- Zope-Announce - Zope lists

Zope security alert and 2.1.7 update [*important*]
by Brian Lloyd 15 Jun '00

15 Jun '00

Hello all, We have recently become aware of an important security issue that affects all released Zope versions including the recent 2.2 beta 1 release. The issue involves an inadequately protected method in one of the base classes in the DocumentTemplate package that could allow the contents of DTMLDocuments or DTMLMethods to be changed remotely or through DTML code without forcing proper user authorization. A Zope 2.1.7 release has been made that resolves this issue for Zope 2.1.x users. This release is available from Zope.org: http://www.zope.org/Products/Zope/2.1.7/ A patch is also available if it is not feasible to update your Zope installation at this time (the patch is based on 2.1.6): http://www.zope.org/Products/Zope/2.1.7/DT_String.diff If you are evaluating any of the recent 2.2 alpha or beta releases, you should apply the patch noted above if your site is accessible by untrusted clients. A forthcoming 2.2 beta 2 release will contain the fix for this issue. While we know of no instances of this issue being used to exploit a site, we *highly* recommend that any Zope site that is accessible by untrusted clients take the appropriate mitigation steps immediately. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

New ZMySQLDA Release
by Monty Taylor 15 Jun '00

15 Jun '00

A new version of ZMySQLDA is available. This version incorporates the MySQLdb module from Andy Dustman. There are also a few cosmetic changes as well. Checkout http://www.zope.org/Members/mordred/ZMySQLDA. I'm marking this as development due to the incorporation of the new back-end module, but I'm not expecting any problems. Monty

1 0

Zope Weekly News June 14th
by ethan mindlace fremen 14 Jun '00

14 Jun '00

LinuxTag, the Open Source Convention, Launch of Zope 2.2.0b1, a Docs Wiki and much Documentation work, PTK gains steam, Guido's time machine stolen, Improved Products page and more! The opinions expressed in Zope Weekly news are solely the authors', and not the opinions of Digital Creations, The Zope Community at-large, or the Spanish Inquisition. The Zope Weekly News now has a "permanent home", http://www.zope.org/Documentation/ZWN. And Now For Something Completely Different: Coming Events LinuxTag There will be a Zope booth at the "LinuxTag", http://www.linuxtag.de in Stuttgart, Germany from June 29th to July 2nd. In addition to the booth that will be there for the whole conference, there will be 2 rooms available for talks and discussions on the business day, Thursday 29th. There will not be an additional charge for the two rooms on buisness day. We are still looking for people who want help organizing the conference, give some talks and attend the booth. Generally, it would also be great to know who is planning to be at the conference. Please send feedback to "Stephan Richter", mailto:srichter@digicool.com See "Zope at Linuxtag", http://www.zope.org/Members/Linuxtag/ for the most up-to-date information. The Open Source Convention This "enormous convention", http://conferences.oreilly.com/oscon2000/ hosted by O'reilly, is shaping up to be pretty interesting. Aside from the State of Python, given by Guido von Rossum, there's also going to be a "talk on the CERT Advisory", http://www.oreillynet.com/pub/w/evening_events.html about cross-site scripting, a web-wide security issue that the Zope Community was among the first to begin implementing security policies for: they'll land with zope 2.2. Zope is going to be at the conference in force, with: - Paul "opening eyes to the Zope-Mozilla initiative", http://www.oreillynet.com/pub/e_sess/853 - Ryan telling the world "you can have web IMAP and collaboration", http://www.oreillynet.com/pub/e_sess/725 - Christopher, as always, concentrating on the "edification of the community", http://www.oreillynet.com/pub/w/python_tutorials.html Documentation -- by Amos Lattier This Week * We've released the Docs Wiki http://www.zope.org/Wikis/Docs This is your source for information on official Zope documentation. You can find out about all our projects including their status and timelines. You can also see what Amos, Michel and Stephan are doing each week. Plus, since it's a wiki you can add your comments. * The bulk of this week's work will be spent trying to get the online docs ship shape for Zope 2.2 final. Mike is finishing up the API docs, Amos is working on the help system framework and tutorial and Stephan is working on the management help content. * Mike is working with O'Reilly this week to clarify the status of his book. If all goes well we should have a definitive answer on making it official Zope documentation by the end of the week. Next Week * Next week will be spent finishing any bits that need finalizing for Zope 2.2 that we don't finish this week. * Hopefully next week we can begin making Mike's book public. Zope Status -- by Brian Lloyd Summary We finally beat the todo list and got the 2.2 beta 1 release "out the door", http://www.zope.org/Products/Zope/2.2.0b1 (and there was much rejoicing!). Last week highlights 7 more collector issues were closed last week, and the remaining items on the todo list for 2.2 beta 1 were knocked out. The needed hooks for non-invasive virtual hosting support were added, as well as better Undo handling, several catalog fixes and some long overdue fixes to the way that HTTP HEAD requests are handled that should make Zope more friendly to various spidering tools. This week's good-buddies-of-the-core: o Chris Withers and others for forcing some action on the HEAD issue o Toby Dickenson and Butch Landingin contributed fixes for ZCatalog o tazzzzz sent a patch to un-screw what I screwed up last time I worked on MailHost :^) Next week Next week we'll be absorbing feedback on the beta release and planning for final. More importantly, work will begin in earnest on the "opening the development process" initiative. I hope to get a basic "Zope core development"- focused area set up, publish the draft Zope roadmap for comment and start working out some post-2.2 plans. This week in the PTK Community -- by Tres Seaver * David Brown, author of "Zope Fish":http://zopefish.weblogs.com/ZopeFishRelease, agreed to join TeamPTK. Welcome! * We arrived at protocol for gaining consensus on proposed changes: - Create a tracker issue embodying the proposal (which then emails the list). - Discuss the proposal in email, copying significant arguments to the tracker. - Finally, one TeamPTK member accepts the item, makes the changes, and posts the patch/update. - After a final "speak now or forever hold your peace" interval, TeamPTK member checks in changes. * Bill Anderson found a workaround for the problem of DTML methods "losing" other methods inside the portal: <URL http://lists.zope.org/pipermail/zope-ptk/2000-June/000940.html> * Dan Pierson checked in his patches integrating the PTK with the new LoginManager: <URL http://lists.zope.org/pipermail/zope-ptk/2000-June/000937.html> * Dan also proposed fixing "Discussable" items such that they *always* display their discussion: <URL http://www.zope.org/Products/PTK/Tracker/93> * Dan Pierson posted a tracker issue describing the difficulty of customizing the display of PortalContent objects: <URL http://www.zope.org/Products/PTK/Tracker/94> * Tres Seaver created a somewhat terse How-To on creating PortalContent classes as ZClasses: <URL http://yyy.zope.org/Products/PTK/ZWiki/CreatingAPortalContentZClass> * Tres also wrapped up the "vision" statement for the PTK-NG: <URL http://www.zope.org/Products/PTK/ZWiki/OnceAndFuturePTK> * Phillip Eby delivered a wonderful "motivation" piece for the ZPatterns meta-framework he and Ty Sarna have been building (and which underlies LoginManager): <URL http://lists.zope.org/pipermail/zope-dev/2000-June/005323.html> * Shane Hathaway replied with a nice "file clerk" analogy for the ZPatterns: <URL http://lists.zope.org/pipermail/zope-dev/2000-June/005352.html> * Kevin Dangoor released a new Membership product, which packages the LoginManager in a more "friendly" bundle: http://www.zope.org/Members/tazzzzz/Membership He is asking for testers, with the goal of re-integrating the package with the PTK after a shakeout. * A new discussion on refactoring some of the dependencies between PTKBase and PTKDemo: <URL http://lists.zope.org/pipermail/zope-ptk/2000-June/000962.html> yielded two Tracker issues: <URL http://www.zope.org/Products/PTK/Tracker/96> <URL http://www.zope.org/Products/PTK/Tracker/97> Looking Ahead * Re-integrate Kevin Dangoor's Membership product * Land proposed refactoring of concrete PortalContent and of Discussable decoupling. * Discuss integrating ZPatterns more closely into PortalContent. PTK Tracker Vitals, WE 2000/06/13 Type / Status New Closed Current Bug Reports 4 0 19 Feature/Doc Requests 1 0 15 <hr NOSHADE SIZE="0" WIDTH=95%> Zope Studio Martijn has stolen Guido's time machine in order to complete a year long class in a mere two weeks. We cannot recieve this week's Zope Studio information, lest we be sucked into a temporal anomaly. Zope Web -- by Ethan Fremen This Week: o AlexR's "All howto's" & all tips, both HTML & PDF, have been integrated into their respective pages. Thanks, Alex! o While the Members page remains in abeyance, the Products page recieved a "lot of work", http://www.zope.org/Tracker/43 with descriptions and sorting added, the "disappearance" of Digital Creations Products when asking for more Members Products, with more to come! o Paul Everitt had some interesting ideas on the future of the "Documentation section", http://lists.zope.org/pipermail/zope-web/2000-June/000035.html How do *you* think it should look? Weigh in on "zope-web(a)zope.org", http://lists.zope.org/mailman/listinfo/zope-web o There's between 10-20 people regularly on #zope these days! The internet just isn't real without the "real time interaction", http://www.zope.org/Documentation/Chats o The cataloguing bug "was squished", http://www.zope.org/Tracker/44 Zope Mail o All the zope mailing lists had a net gain of 45 members. o Zope had a lot of churn, with only 5 net (52 gross) subscribers and 47 unsubscribers. o Zope-announce is more popular, with a net 13 gain. o Zope-dev was still proving rough going for many folks, with a net unsubscription of one. o Zope-ptk is still in the radar, with a net gain of 7. o Zope-mozilla held on with a net rise of one subscriber. o And ZDP was even for the week. Next Week o I'm going to be in Virginia (finally) so the rumblings of Zope-Web Geddon should begin! Lots of good ideas coming from the folks in the "Zope Documentation Project", http://zdp.zope.org/ Like every project, it too has its "own wiki", http://www.zope.org/Members/chrisw/ZopeSites/FrontPage

1 0

ZPatterns 0.3.0 Binary Release (with URL!)
by Nick Garcia 13 Jun '00

13 Jun '00

(And for my next trick, I'll actually provide the URL through which to download it!) I have compiled the latest version of ZPatterns on a RedHat 6.2 system for anyone who wants it. I can't guarantee compatibility with all distributions, as it's compiled against glibc 2.1.2. This release will work on all the CodeIt machines. Get it at: http://www.zope.org/Members/ngarcia/ZPatternsBinaryRelease -- Nick Garcia | ngarcia(a)codeit.com CodeIt Computing | http://codeit.com

1 0

ZPatterns 0.3.0 Binary Release
by Nick Garcia 13 Jun '00

13 Jun '00

I have compiled the latest version of ZPatterns on a RedHat 6.2 system for anyone who wants it. I can't guarantee compatibility with all distributions, as it's compiled against glibc 2.1.2. This release will work on all the CodeIt machines. -- Nick Garcia | ngarcia(a)codeit.com CodeIt Computing | http://codeit.com

1 0

Zope 2.2 beta 1 released
by Brian Lloyd 12 Jun '00

12 Jun '00

Zope 2.2.0 beta 1 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.0b1/ This release contains refinements to the new ownership model as well as better undo management and many bug fixes. For more information, see: http://www.zope.org/Products/Zope/2.2.0b1/CHANGES.txt If you are still using a 2.1.x version of Zope, be sure to see the document http://www.zope.org/Products/Zope/2.2.0b1/upgrading_to_220 for information on the recent changes to the Zope security model and other upgrade information. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

ANN: InterbaseStorage alpha release
by Chris McDonough 11 Jun '00

11 Jun '00

Hi, The alpha release of a Zope storage that uses the Interbase relational database to store object database information is available at http://www.zope.org/Members/mcdonc/RS/InterbaseStorage. It's a full-featured storage. Guinea pigs^H^H^H^H^H^H^H^H^H^H^H Testers wanted. -- Chris

1 0

Random line of Products
by Oleg Broytmann 09 Jun '00

09 Jun '00

Hello! I created and published three demo toy Products I named them "Random" Products, because each of them displays text, randomly selected from a list prepared by webmaster. These Products differ in how they store the text items. I learned a good deal of Zope internals while wrote it, and I hope that looking into it will help people to learn Product API. I also run a demo site for these Products. Source code: http://www.zope.org/Members/phd/Random/ Demo site : http://sun.med.ru/pcgi/Random/ DETAILS: The first Product, RandomLine was created from Boring Product - I just learned Product API. The product stores text (edited in a texarea), splits the text into a list of lines and when asked displays a random line. The second Product, RandomLine_v, is just a modified version of the first. The difference is volatile attributes. I found (in RandomLine) that I store both text and splitted list of strings in ZODB. I thought I need to learn volatile attributes and this version stores only text in ZODB. The splitted list stored in a volatile attribute and recomputed when neccessary. The third Product, RandomItem, implements the same idea, but with different implementation. The core class is ObjectManager-derived, and it stores a list of items. Every item in turn stores multiline text. Oleg. ---- Oleg Broytmann http://www.zope.org/Members/phd/ phd2(a)mail.com Programmers don't die, they just GOSUB without RETURN.

1 0

Public Zope training class scheduled for Aug 7-10
by Gary Graham 08 Jun '00

08 Jun '00

Public Zope training class is scheduled for August 7-10. We are going to use the same wonderful KDC facility that we used for our last class in Dulles airport area near Washington, DC. You might want to enjoy DC on Friday before flying back out. This is the "high tourist season" for DC so all the museums, etc are open. Weather will be warm - maybe even hot. The dates are: Zope 101: Monday, Aug 7th thru Wed Aug 9th Zope 201: Thursday, Aug 10th The class fills very quickly. So contact me ASAP to reserve seating. ZOPE101: 3 Days, $1,495.00(US) per person This three (3) day course provides the student with a thorough and briskly paced introduction to Zope. This course is valuable for applications and Web site developers, Webmasters, system adminis- trators and others developing and/or supporting intranet/Internet services using Zope. Students should have a thorough understanding of HTML (including the development and use of HTML forms). ZOPE201: 1 Day, $450.00(US) per person This one (1) day seminar provides the attendee with an opportunity to develop a real-world application under the supervision and guidance of an experienced commercial Zope developer. The instructor will guide the students' development of an application utilizing SQL, ZClasses, ZCatalog, and various user authentication techniques. This fast-paced day will end with a survey of design patterns and develop- ment approaches appropriate with Zope. Registration To register for these courses, please send the following information to: gary(a)digicool.com Name Organization Name Desired Venue Phone number (fax number if possible) Course (e.g., Zope 101 AND 201, Zope 101 only, Zope 201 only, etc.) We will contact you as soon as possible after receiving your email. Important Notes: The first five (5) pre-paid registrants for the Zope101 course will be entitled to attend the Zope201 course at no additional charge. Payment for training courses is due within twenty-one (21) days of the start of the course in order to confirm seat reservations. Complete refunds are available for cancellations made more than twenty-one (21) days before the start of the course. Fifty (50) percent refunds are available for cancellations made more than fifteen (15) days from the start of the training course. No refunds will be offered for cancellations made less than fifteen (15) days from the start of the course. U.S. Government and Educational institutions enjoy a 20% discount. The training day starts at 9a and ends at 5p daily. See www.digicool.com/Solutions/Training/ for more details on the individual classes. Knowledge Development Center url is www.kdc-washington.com/ They can give you info about the surrounding area and lodging. There is a "Homewood Suites" located next door to KDC. Flights should go to Washington DC either to Dulles Airport (closest) or National Airport (but requires an approximate 20 mile drive). -------------------- --Gary Gary Graham gary(a)digicool.com Director, Sales & Marketing Digital Creations Fredericksburg, Virginia USA mobile: 540.840.3813 office: 540.371.6909 ext 117 ---------------------------------------------------- Creators of Zope: The Open Source Application / Content Management Server www.zope.org www.digicool.com

1 0

Zwiki security alert!
by Simon Michael 08 Jun '00

08 Jun '00

I've added some 0.6 release notes on zwikiweb (http://joyful.com/zwiki) and also a Security Alert! summary: upgrade to 0.6.1 now! DTML trojans: Zwiki versions before 0.6 allowed executable DTML content by default, with a big vulnerability: a hostile anonymous or unprivileged user could add harmful DTML code to a page - eg to delete all zope objects - which could get successfully executed by the next privileged user to view that page. Zwiki 0.6.1 has changes to alleviate this. HTML trojans: The trojan issue is still a problem even with non-DTML pages which are editable, because most of zwiki's page types are rendered as HTML. This means hostile users could add harmful HTML or javascript to be executed by others who view the page. What this means: If you manage a zwiki web that is editable by untrusted users, you should (a) upgrade to 0.6.1 or greater (b) familiarize yourself with this issue (c) choose a policy you are comfortable with and change your page types and your view/edit/manage permissions if necessary For more details, see the commentary on the trojan issue below and http://www.zope.org/Members/jim/ZopeSecurity/TrojanIssueOverview Regards, -Simon

1 0