- Zope-Announce - Zope lists

Zope 2.2.0 beta 3 released...
by Brian Lloyd 26 Jun '00

26 Jun '00

Hi all, Zope 2.2.0 beta 3 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.0b3/ This release resolves the "len of unsized object" error some folks were seeing with their SQL methods as well as an issue with broken installed products causing a recursion problem instead of appearing as normal "broken" objects. I'm hopeful that this will be the last 2.2 beta, assuming that no other real problems arise that need fixes tested before final. For more information, see the CHANGES.txt file for the release: http://www.zope.org/Products/Zope/2.2.0b3/CHANGES.txt If you are still using a 2.1.x version of Zope, be sure to see the document upgrading to Zope 2.2: http://www.zope.org/Products/Zope/2.2.0b3/upgrading_to_220 for information on the recent changes to the Zope security model and other upgrade information. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Zope Job Board Available
by Patrick Lewis 26 Jun '00

26 Jun '00

A new job board is now available for employers that want to post jobs pertaining to Zope. The board is located at: www.zope.org/Members/plewis/job_board. Comments and suggestions for improvement are welcome. -- Patrick Lewis <pl(a)teleport.com>

1 0

new product: NISUserFolder
by Jonothan Farr 22 Jun '00

22 Jun '00

I've created a new product similar to etcUserFolder that authenticates against an NIS database. http://www.zope.org/Members/jfarr/Products/NISUserFolder/ This also improves upon the etcUserFolder product by defining a separate role for each user group, allowing more fine-grained control of which users have which permissions. I've submitted a patch to the collector containing these same changes to etcUserFolder. If DC decides not to include them I'll release this as a separate product. Enjoy! --jfarr "Perl is worse than Python because people wanted it worse." Larry Wall, 14 Oct 1998

1 0

Zope 2.2 beta 2 released
by Brian Lloyd 22 Jun '00

22 Jun '00

Hi all, Zope 2.2.0 beta 2 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.0b2/ This release resolves the outstanding issues from beta 1 as well as the integrated fix for the recent security issue and further refinements of the help system. For more information, see the CHANGES.txt file for the release: http://www.zope.org/Products/Zope/2.2.0b2/CHANGES.txt If you are still using a 2.1.x version of Zope, be sure to see the document "Upgrading to Zope 2.2" for information on the recent changes to the Zope security model and other upgrade information. http://www.zope.org/Products/Zope/2.2.0b2/upgrading_to_220 Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

mod_pcgi2 version 1.1.1
by Oleg Broytmann 21 Jun '00

21 Jun '00

Hello! http://www.zope.org/Members/phd/mod_pcgi2/ mod_pcgi2 version 1.1.1. Some minor corrections in handling of root location and SCRIPT_NAME. Still experimental - I have not got enough reports to announce it stable. Oleg. ---- Oleg Broytmann http://www.zope.org/Members/phd/ phd2(a)mail.com Programmers don't die, they just GOSUB without RETURN.

1 0

ANN: First public release of ZEO
by Paul Everitt 20 Jun '00

20 Jun '00

ZEO 0.2, an alpha version of ZEO, is now publicly available from the "ZEO page", http://www.zope.org/Products/ZEO/. ZEO is the clustering code for Zope. This version does *not* contain the multiplexing code that was holding up the release. Be sure to check the page for performance numbers posted by Greg Ward. Enjoy! --Paul

1 0

zope worldwide drawingincode public domain release
by michael bolger 20 Jun '00

20 Jun '00

to the Zope Community, from beginner to expert. drawingincode, a process development creating web based applications generally in the knowledge engineering and bio-informatics sector. We are asking for anyone who might be interested in participating at this moment, specifically at this time in your respective country(or interested in) to register drawingincode.your_country. You would be the "owner". We ask that you participate in some related way that would "care" for promoting open source idea's and concepts, especially related to provide opportunity's/education for children in respective country's. This is a long term "project" with no immediate "hurry", other than registering domain :) drawingincode will be sponsoring zope product development, most likely thru established open_source project portals. We will announce our full "mission statement" at our exhibition space in Monterey at the Oreilly sponsored open source conference on July 19,2000 I michael p bolger and drawingincode.com/.net_and.org being the "owner" (copyright 1st Quarter 1999) of the word "drawingincode" - "release"/establish- drawingincode to the public domain. no_strings, url's like drawingincodenews etc. are encouraged. I see all drawingincode's with a vision of world peace and prosperity for all. Thank You michael p bolger northern california 6/20/2000 7 a.m. drawingincode(a)lifeplant.com

1 0

SQLRelay with Zope Database adapter
by Roman Milner 19 Jun '00

19 Jun '00

I'm happy to announce the first release of a database adapter for sqlrelay. In short, with this adapter and a small client library your zope server can talk to Oracle, Postgresql, MySQL, mSQL, SQLite, and Lago - without having the client libs for any of these database servers on your Zope server machine. SQLRelay (an open source product by firstworks http://www.firstworks.com) runs a daemon that listens for sql queries - it then relays the query to the database server and returns the results to the socket client allowing you to talk to any of the above databases via a simple socket protocol. Two python APIs are provided - one that closely matches the sqlrelay client API and one that is semi DB API compliant. The database adapter works on top of the DB API. The DA and python interfaces are included in the latest release of SQLRelay. You will also need to download the latest release of the rudiments library. Both can be had from the firstworks homepage: http://www.firstworks.com Much thanks to David Muse, the author of SQLRelay, for near 24 hour support in getting this written. ^Roman

1 0

ANN: Debian Zope security release (2.1.6-5)
by Gregor Hoffleit 16 Jun '00

16 Jun '00

I have prepared a security release of the Zope 2.1.6 Debian package in order to fix the DTML vulnerability in Zope reported yesterday (cf. http://yyy.zope.org/Products/Zope/Hotfix_06_16_2000/security_alert) The new package is currently in Debian's incoming queue. The temporary URL is http://incoming.debian.org/zope_2.1.6-5_i386.deb Hopefully it will be moved into potato and woody by the release manager RSN. Please read the security alert mentioned above and consider upgrading your site to 2.1.6-5. The package fixes the possible exploit by including the Hotfix_06_16_2000 product. If you install 2.1.6-5, you don't need to install the Hotfix nor apply DT_String.py.diff nor do you need to upgrade to 2.1.7. Gregor Hoffleit <flight(a)debian.org>

1 0

Updated security alert
by Brian Lloyd 16 Jun '00

16 Jun '00

Hi all - I've updated the security alert (below). Short story: a new "hotfix product" is available on zope.org that will work for all 2.0+ Zopes and has no side effects or upgrade implications for Zope installations. This feels like a much better model for things like this, especially for production sites. ---------------------------------------------------------------- We have recently become aware of an important security issue that affects all released Zope versions including the recent 2.2 beta 1 release. The issue involves an inadequately protected method in one of the base classes in the DocumentTemplate package that could allow the contents of DTMLDocuments or DTMLMethods to be changed remotely or through DTML code without forcing proper user authorization. A hotfix for this issue in the form of an add-on Zope product has been made available on zope.org. To install the hotfix, simply download and install the package as you would any other Zope add-on product (extract it in the root of your Zope installation). Remember to restart your Zope installation for the hotfix to take effect. http://www.zope.org/Products/Zope/Hotfix_06_16_2000/Hotfix_06_16_2000.tg z The hotfix will work for all versions of Zope 2.0 and higher, including the recent 2.2 alpha and beta releases. The forthcoming Zope 2.2 beta 2 release will contain a fix for this issue, and you be able to uninstall the hot fix after upgrading to 2.2. (though nothing bad will happen if you don't uninstall it). Note that the 2.1.7 release that was initially made to address this issue has been pulled in favor of this hotfix product, which will allow managers of Zope sites to address this issue without worrying about other implications of upgrading their installations. While we know of no instances of this issue being used to exploit a site, we *highly* recommend that any Zope site that is accessible by untrusted clients install the 06/16/2000 hotfix product immediately. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0