- Zope-Announce - Zope lists

SECURITY alert and hotfix release
by Brian Lloyd 08 Dec '00

08 Dec '00

Hi all, Aleksander Salwa has brought a security issue to our attention that affects all Zope versions up to and including Zope 2.2.4. We have released a Hotfix product to address the issue that can be downloaded from zope.org. (Thanks to Aleksander for finding this and to Shane Hathaway for his quick response in resolving it!) The issue involves security registration of "legacy" names for certain object constructors such as the constructors for DTML Method objects. Security was not being applied correctly for the legacy names, making it possible to call those constructors without the permissions that should have been required. This issue could allow anonymous users with enough internal knowledge of Zope to instantiate new DTML Method instances through the Web. The hotfix for this issue is available on the zope.org web site: o http://www.zope.org/Products/Zope/Hotfix_2000-12-08/Hotfix_2000-12-08.tgz We *highly* recommend that any Zope site running versions of Zope up to and including 2.2.4 have this hotfix product installed to mitigate the issue. The hotfix will work for all versions of Zope 2.2.0 and higher. A future version of Zope will contain the fix for this issue, and you will be able to uninstall the hot fix after upgrading. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

ZMySQLDA Zope Product 2.0.1
by Andy Dustman 07 Dec '00

07 Dec '00

Zope MySQL Database Adapter Stability: Alpha Released: 2000-12-07 03:30 UTC Notes I have not done a whole lot of testing on this one, but it seems to work adequately. You MUST have MySQLdb-0.3.0 for this release! Note that this provides two versions: ZMySQLTDA, which supports the Transaction Manager; ZMySQLDA, which does not. Only use ZMySQLTDA with MySQL-3.23.29 and higher, and only with transaction-safe tables (i.e. BDB tables). If you are using MySQL-3.22 or otherwise using non-transaction-safe tables (i.e. ISAM, MyISAM), you must use ZMySQLDA, and you will not be able to use Zope's transactional abilities. As with all Zope products, unpack this into your Zope tree (where the lib directory is), and restart Zope. http://dustman.net/andy/python/ZMySQLDA/2.0.1 -- Andy Dustman PGP: 0xC72F3F1D @ .net http://dustman.net/andy

1 0

Zope Weekly News for December 6th
by ethan mindlace fremen 06 Dec '00

06 Dec '00

Planning for 2.3, give me wiki now, Python Scripts, Documentation Processes, Zope 3 bedtime stories, Interface documentation, and Zope.org bug stomping. The opinions expressed in Zope Weekly news are solely the authors', and not the opinions of Digital Creations, The Zope Community at-large, or the Spanish Inquisition. If you or your company are doing something cool with zope, "submit it to the Zope Weekly News", mailto:zope-web@zope.org for possible inclusion. And Now For Something Completely Different: ---- Zope Status by Brian Lloyd Summary Gearing up for 2.3 Recent News Last week we released Zope 2.2.4 which took care of quite a few bugs - now its time to start thinking about all new bugs, er, features for Zope 2.3. I have updated the "Zope 2.3 plan on dev.zope.org", http://dev.zope.org/Resources/zope_230_plan.html It now details the planned release milestones for 2.3 and what features will be in each milestone. 2.3 will be important from a usability perspective: alpha 1 will include Evan's "Python Scripts" that will allow people to implement logic in a language meant for logic (not DTML!) and the way that user bootstrapping occurs at install time will be changed. Superuser will no longer exist unless you explicitly need and create it - the user created at install time will simply be a bootstrap manager. That means that newbies won't immediately run into "SuperCannotOwn" errors because they forgot to create an initial manager and re-login (which was a pretty brain-dead expectation anyway!) In the fishbowl, Michel is working with Amos to finish describing the "Zope documenation process", http://dev.zope.org/Wikis/DevSite/Projects/DocumentationProcess Ken Manheimer is working on the "Wiki For Now", http://dev.zope.org/Wikis/DevSite/Projects/WikiForNow project (or "Wiki Aspirin" as Jim calls it) that aims to provide solutions for some of the more painful shortcomings of Wikis as they are used for running development projects. This one will probably be completed by the week of the 13th. Near Future Next Monday (the 13th) I expect to release 2.3 alpha 1. After seeing how that goes and looking at resource availability we'll be working to set a date for the next milestone (a2). ---- Documentation by Michel Pelletier This week Amos is still working on the "Zope 3 Story" with the Virginia crew and finishing off the Documentation process. He and I will be creating some new projects that track the book, and some other documentation artifacts, so Watch Out! We'll send out some general announcements when we have something substantial. This week I'm working on "Python Interfaces":http://www.zope.org/Wikis/Interfaces, Python Script online help system documentation, and the rather mundane task of converting every mention of "Python Method" in "the book":http://www.zope.org/Members/michel/ZB to "Python Script". I tried to train my monkey to do it but he resented the new name that was chosen; having preferred *Python Snake Thingy* like many of you did. The internal technical reviewers at O'Reilly still haven't gotten back to us about the book yet, so we have nothing new for the community reviewers to do. We know your anxious, and we hope you're still with us when the book comes back! Till next week... ---- Zope Web -- by Ethan Fremen New Things Have Bugs Well, Zope.org has had a few problems, in that feedback and signing up for membership were both broken. They should be fixed now. I am still working on the "not authenticated on dev.zope.org" issue. Working on Description I am working on a description of the cluster, and should have at least a bare bones outline (that will get fleshed in with lots of details) on the site by the end of the week. -EOT-

1 0

ZODB development page & SourceForge project
by Andrew Kuchling 06 Dec '00

06 Dec '00

I've created a SourceForge project for ZODB development: http://sourceforge.net/projects/zodb/ A page of development-related links that will be updated as needed is at: http://www.amk.ca/zodb/devel.html The goal of this project isn't to create a fork of the ZODB code, or to make many modifications to the core ZODB packages. Instead it will focus on the surrounding tools, packaging and documentation, aiming to make the ZODB more useful for people who want to use it as an object oriented database for Python. For example, we're using it to store (Developers who want to hack on the core ZODB packages must make such sensitive changes on a CVS branch; the trunk will track DC's version of the ZODB code.) --amk

1 0

Is there an interest for Zope classes taught in Europe
by Gary Graham 30 Nov '00

30 Nov '00

Digital Creations is considering offering Zope classes for the European market with perhaps two classes in the Springtime in 2001. We are asking for your input on: 1) are there any students interested in attending? 2) suggestions for class locations and dates? 3) price has not been set yet and may vary according to location costs. 4) most likely the classes would be taught in English 5) what other languages? 6) are there qualified multi-lingual Zope instructors? Comments, other ideas, suggestions or, any students interested, please reply to training(a)digicool.com --Gary Gary Graham gary(a)digicool.com Director, Sales & Marketing Digital Creations Fredericksburg, Virginia mobile: 540.840.3813 office: 540.372.9971 direct eFax: 781.394.7868 ---------------------------------------------------- Creators of Zope: The Open Source Application / Content Management Server www.zope.org www.digicool.com

1 0

ANNOUNCE: Zope 2.2.4 (final) released...
by Brian Lloyd 27 Nov '00

27 Nov '00

Hello all, Zope 2.2.4 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.4/ This release supercedes the 2.2.3 release, which had an error that prevented permissions from being acquired correctly. Until the testing infrastructure that has been started in the 2.3 CVS is more mature and there is a useful regression test rig, we'll be planning for at least one (short) beta period for third-dot releases. This bug-fix release contains the fixes for all released Hotfixes to date, as well as fixes for a memory leak in the Acquisition module, various ZCatalog fixes and a fix for the infamous "__call__" bug. It also contains a fix for a problem in header parsing in the dtml sendmail tag that has affected some users recently. The problem with caching of ImageFile objects (mainly icons in the Zope management interface) in the 2.2.4 beta is also fixed (and verified using the Cacheability Engine (http://www.web-caching.com/cacheability.html) For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.2.4/CHANGES.txt - http://www.zope.org/Products/Zope/2.2.4/HISTORY.txt Note that we have also posted "diff" updates as .tgz files that will let you easily upgrade an existing 2.2.x site. These updates are available for those currently using the 2.2.x source release or the 2.2.x binary releases. To apply a differential update to your site: - download the appropriate .tgz file from zope.org - shutdown your Zope process - copy the .tgz to your Zope directory and extract it - run w_pcgi or wo_pcgi *if you are not using a binary release* - restart your process Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Best wishes
by Federico Di Gregorio 24 Nov '00

24 Nov '00

Dear PoPy and ZPoPyDA users, last days, a lots of stuff happened here at MIXAD LIVE. the most important to you is that source code for the programs is not in our cvs server anymore and the home page was moved to the official Zope site[1]. To make it short, thierry and eric decided to not work for MIXAD LIVE anymore. so, what will change for you PoPy users? hopefully nothing... we'll continue to submit patches (we are using the product a lot) and to host the mailing list (unless they wants to move it away.) i will personally keep on packaging PoPy and ZPoPyDA for the Debian distribution. we also want to transfer to thierry the copyright of all the work done by us on the programs, to give him total freedom. i think PoPy and ZPoPyDA will grow better and better in the future. what can i say more? maybe "good luck" to them and "keep on hacking"... federico [1] http://www.zope.org/Members/tm/ZPoPyDA -- Federico Di Gregorio MIXAD LIVE Chief of Research & Technology fog(a)mixadlive.com Debian GNU/Linux Developer & Italian Press Contact fog(a)debian.org Qu'est ce que la folie? Juste un sentiment de liberté si fort qu'on en oublie ce qui nous rattache au monde... -- J. de Loctra

1 0

Product Release
by Gianluigi Tiesi 20 Nov '00

20 Nov '00

I have released ZSwGenerator, a product to dynamically generate Macromedia Flash objects using swift-generator from http://www.swift-tools.com -- Gianluigi Tiesi Responsabile R&D NetFarm S.r.l. http://www.netfarm.it GSM: +39.3473679811

1 0

ANNOUNCE: Zope 2.2.4 beta 1 released...
by Brian Lloyd 20 Nov '00

20 Nov '00

Hello all - Zope 2.2.4 beta 1 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.4b1/ This release supercedes the 2.2.3 release of Friday, which had an error that prevented permissions from being acquired correctly. Until the testing infrastructure that has been started in the 2.3 CVS is more mature and there is a useful regression test rig, we'll be planning for at least one (short) beta period for third-dot releases. I expect to make 2.2.4 final in a week barring any serious problems. This bug-fix release contains the fixes for all released Hotfixes to date, as well as fixes for a memory leak in the Acquisition module, various ZCatalog fixes and a fix for the infamous "__call__" bug (and there was much rejoicing!). For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: http://www.zope.org/Products/Zope/2.2.4b1/CHANGES.txt http://www.zope.org/Products/Zope/2.2.4b1/HISTORY.txt Note that we have also posted "diff" updates as .tgz files that will let you easily upgrade an existing 2.2.x site. These updates are available for those currently using the 2.2.x source release or the 2.2.x binary releases. To apply a differential update to your site: - download the appropriate .tgz file from zope.org - shutdown your Zope process - copy the .tgz to your Zope directory and extract it - run w_pcgi or wo_pcgi *if you are not using a binary release* - restart your process Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

RE: ANNOUNCE Zope 2.2.3 release...
by Brian Lloyd 17 Nov '00

17 Nov '00

FYI - someone has noticed a problem with the posted 2.2.3 release that needs looking into, so I've unlisted it for the time being. I'll send out a note and re-list it after we dig into this a bit... Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0