- Zope-Announce - Zope lists

SECURITY alert and hotfix release...
by Brian Lloyd 23 Feb '01

23 Feb '01

Hello All, Casey Duncan uncovered a potential security issue today that necessitated a hotfix release. This hotfix addresses an important security issue that affects Zope versions up to and including Zope 2.3.1 b1. The issue is related to ZClasses in that a user with through-the-web scripting capabilities on a Zope site can view and assign class attributes to ZClasses, possibly allowing them to make inappropriate changes to ZClass instances. This patch also fixes problems in the ObjectManager, PropertyManager, and PropertySheet classes related to mutability of method return values which could be perceived as a security problem. We *highly* recommend that any Zope site running versions of Zope up to and including 2.3.1 b1 have this hotfix product installed to mitigate these issues if the site is accessible by untrusted users who have through-the-web scripting privileges. - http://www.zope.org/Products/Zope/Hotfix_2001-02-23/README.txt - http://www.zope.org/Products/Zope/Hotfix_2001-02-23/Hotfix_2001-02-23.tgz Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Product release: ExtFile/ExtImage 1.1.0.beta1
by Gregor Heine 20 Feb '01

20 Feb '01

ExtFile/ExtImage Product 1.1.0.beta1 has just been released. Get it at http://www.zope.org/Members/MacGregor/ExtFile The new Version comes with many, many internal changes and some new features which will (hopefully) make ExtFile/ExtImage even more reliable: - You can set a 'level of undo' which determines in wich cases the external file is overwritten/deleted or renamed to '.undo'. - 'id collision bug' fixed, which caused unreferenced files in the repository, when an id of a new object already existed (thanks to Fred Yanowski). Instead of in the __init__ method, the file data is now passed to the object after it has been successfully added, via manage_file_upload. - 'wrong file size bug' fixed, which caused a wrong file size and resolution of the image and preview, after a new file was uploaded followed by an undo of this transaction. The filesize and resolution attributes have been replaced by corresponding methods which determine the respective value directtly from the file(e.g. width(), height(), prev_size(), ...) - Objects can be assigned an alternative id (instead of the filename) by the optional 'id' field in the manage_add method of ExtFile and ExtImage. - Uploaded preview images can be resized during upload (like the generated previews). - Images can be dynamically resized (thanks to Arno Gross): the index_html method now has two additional parameters ('width' and 'height') which cause the image to be resized on the fly. - Documentation updated. Because the product was rewritten in big parts this release is a beta version which might still have some bugs. I haven't had too much time for testing, so please report me any bug you find. I hope I will be ableto publish the next stable release within the next two or three weeks.

1 0

February 19th Zope News
by ethan fremen 20 Feb '01

20 Feb '01

The Content Management Framework formerly known as PTK, Zope 2.3.1 beta is out, Presentation Templates will save us, Zope.org stabilized, all in this week's Zope News. The opinions expressed in Zope News are solely the authors', and not the opinions of Digital Creations, The Zope Community at-large, or the Spanish Inquisition. If you or your company are doing something cool with zope, "submit it to Zope News", mailto:zope-web@zope.org for possible inclusion. And Now For Something Completely Different: ---- Zope Presentation Templates -- by Ethan Fremen "Zope Presentation Templates", http://www.zope.org/Members/tcoram/PresentationTemplates now in an alpha release, have the promise of both replacing dtml and integrating well with wysiwyg tools, like Adobe GoLive. I'm really excited about this project: it should go a long way towards us being able to have real separation of logic, presentation, and data. The basic idea is that attributes in a namespace will control manipulation of nodes in a native XML namespace: the most common example will be XHTML. This means that you'll no longer have a page so saturated with additional tags that you cannot identify the underlying XHTML: instead, you'll have a well formed document that your editor can play nicely with. A crude example is: <p tal:insert="here/saying">Dummy Text</p> Assuming the document had a property called "saying", with a value of "Hello World", the result would be: <p>Hello World</p> There are "more examples", http://dev.zope.org/Wikis/DevSite/Projects/ZPT/Examples including basic loop constructs. After you download and try out the software, please give some feedback to the "development project.", http://dev.zope.org/Wikis/DevSite/Projects/ZPT/CurrentStatus ---- Zope Status by Brian Lloyd Summary Zope 2.3.1 beta 1 released Recent News This week's not-so-weekly update: Thursday Feb. 15 we released beta 1 of Zope 2.3.1. 2.3.1 will follow in a week or so barring any problems. The 2.3.1 release contains quite a number of bug fixes, both issues found during the upgrade cycle to 2.3 and quite a few older issues that had been languishing in the Collector. We anticipate that 2.3.1 will be quite solid, so we will be able to turn some attention to other things and start talking about some new longer-term initiatives for Zope. ---- The Content Management Framework Formerly Known as the PTK --by Ethan Fremen The CMF has been on the fast track for the past month or so. Tres reports that we should have a 1.0 release by the end of this month. You can read all about it at the "CMF dogbowl", http://cmf.zope.org so today I'll just hilight one of the exciting things in the CMF: Access-based filtered searching. An article that has just been written but not approved might appear in a list of to-be-approved items for an editor. This list is generated by a catalog query: however, a regular user, searching for articles, will not see the yet-approved article. Perhaps once this article is published, it is in a members only area. Then, members will see it both in a catalog-driven list of content, but also in raw searches, yet it will remain invisible to the "Anonymous User". I reviewed quite a few indexing engines a while ago. Finding one that stayed up-to date with the changes made to the site was hard enough (All CMF content is automatically catalogued): Finding one that gave a different set of results to different kinds of viewers was impossible. ---- Zope Web --by Ethan Fremen ZopeOrgBlowsUp For the past few weeks, Zope.org has been rather unstable. I'm pretty confident in the zope software, and so I found this rather unnerving. I put some work into tracking it down, but Shane Hathaway really found the culprit, and Ken Manheimer finally put it to rest. The new wikis had an infinite-recursion loop that was causing zope to segfault. Luckily, this has been corrected, and my pager has been silent since (yay!). Cluster Grows Zope.org's cluster is also getting a bit bigger: We're adding a new storage server so that the mail can have a machine to itself. Other benifits of the new server will be support for files greater than 2GB, so that zope.org will stop coming to a writing halt every time the database passes that point. We're also adding another ZEO client box to the cluster that will allow us to have a place to do things (like load in all of the mailing list messages) that are a bit ... resource intensive. Zope.org grows up Since the CMF is nearing release status, it's high time that Zope.org starts moving in that direction. We're going to be building a new Zope.org off of this one-dot-oh release, so stay tuned for a lot of activity next month. -EOT-

1 0

Re: [Zope] New Riders to publish The Zope Book
by Michel Pelletier 20 Feb '01

20 Feb '01

I'm sure they will. Also, for those of you who have been asking for it, I have uploaded a full tarball of the book in HTML format that can be downloaded in one gulp: http://www.zope.org/Members/michel/ZB/TheZopeBook2.3a2.tgz -Michel On Mon, 19 Feb 2001, J. Atwood wrote: > Great news... keep the list informed so we may also purchase a full > blooded copy when it is available. I am sure New Riders would enjoy > that. :) > > J > > At 3:08 PM -0800 2/19/01, Michel Pelletier wrote: > >New Riders to publish "The Zope Book" > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

New Riders to publish The Zope Book
by Michel Pelletier 19 Feb '01

19 Feb '01

New Riders to publish "The Zope Book" As many of you know, Amos Latteier and I have spent the last year working with O'Reilly and Associates writing a book about Zope. Recently, O'Reilly decided not to publish the book. We took the book to a number of different publishers, all of whom showed a lot of interest in publishing it. After lots of discussion and review of our options, we have decided to go with New Riders Publishing. We think is a great choice for us, for Zope, and for the Zope community. New Riders is a great publishing company, and we have been very impressed with their line-up of high quality, open source oriented books. Amos and I are really excited to become NR authors, and to have our works placed alongside other great NR books. One of our main reasons for going with NR was their enthusiasm to publish the book under an open content license. Starting today, *The Zope Book* is licensed under the Open Publication License v1.0 (http://www.opencontent.org/openpub/) with none of the restrictive license options chosen. These new licensing terms means that we can we begin to distribute the book in several different downloadable formats, and that you, the reader, can use the book content in a free and open manner in accordance with OPL guidelines. We will also be providing the book in raw, structured text format from a publicly available CVS archive so that community members can contribute patches directly to the book, and other great documentation projects we will be announcing soon! At this point, it is difficult for us to talk about firm timelines, but we hope to have the book on the shelves by early June. NR is very commited to providing us with extensive editorial resources, and the next couple of months are going to be really exciting! For those of you who participted in our free, signed book contest, don't worry, you'll still get your signed copy, it will just look a little different that what you expected. ;) I have uploaded the newest version of the book to Zope.org. We have been waiting for the publication deal to happen before we did this, and now that all that is taken care of you will be seeing lots of changes to the book, and hopefully some more useful downloadable formats in the near future. The book can be found on the Zope.org website at http://www.zope.org/Members/michel/ZB/. Once again, thanks for all your comments and support. Without all those eyes out there looking at our work, it would not be what it is today, and hopefully it will only continue to get better thanks to you and the friendly folks at New Riders. -Michel Pelletier

1 0

[Ann] Chapter "Basic Concepts" of my upcoming Zope book
by Dieter Maurer 18 Feb '01

18 Feb '01

Dear Zopistas, the chapter "Basic Concepts" of my upcoming Zope book is ready for preview. It covers Zope site building objects, Web publishing, name lookup, DTML, site management and Zope security. You find it at URL:http://www.dieter.handshake.de/pyprojects/zope/book/chap3.html I consider it a valuable resource beside (and probably after) the official Zope book. It covers many of the questions that recur often in Zope's main mailing list. It is currently in a pre-alpha state. I know of the following problems: * lack of graphics to explain difficult concepts (such as DTML namespace, acquisition and Zope's security model) * many broken links If external links are broken, it was my lazyness. Broken internal links are caused by Python's XML processing tools not yet being fully up to process DocBook. * synopsis sections look very strange, caused by small bugs in Norman Walsh's DocBook stylesheets * lack of a stylesheet to improve presentation Dieter

1 0

ANNOUNCE: Call for Zopistas at O'Reilly OSCON
by Brian Lloyd 16 Feb '01

16 Feb '01

Hello all, I'm looking for some true believers who are planning to attend the O'Reilly Open Source Convention in San Diego this July and who would be interested in giving a Zope-related talk. The OSCON brings together geeks from all over the Open Source map, and this is a great opportunity to help get the word out about Zope (or your own Zope work). This is a crowd you can talk nuts and bolts with, so topics are pretty wide open. If you are interested and can give a firm commitment, please email me directly (brian(a)digicool.com) and let me know what you'd like to talk about and an approximate length. And if you need added incentive, I'll make sure that anyone who gives a talk leaves with some coveted Zope booty :^) Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

ANNOUNCE: Zope 2.3.1 beta 1 released...
by Brian Lloyd 15 Feb '01

15 Feb '01

Hello all, Zope 2.3.1 beta 1 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.3.1b1/ Zope 2.3.1b1 fixes a number of issues that have come up through usage of 2.3.0, as well as some previously reported issues from the Zope bug collector. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: http://www.zope.org/Products/Zope/2.3.1b1/CHANGES.txt http://www.zope.org/Products/Zope/2.3.1b1/HISTORY.txt Note that we have also posted "diff" updates as .tgz files that will let you easily upgrade an existing 2.3.x site. These updates are available for those currently using the 2.3.x source release or the 2.3.x binary releases. To apply a differential update to your site: - download the appropriate .tgz file from zope.org - shutdown your Zope process - copy the .tgz to your Zope directory and extract it - run w_pcgi or wo_pcgi *if you are not using a binary release* - restart your process Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

BookmarkFolder 1.0.0 Preview 1 released
by morten＠esol.no 14 Feb '01

14 Feb '01

BookmarkFolder is a simple product for managing bookmarks. It is available at <url:http://www.zope.org/Members/morphex/BookmarkFolder>. Cheers, Morten

1 0

Zope Membership Component Site Updated
by Bill Anderson 14 Feb '01

14 Feb '01

Zope Membership Component Site Updated More documentation is available, as is a 1.0 release roadmap. An update for the ZMC (Zope Membership Component) is available on http://zmc.immortalitysystems.net. It contains fixes for the delete users methods. Also available is a Zope export for 0.8.0beta1, which includes Python Scripts replacing the Python methods; this version will require Zope 2.3.x.

1 0