January 2004 - Zope-Announce

ANN: PloneCollectorNG 1.1.0 Beta 3 released
by Andreas Jung 18 Jan '04

18 Jan '04

I am pleased to announce the release of PloneCollectorNG 1.1.0 beta 3(PCNG) PCNG is a bugtracking system for Plone. It is based on the concepts and ideas of CMFCollector and CMFCollectorNG but it is a complete re-write. PCNG is a very generic and open framework (you can configure nearly everything TTW). This release **REQUIRES Archetypes AT 1.3**. **Older Archetypes versions (including 1.2.1) WILL NOT WORK**. This major step was necessary because a lot Archetypes hacks in PCNG 1.0.0 were backported to Archetypes CVS/HEAD. This release also breaks compatibility with portal_forms. CMFFormController is now mandatory. There is a risk that this release might break an existing PCNG instance. So BACKUP YOUR DATA first. The goal for 1.1.0 final is to be compatible with exisitings installations so please let me know if there are any problems. Changes since 1.1.0 beta 2: - SchemaEditor raised an AttributeError if 'Create index' has not been selected for an Archetypes field - Removed german email formatter. The standard email formatter now supports all languages (available through the !PlacelessTranslationService) - using the Archetypes API to accessing or storing fields (no longer using the storage interface directly) - fixed several unicode related problems which caused problems with Plone sites using UTF8 as site encoding - pdfwriter ships with the Vera truetype font provided for free for open-source projects by Bitstream (www.bitstream.com) This is necessary because Reportlab is not directly capable to generate PDFs from UTF8 encoded text without hacks - PlacelessTranslationService: This version of !PloneCollectorNG **requires** an up-to-date version of PTS (best to get a CVS checkout from the OpenTal CVS, see http://savannah.nongnu.org/projects/opental) Older version will raise an !AttributeError 'as_unicode' exception. - Unicode support rewritten: The transcript is now completely unicode-based. Email formatters and pdf writter use unicode for generating the corresponding output. IF YOU UPGRADE FROM FORMER VERSIONS OF PloneCollectorNG: - backup your Data.fs (!) first - for every PloneCollectorNG instance you **MUST** run the 'migrateUnicode' script on the instance to convert the collectors transcript to unicode by calling http://host:port/plone/somecollectorinstance/migrateUnicode Volunteers wanted: PloneCollectorNG is fully internationalized. If you want PCNG to support your language that translate the catalog file (i18n folder) to your language and submit it to me. Documentation Wiki: http://www.zope.org/Members/ajung/PloneCollectorNG Download: http://sf.net/projects/collective Commercial support: http://www.zopyx.com

1 0

New product: Tumatxa, for Translation Memory handling
by Luistxo Fernandez 16 Jan '04

16 Jan '04

Tumatxa 0.1 has been released. It is a new Zope product. Tumatxa is a web-based manager of translation memories (TMX, .po). It has been designed to aid in the process of translation. It lets translators and institutions that manage big volumes of translated text manage memories, terminology and translations on a web-based environment, overcoming restrictions posed by generators of Translation Memories. Memories stored at Tumatxa can be consulted (to clear terminology doubts, for instance) without specific TM software, just making online searches. Several memories can be packed to download as a file, also. Check the website to download the product, and try the demos. * Homepage: www.tumatxa.com When you install the product, any instance of Tumatxa that you create on your Zope installation is a full website in itself. --- What are translation memories? Translation Memory or TM is a technology widely used in professional translation and localization (unlike machine translation). The idea is simple, units or sentences from the original text and its translation are stored aligned into a database. When the system happens to find the same sentence (or a similar one), it would propose the previous translation. These are some of the most popular TM software programmes: Trados, Déjàvu, Wordfast, Transit, edo Translat. The standard for memory exchange among those applications is called TMX. Tumatxa handles TMX, and also the .po files of GNU Gettext. Technical info Tumatxa runs currently only on Linux OS. You need Zope 2.6 or later, and these additional Zope products: * BTreeFolder2 * TextIndexNG2 * Localizer, which lets the product, as well as the website Tumatxa.com, to be truly multilingual Tumatxa has been created by CodeSyntax - http://www.codesyntax.com/en/ Luistxo Fernandez LFernandez(a)codesyntax.com - 652 750 362 CodeSyntax - <http://www.codesyntax.com/>http://www.codesyntax.com/ Azitaingo Industrialdea 3K E-20600 EIBAR Tel: (+34) 943 82 17 80

1 0

PyCon Reminders (proposal submission ends tonight!)
by Guido van Rossum 15 Jan '04

15 Jan '04

Proposal Submission Deadline: Tonight! -------------------------------------- Tonight at midnight (in *some* timezone :-) is the last time to submit PyCon proposals. http://pycon.org/dc2004/cfp/ Early Bird Registration ----------------------- Deadline for Early Bird Registration: January 31. *** Speakers, don't forget to register!!!!!! *** http://pycon.org/dc2004/register/ Sprint pre-announcement ----------------------- Come a few days early and participate in a coding sprint. Sprints are free (courtesy of the PSF!), and are held from Saturday March 20 through Tuesday March 23 (i.e. the four days leading up to the conference). http://pycon.org/dc2004 . Volunteers ---------- We're looking for volunteers to help run PyCon. http://mail.python.org/mailman/listinfo/pycon-organizers About PyCon ----------- PyCon DC 2004 will be held March 24-26, 2004 in Washington, D.C. Keynote speaker is Mitch Kapor of the Open Source Applications Foundation (http://www.osafoundation.org/) Don't miss any PyCon announcements! Subscribe to http://mail.python.org/mailman/listinfo/pycon-announce You can discuss PyCon with other interested people by subscribing to http://mail.python.org/mailman/listinfo/pycon-interest The central resource for PyCon DC 2004 is http://www.pycon.org/ Pictures from last year's PyCon: http://www.python.org/cgi-bin/moinmoin/PyConPhotos I'm looking forward to seeing you all in DC in March!!! --Guido van Rossum (home page: http://www.python.org/~guido/) Open Source Awards: http://builder.com.com/5100-6375_14-5136758.html

1 0

CMFBoard 1.4.3 released
by Nikolay Kim 15 Jan '04

15 Jan '04

Official site http://www.cmfboard.org Version 1.4.3 * forum_styles.css now use base_properties for Plone2.0 * 'AddTopicReply' permission instead of using 'View' to control topic replyability * fixed lost reply title after "preview" * fixed more UnicodeDecodeError * fixed TypeError: unsupported operand types for + in some scripts * fixed error where brefs might not be a list, make it a list (with only one reply) in ForumMessage.py * fixed folder_forum_view and forum_get_forum_data to fix the topics and replies counters, and added a hits counter. * fixed wrong "Last Updated" link * fixed wrong pages links * fixed GroupUserFolder compatibility * fixed unicode forumEmail, now it always string * fixed "KeyError: forum_blog_widget" * fixed "AttributeError: hasReplies" with Plone2 * fixed bug in registry.py, can't join with maillist enabled * new translation Chinese(HongKong), French Download http://www.cmfboard.org/download/CMFBoard-1.4.3.tar.gz Download from Sourceforge http://prdownloads.sourceforge.net/collective/CMFBoard-1.4.3.tar.gz?download

1 0

ZopeMag Weekly News Issue 15!
by Mark Pratt 13 Jan '04

13 Jan '04

Hi, Every Week ZopeMag continues to publish the only regular and weekly News fix of things going on in the Zope and Plone community. We are now up to Issue 15 of the ZopeMag Weekly News! http://weekly.zopemag.com/ So bookmark our page and visit regularly ;-) The ZopeMag Staff

1 0

PyCon Reminder: Proposal deadline 1/15 (LAST WARNING)
by Guido van Rossum 12 Jan '04

12 Jan '04

This is the *last* reminder that the deadline for sending proposals for presentations at PyCon DC 2004 is January 15, 2004. That's upcoming Thursday! I'm also reminding everybody, speakers and non-speakers, of the upcoming deadline for Early Bird Registration: January 31. Until then, the registration fee is $175 (student rate $125); after that date, the registration price goes up to $250 (student rate $150). Don't forget to register! (Sorry, there's no speakers discount.) If you're coming to the conference, consider coming a few days early and participate in a coding sprint. Sprints are free (courtesy of the PSF!), and are held from Saturday March 20 through Tuesday March 23 (i.e. the four days leading up to the conference). For more info on sprints, see http://pycon.org/dc2004 . Now back to proposal submissions: We are interested in any and all submissions about uses of Python and the development of the language. Since there is expected to be a strong educational community presence for the next PyCon, teaching materials of various kinds are also encouraged. You can submit your proposal at: http://submit.pycon.org/ For more information about proposals, see: http://www.pycon.org/dc2004/cfp/ If you have further questions about the submission web interface or the format of submissions, please write to: pycon-organizers(a)python.org We would like to publish all accepted papers on the web. If your paper is accepted and you prepare an electronic presentation (in PDF, PythonPoint or PowerPoint) we will also happily publish that on the web site once PyCon is over. If you don't want to make a formal presentation, there will be a significant amount of Open Space to allow for informal and spur-of-the-moment presentations for which no formal submission is required. There will also be several Lightning Talk sessions (five minutes or less). About PyCon: PyCon is a community-oriented conference targeting developers (both those using Python and those working on the Python project). It gives you opportunities to learn about significant advances in the Python development community, to participate in a programming sprint with some of the leading minds in the Open Source community, and to meet fellow developers from around the world. The organizers work to make the conference affordable and accessible to all. PyCon DC 2004 will be held March 24-26, 2004 in Washington, D.C. The keynote speaker is Mitch Kapor of the Open Source Applications Foundation (http://www.osafoundation.org/) There will be a four-day development sprint before the conference. We're looking for volunteers to help run PyCon. If you're interested, subscribe to http://mail.python.org/mailman/listinfo/pycon-organizers Don't miss any PyCon announcements! Subscribe to http://mail.python.org/mailman/listinfo/pycon-announce You can discuss PyCon with other interested people by subscribing to http://mail.python.org/mailman/listinfo/pycon-interest The central resource for PyCon DC 2004 is http://www.pycon.org/ Pictures from last year's PyCon: http://www.python.org/cgi-bin/moinmoin/PyConPhotos I'm looking forward to seeing you all in DC in March!!! --Guido van Rossum (home page: http://www.python.org/~guido/) _______________________________________________ Pycon-organizers mailing list Pycon-organizers(a)python.org http://mail.python.org/mailman/listinfo/pycon-organizers

1 0

[ANN] TextIndexNG 2.05 released
by Andreas Jung 11 Jan '04

11 Jan '04

Fixes since 2.04: - fixed name clashes in hashtable code of TXNGSplitter (problem under MacOSX) - Indexing multiple attributes with one index has been broken between V 2.02 - V 2.04. Only the last attribute has been indexed. Download it from "here":http://www.zope.org/Members/ajung/TextIndexNG

1 0

Zope 2.7.0 beta 4 Release and Security Update
by Brian Lloyd 10 Jan '04

10 Jan '04

Zope 2.7.0 beta 4 Release and Security Update Zope 2.7.0 beta 4 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.7.0b4 from Zope.org: http://www.zope.org/Products/Zope/2.7.0b4/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.7.0b4 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.7.0b4 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.7.0b4 in the near future. Also note that there are binary code changes in the 2.7.0b4 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.7.0b4/CHANGES.txt - http://www.zope.org/Products/Zope/2.7.0b4/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

1 0

ANNOUNCE: Zope 2.6.3 Release and Security Update
by Brian Lloyd 09 Jan '04

09 Jan '04

Zope 2.6.3 Release and Security Update Zope 2.6.3 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.6.3 from Zope.org: http://www.zope.org/Products/Zope/2.6.3/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.6.3 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.6.3 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.6.3 in the near future. Also note that there are binary code changes in the 2.6.3 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation. Zope 2.6.3 provides fixes for all of these issues. A description of each issue, who is affected and issue status is included below. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.6.3/CHANGES.txt - http://www.zope.org/Products/Zope/2.6.3/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html ISSUES RESOLVED BY Zope 2.6.3: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher.

1 0

ZODB3 3.3 alpha 2 released
by Jeremy Hylton 07 Jan '04

07 Jan '04

I'm pleased to announce the release of ZODB2 3.3 alpha 2. This release includes support for new-style persistent classes and multi-version concurrency control. It's an alpha release, so we could use feedback on the new features and helping testing them. The 3.3a2 release requires Python 2.3. It contains the code that is slated to be in Zope 2.8. You can download a source tarball or Windows installer from http://zope.org/Products/ZODB3.3 The new features represent major changes to ZODB. Support for new-style classes means that ZODB programmers can use the new class features introduced in Python 2.2, like properties and descriptors. It also means that ZODB no longer uses ExtensionClass, which caused many subtle incompatibilities with other classes. The multi-version concurrency control feature represents the end of read conflicts. If a transaction encounters a conflict, it reads older revisions of the object rather than raising a ReadConflictError. This feature allows read-only transactions to see a consistent view of the database without need to handle read conflicts and restart the transaction. The code is fairly stable, but we have noted a few hard-to-provoke bugs during development. One problem is a refcount problem in the persistence core that causes rare core dumps in Python's garbage collector. (Rare means once a week across multiple developers and testers.) We hope to move to a beta release expeditiously, perhaps as early as next month. The final release schedule depends on the Zope 2.8 release schedule. More on that later. Enjoy! -- Jeremy Hylton <http://www.python.org/~jeremy/>

1 0