- Zope-Announce - Zope lists

SECURITY ALERT and Zope hotfix release [2001-03-08]
by Brian Lloyd 09 Mar '01

09 Mar '01

Hello all - An issue has come to our attention (thanks to Randy Kern) that necessitates a Zope hotfix. Hotfix products can be installed to incorporate modifications to Zope at runtime without requiring an immediate installation upgrade. Hotfix products are installed just as you would install any other Zope product. This hotfix (Hotfix_2001-03-08)addresses an important security issue that affects Zope version 2.3.0 and the current 2.3.1 beta 1 release. The issue involves an error in the 'aq_inContextOf' method of objects that support acquisition. A recent change to the access validation machinery made this bug begin to affect security restrictions. The bug, with the change to validation, made it possible to access Zope objects via acquisition that a user would not otherwise have access to. This issue could allow users with enough internal knowledge of Zope to perform actions higher in the object hierarchy than they should be able to. We *highly* recommend that any Zope site running Zope 2.3.0 final or any alpha or beta version of 2.3.0 or 2.3.1 beta 1 have this hotfix product installed to mitigate the issue. Zope 2.3.1 beta 2 will contain a fix for the issue, at which time the hotfix can be removed. Zope versions prior to 2.3.0 are not affected by this issue. - http://www.zope.org/Products/Zope/Hotfix_2001-03-08/README.txt - http://www.zope.org/Products/Zope/Hotfix_2001-03-08/Hotfix_2001-03-08.tgz Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

FreePM 0.6.0b - Is Online
by Tim Cook 07 Mar '01

07 Mar '01

We are very proud to present the online demo of FreePM 0.6.0b The distribution files for *nix and MS platforms will be available in a few days for you to download. What is FreePM? FreePM is an open source, cross-platform Electronic Medical Record application. It requires use of the Zope application server (also open source) from Digital Creations, Inc. The client interface can be any frames capable, javascript enabled web browser. New Features: Template Driven Patient Encounters. Template Generator (you will definitely need to read the documentation on this). Better EMR workflow organization. We invite you to build templates on the demo site. These templates will be included with future distributions of FreePM. Community involvement has been great so far. Your continued support insures the success of this open source application. What to do with the demo: Select a patient record (or enter a new one), begin a patient encounter. Try out the lower back pain template. The help file for encounters is not yet finished. You can write prescriptions, order lab and radiology. These can be inserted into the note. Immunizations, injections and procedures will be ready in the next day or two. After seeing how the template works in the encounter, close this EMR and go back to the main menu. Select Configuration and then Templates. There is a help file that gives an introduction on how to construct templates. If it is confusing, please post questions to the freepm list. BTW: Thanks to Sourceforge for getting the list back up and running again. The tickler for Lab and Radiology is working so that when an order is placed it is displayed on the tech's menu. When the tech (or whomever) enters the results it is being entered directly into the EMR. ----------------------------- Things we're working on next: Interface cleanup to make some of the old stuff match the new stuff. Printing (BTW: All printing is done via PDF files. You will need a PDF viewer such as Acrobat Reader or xpdf). Sending reports / results via email. Orders generate charges. The infrastructure is there, just need to finish some charge tables and work on the code where it changed between versions. E&M coding levels checking (more information about coding in general in a few days). Integration of the Multum Drug Database. Documentation. ----------------------------------- Moving from the development version to the demo I have several security checks to turn off so that anonymous users can gain access. If you get prompted for a login please let me know what you were trying to access. If you would like to more actively participate in the development of FreePM please let me know. Thanks, -- Tim Cook, President - FreePM,Inc. http://www.FreePM.com Office: (901) 884-4126 http://www.freepm.org:8080/FreePM

1 0

Announcement: CMF 1.0 beta released
by Tres Seaver 06 Mar '01

06 Mar '01

We are pleased to "release version 1.0 beta", http://cmf.zope.org/download/CMF-1.0beta of the Zope Content Management Framework (CMF). Please review the "release notes":../README.txt and the "known issues":../ISSUES.txt. >From the README: What is the CMF? The Zope Content Management Framework provides a set of services and content objects useful for building highly dynamic, content-oriented portal sites. As packaged, the CMF generates a site much like the Zope.org site. The CMF is intended to be easily customizable, in terms of both the types of content used and the policies and services it provides. Resources * The CMF "dogbowl" site, "http://cmf.zope.org":http://cmf.zope.org. * The mailing list, zope-ptk(a)zope.org. List information and online signup are available at: http://lists.zope.org/mailman/listinfo/zope-ptk. Archives of the list are at: http://lists.zope.org/pipermail/zope-ptk. Tres. -- =============================================================== Tres Seaver tseaver(a)digicool.com Digital Creations "Zope Dealers" http://www.zope.org

1 0

Mysql Admin in Zope
by Randhir Shinde 06 Mar '01

06 Mar '01

Hi guys, We have developed a Mysql Admininstrator in Zope. It is a very useful tool for Zope sites that have mysql server installed. It connects to the server and let you access the database and have administration. Please tell me how do I upload this software to the Zope product list so that people can use it for themselves.? Regards Randhir

1 0

ANNOUCE Dtml-Contract
by ender 05 Mar '01

05 Mar '01

Introducing the dtml-contract tag, the swiss army knife of dtml, it documents, it validates, it does form processing, it redirects, it reduces the amount of dtml you need to write, and if you ask nicely it might even do your laundry. All of this and more for that amazing price of free. ats its heart this utilitarian tag is a form processor based on the ArsDigita Community System's ad_page_contract. take a simple dtml form processing method <dtml-comment> this method changes the myint property of this object </dtml-comment> <dtml-if "REQUEST.has_key('myint')"> <dtml-try> <dtml-call "REQUEST.set('myint', _.int(myint)"> <dtml-except> Please enter an integer value for myint </dtml-try> <dtml-else> Please enter an integer value for myint </dtml-if> <dtml-call "manage_changeProperties({'myint':myint})"> all of this for a simply trying to get a variable coerced and displaying a userful error message to the user, add in a few more variables and the amount of code just grows. sophisiticated zopitista's might say, well just use ZPublishers coercion functions, and write <input type="string" name="myint:int"> but there are a couple problems with this. 1. error messages are unhelpful, zpublisher will short circuit so you won't get information about errors with all variables 2. because this information is transmitted via the http request, its vulnerable to url surgery. 3. its hard to customize and add your own conversion utilities, error messages, or error pages. so how does dtml-contract save the day? dtml-contract in action <dtml-contract> this method changes the myint property of this object <dtml-params> myint:integer <dtml-exception> error_page </dtml-contract> with this we've setup a method which is documented, expects a variable myint in the request, will automatically try to convert it to an integer, and if doesn't exist will return an evaluation of error_page. we've already cut down on the lines of dtml-code, plus we won't get the insertion of extra blanks commonly associated with coding in dtml. now imagine extending our simple example to a real app with several form variables and the utility of dtml-contract becomes more apparent. i could wax poetic about the myriad features of dtml-contract, but the day is short and i must drive to the python conference so here's a quick laundry list. features - comes with 10 filters including -newobid -obid -range(type, min, max) -optional -trim -nohtml -email -date -float -naturalnum - comes with extensive in source documentation in javadoc style - comes with extensive readme docs - takes optional argument to remove all non-contracted variables from the request (request.form to be specific). - takes optional arguements to redirect instead of writing directly to the connection on errors - sets error information in the error_handlers namespace (as contract_errors) - has utility functions for registering user defined filters. act now and i'll even toss in some unittests. http://www.zope.org/Members/k_vertigo/ZopeProducts/PageContract cheers kapil thangavelu off to the python conference.

1 0

Zope Administration Guide Documentation Project
by Will Dennis 05 Mar '01

05 Mar '01

"...and the Lord spake, saying, 'First shalt thou take out the Holy Pin, then shalt thou count to three, no more, no less. Three shalt be the number thou shalt count, and the number of the counting shalt be three. Four shalt thou not count, neither count thou two, excepting that thou then proceed to three. Five is right out. Once the number three, being the third number, be reached, then lobbest thou thy Holy Hand Grenade of Antioch towards thou foe, who being naughty in my sight, shall snuff it.'" Yes, all complex systems need instructions, lest we blow ourselves into tiny bits. For too long, our favorite application server platform has lacked a comprehensive administrator's reference manual. Right then! Presenting the: *** Zope Administrator's Guide (ZAG) Documentation Project *** From the Scope description: "The ZAG should cover installation, maintenance, backups, upgrading, integrating Zope with web servers, using ZEO, Zope logs, Zope database maintenance (ie packing), troubleshooting, installing and upgrading products, compiling Zope, initial manager creation. "The ZAG should not cover using Zope, or developing for Zope. For example, the ZAG probably shouldn't cover creating user accounts, or controlling permission/role settings." We're looking for a few good writers, editors and reviewers (anyone who's interested, really) to help out with this important documentation project. If you have Zope installation/administration experience to share, and an ability to write in a clear manner, this documentation project needs your input. Please visit the Zope Administrator's Guide project page at: http://www.zope.org/DocProjects/AdminGuide/Project/FrontPage Thanks!

1 0

ANNOUNCE. Zope Beans v 0.1
by Paul T 04 Mar '01

04 Mar '01

Experimental version: http://www.pault.com/zope_beans.html Genbean.py v 0.1 Tested with Zope 2.3.0 The big picture is described in the paper "Zope: How To Win Big". http://www.pault.com/zope.html What is Zope Bean? Zope Bean is a simplified plug & play product for Zope. Zope Bean encapsulates a set of properties and methods. Zope Bean has one creation screen, one configuration screen and one information screen. Zope Bean is not Zope Component. Zope Component is experimental new feature in Zope. I have not seen it implemented yet. However, from the paper: "Components need not be persistent, nor provide a management interface." Zope Beans are persistent and they provide a management interface. Zope Bean is not exactly Zope Product. Zope Products are hard to create and hard to maintain. If you're Python/Zope pro who is used to write complex Zope Products, the chances are that you may have no need in Zope Beans - you're already a magician. However, Zope Beans enforce loose coupling design (something to think about). The biggest difference between Zope Bean and Zope Product is that Zope Bean is extremely easy to create and to maintain even you have no experience with Zope Products at all. If you know a bit of Python - you can write and use Zope Beans. Next version of Zope Beans may provide more functionality (like complex types of properties, one-bean-cooperating-with-other-bean, Global Bean Distribution Network, e t.c.) The purpose of this version is to show that writing plug & play Zope Products could be significantly easier than it is now. Comments welcome. Rgds.Paul.

1 0

New PostgreSQL Database Adapters: psycopg and ZpsycopgDA
by Federico Di Gregorio 28 Feb '01

28 Feb '01

Hi *, the guys here at initd (http://initd.org/) arre happy to announce the release of psycopg, a Python/PostgreSQL driver module and ZPsycopgDA, a Zope Database Adapter based on the psycopg driver. Now, I'll answer the questions you asked... (_what_ questions? well... follow me...) Q. Why another postgresql dba? we already have pygres and popy! A. That's true. We had some ideas about a performant, thread-safe driver and we wanted to hack a little bit. the resulting driver is slim, fast, with clean code and some nice features (see below.) Writing a Zope DBA was a logical consequence only because we use it. Q. Should I switch to psycopg and zpsycopgda? A. Not if you are happy with your current driver [and i hope it is popy ;-)] The only real reason is if you want the advanced features you can find only in psycopg: 1/ level-2 thread safety 2/ advanced type-casting system 3/ automatic management of multiple phisical connections to the DB (one per thread) to speed up queries 4/ extremely clean and maintainable code also, in a future release (0.5) zpsycopgda will support db and table management from zope management screens. Q. Hey! you're from MIXAD LIVE, is psycopg a popy fork? A. No, psycopg is 100% clean code. we had some ideas on how a db driver should workin a heavily multithreaded environment and we wanted to test them. that's all. Q. Where can I download it? A. http://initd.org/Software/psycopg (tarball and precompiled debian packages) ciao and good hacking, federico -- Federico Di Gregorio MIXAD LIVE Chief of Research & Technology fog(a)mixadlive.com Debian GNU/Linux Developer & Italian Press Contact fog(a)debian.org Qu'est ce que la folie? Juste un sentiment de liberté si fort qu'on en oublie ce qui nous rattache au monde... -- J. de Loctra

1 0

Another satisfied user
by Walter Miller 27 Feb '01

27 Feb '01

Maybe this is old news but it looks like http://appwatch.zdnet.com uses Zope.

1 0

[Ann] DocFinder 0.3: ask Zope about its documentation
by Dieter Maurer 23 Feb '01

23 Feb '01

DocFinder is a small Zope product that presents documentation about Zope objects. The new version 0.3 supports 3 types of documentation: for product programmers, for script/DTML programmers and for through the Web users. More information and download: URL:http://www.dieter.handshake.de/pyprojects/zope/DocFinder.html Dieter

1 0