung Lu 05 Jun '00

05 Jun '00

Hi, I have been using RAM-based session management for a while, but never wrote a product for it. Since Graham Chiu has mentioned it again about making a real product, I have taken the time to make one, and called it HappySession. :) Well, in short, it uses cookie for session id, you specify a maximum session expiration time, and expired session data are automatically deleted. It's Zope-transaction-aware. I got a lot of help from Pavlos Christoforou (author of FSSession, a file-system-based session management product.) Thanks a lot, Pavlos! Give it a try. Let me know whether there is any problem. It's easy to use, or at least that's what I have intended. :) It's my very first product, so if there are any bad things that I have done, please let me know. Here is the URL: http://www.zope.org/Members/hungjunglu/Products regards, Hung Jung ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

1 0

[ANN] Zope at Linuxtag 2000 in Stuttgart
by Stephan Richter 02 Jun '00

02 Jun '00

Hello everyone, A couple of days back Martijn Faassen and I had the idea to organize a European Zope conference. Maik Roeder reminded me of the upcoming Linuxtag 2000 in Stuttgart. So I contacted the Linuxtag staff and we will have a booth. Martin Schulze, my main contact, will also try to get a Zope Conference setup for us, which would give us 2 rooms for one day fitting 50 people per room, where we can have talks and discussions. The Linuxtag will be from June 29th (Thursday) to July 2nd (Sunday). It will be in the Exhibition Center (Messegelaende) in Stuttgart, Germany. I know we have little time to organize the conference (26 days). We have one day to fill with speeches and discussions, so please let me know if there are people willing to give some talks or want to have "Special Interest Group" discussions, like E-commerce, XML or Portals in Zope. I would also like to know, who would be able to come, so I can give the Linuxtag staff some feedback. Here are some subjects I thought we could have: The ZDP Portal (Maik Roeder, ....), XML in Zope (I know Martijn F. did a lot of work there. ;-), An Introduction to Zope for newbies (Stephan Richter -- me), ZClasses, Python Products for Zope and so on. I also would like to hear some talks and discussions about Python products that Zope uses, such as PyGres, PIL, mxDateTime and other modules. I would be very glad, if some Python-only people would show some interest too. :-) The speeches and discussion can be held in German and English (preferred, since we expect people from other countries). So, everyone who is interested in preparing a talk or discussion, please send me an E-Mail and I will compile it to a schedule. The rooms will be open for us between 9:00 am - 8:00 pm on Thursday the 29th. Let's make this a successful event! Regards, Stephan -- Stephan Richter CBU - Physics and Chemistry Web2k - Web Design/Development & Technical Project Management

1 0

ZRTChat-0.3.0 - the Python version
by Jim Washington 02 Jun '00

02 Jun '00

In a possibly futile attempt to improve my zope zen, I have reversioned ZRTChat as a Python product based on Boring, making this probably one of the first products to go from folders and DTML Methods to ZClasses to Python. Special thanks to Shane for the 'refresh' tab (http://www.zope.org/Members/hathawsh/Refresh) and Evan for packProduct (http://www.zope.org/Members/4am/packProduct) There are few changes from 0.2.0, so it might be an interesting exercise for new people to compare 0.2.0 in ZClasses and 0.3.0 in Python to see what the difference is. Or not. What has changed functionally: A somewhat nicer Properties page Select all, Clear all on the Contents page Edit box now clears on submit. (yay!) The last two use just a wafer-thin bit of javascript, so the product is no longer javascript-free. I am thinking of using more javascript and addition of css for the future. The obligatory link: http://www.zope.org/Members/jwashin/ZRTChat -- Jim Washington Center for Assessment, Evaluation and Educational Programming Department of Teaching and Learning, Virginia Tech

1 0

[announce] SQL Session 0.2.9 available.
by Anthony Baxter 02 Jun '00

02 Jun '00

A long-overdue update to SQL Session is out. This version (0.2.9) will be the last version in the 0.2.x series (assuming no brown paper bag bugs in this release). I will be now working on 0.3.x, which will hook into the transaction machinery so that it only makes a single set of updates in a transaction. This should lower the database hits significantly. Installation: If you have a previous version of SQLSession, you might need to go to the management panel of your Session object after installing the new version and hit 'Change'. Note that the default schema has changed to avoid bad words like 'name', 'session', 'sessions' and 'value', since some databases have issues with these. Changelog from 0.2.3: Code now uses it's own decodestring/encodestring, because the standard python lib supplies an incredibly stupid implementation. (take a string, wrap it in a StringIO, then pass it to encode which then pulls out the string again.) Rough testing shows that a small string encode or decode drops from 1ms or so to about 1/20th of that. Given how often this is done, it makes a big big difference. Jeff Hoffman supplied a patch that makes SQLSession work with 2.2 - adding __allow_access_to_unprotected_subobjects__ = 1 to the SESSION object. Ooo, magic. Changed the default schema and queries to avoid using the words 'session', 'value' or 'name'. Different databases have different ideas of which are and are not reserved words. Added a new option 'path', to specify the cookie path. This means that you can specify, say, /foo, and only the browser will only send the cookie when requesting URLs beginning with /foo. Re-did some of the internals to avoid what may or may not have been a refcount cycle. I'm still not sure what caused it - assigning the SESSION object to REQUEST.SESSION, with SESSION keeping a reference to the parent Session object. It now finds Session by acquisition. A number of dumb bugs were squished. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0