- Zope-Announce - Zope lists

[ANN] Zope 2.9.4 released
by Andreas Jung 20 Jul '06

20 Jul '06

Hi all, on behalf of Zope Corporation and the Zope community I am pleased to announce the release of Zope 2.9.4. This bugfix release corrects the information exposure vulnerability addressed in the "2007/07/05 Hotfix.", http://www.zope.org/Products/Zope/Hotfix-2006-07-05 You may remove that hotfix product from your instances after upgrading to this version of Zope. You can download it from http://www.zope.org/Products/Zope/2.9.4/ Some new features of Zope 2.9: - ZODB 3.6 - Five 1.3 - integration for Zope 3 events for object creation and deletion - Zope 3 i18n integration for page templates For more information on what is new in this release, see the CHANGES.txt files for the release: http://www.zope.org/Products/Zope/2.9.4/CHANGES.txt Please bring all the bugs you have found to the Zope bugtracker: "http://collector.zope.org/Zope":http://collector.zope.org/Zope For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.plope.com/Books/2_7Edition/InstallingZope.stx Supported Python versions: Zope 2.9 requires Python 2.4.3 (Python 2.4.1, 2.4.2 are still acceptable). Older Python versions are no longer supported. -- Andreas Jung (andreas at zopyx dot com)

1 0

Announcing the release of Zope version 2.8.8
by Tres Seaver 14 Jul '06

14 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Zope 2.8.8 Released On behalf of Zope Corporation and the Zope community I am pleased to announce the release of Zope 2.8.8. You can download the sources from "http://www.zope.org/Products/Zope/2.8.8/", http://www.zope.org/Products/Zope/2.8.8 This bugfix release corrects the information exposure vulnerability addressed in the "2007/07/05 Hotfix.", http://www.zope.org/Products/Zope/Hotfix-2006-07-05 You may remove that hotvix product from your instances after upgrading to this version of Zope. New features of Zope 2.8.x - ZODB 3.4 with MVCC (multi version concurrency control) support. MVCC solves nearly every problem with ZODB read-conflict errors which is very important for high-traffic Zope sites. - Extension Classes were rewritten as Python new-style classes making all features of Python new-style classes available in Zope objects. This includes support for cyclic garbage collection. - Integration of Zope 3 technologies through Five (see http://codespeak.net/z3/five/) More Information For more information on what is new in this release, see the CHANGES.txt files for the release: "http://www.zope.org/Products/Zope/2.8.8/CHANGES.txt", http://www.zope.org/Products/Zope/2.8.8/CHANGES.txt See also: "http://www.zope.org/Wikis/DevSite/Projects/Zope2.8/OverView" http://www.zope.org/Wikis/DevSite/Projects/Zope2.8/OverView For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: "http://www.plope.com/Books/2_7Edition/InstallingZope.stx", http://www.plope.com/Books/2_7Edition/InstallingZope.stx Reporting Bugs Please report all the bugs you have found to the Zope bugtracker: "http://collector.zope.org/Zope", http://collector.zope.org/Zope Supported Python versions At this time the only **supported** and **recommended** Python versions are 2.3.4 and 2.3.5. Using Python 2.4.X is **not supported** and **not recommended** at this time. Python 2.4.X will be supported when a security audit takes place. This means that you are using Python 2.4 + Zope 2.8 at **your own risk**. This warning also applies to binary packages that install Zope packages together with a system wide Python 2.4 installation (e.g. Fedora, SuSE...). Such installations are in general not supported. In addition there some third-party products and Python packages that don't work with Python 2.4 and can cause trouble when using Python 2.4. Tres. - -- =================================================================== Tres Seaver +1 202-558-7113 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEuB6X+gerLs4ltQ4RAofcAJ9lX+PxqXvlOv8Dl8tnxq2H/NLACwCfW5zN h2S/BSncs4Vb3BNBVeydsv0= =uDd5 -----END PGP SIGNATURE-----

1 0

Fredericksburg, VA ZPUG July 12: Jim Fulton's buildout package, Python + Fortran, roundtable
by Gary Poster 12 Jul '06

12 Jul '06

(Apologies for the especially late notice; for some reason these announcements did not go out when I sent them Monday to python- announce-list and zope-announce) Please join us Wed., July 12, 7:30-9:00 PM, for another meeting of the Fredericksburg, VA Zope and Python User Group ("ZPUG"). We will have a presentation, a lightning talk, a roundtable, and some good snacks. - Jim Fulton will present the talk he gave last week at EuroPython on zc.buildout. The zc.buildout project provides support for creating applications, especially Python applications. It provides tools for assembling applications from multiple parts, Python or otherwise. See http://svn.zope.org/zc.buildout/trunk/. - John Kimball will present a lightning talk of Fortran in Python. - We will have a roundtable discussion of Python and Zope topics. Gary ---------------------------------------- General ZPUG information When: second Wednesday of every month, 7:30-9:00. Where: Zope Corporation offices. 513 Prince Edward Street; Fredericksburg, VA 22408 (tinyurl for map is http://tinyurl.com/duoab) Parking: Zope Corporation parking lot; entrance on Prince Edward Street. Topics: As desired (and offered) by participants, within the constraints of having to do with Python or Zope. Mailing list: fredericksburg-zpug(a)zope.org Contact: Gary Poster (gary(a)zope.com)

1 0

Fredericksburg, VA ZPUG July 12: Jim Fulton's buildout package, Python + Fortran, roundtable
by Gary Poster 11 Jul '06

11 Jul '06

Please join us Wed., July 12, 7:30-9:00 PM, for another meeting of the Fredericksburg, VA Zope and Python User Group ("ZPUG"). We will have a presentation, a lightning talk, a roundtable, and some good snacks. - Jim Fulton will present the talk he gave last week at EuroPython on zc.buildout. The zc.buildout project provides support for creating applications, especially Python applications. It provides tools for assembling applications from multiple parts, Python or otherwise. See http://svn.zope.org/zc.buildout/trunk/. - John Kimball will present a lightning talk of Fortran in Python. - We will have a roundtable discussion of Python and Zope topics. Gary ---------------------------------------- General ZPUG information When: second Wednesday of every month, 7:30-9:00. Where: Zope Corporation offices. 513 Prince Edward Street; Fredericksburg, VA 22408 (tinyurl for map is http://tinyurl.com/duoab) Parking: Zope Corporation parking lot; entrance on Prince Edward Street. Topics: As desired (and offered) by participants, within the constraints of having to do with Python or Zope. Mailing list: fredericksburg-zpug(a)zope.org Contact: Gary Poster (gary(a)zope.com)

1 0

ANN: eGenix mxODBC Zope Database Adapter 1.0.10
by M.-A. Lemburg 10 Jul '06

10 Jul '06

________________________________________________________________________ ANNOUNCEMENT EGENIX.COM mxODBC Zope Database Adapter Version 1.0.10 Usable with Zope and the Plone CMS. Available for Zope 2.3 through 2.10 on Windows, Linux, Mac OS X, Solaris and FreeBSD ________________________________________________________________________ INTRODUCTION The eGenix mxODBC Zope Database Adapter allows you to easily connect your Zope or Plone installation to just about any database backend on the market today, giving you the reliability of the commercially supported eGenix product mxODBC and the flexibility of the ODBC standard as middle-tier architecture. The mxODBC Zope Database Adapter is highly portable, just like Zope itself and provides a high performance interface to all your ODBC data sources, using a single well-supported interface on Windows, Linux, Mac OS X, Solaris and FreeBSD. This makes it ideal for deployment in ZEO Clusters and Zope hosting environments where stability and high performance are a top priority, establishing an excellent basis and scalable solution for your Plone CMS. ________________________________________________________________________ NEWS We are pleased to announce a new version of our mxODBC Zope DA product. The Zope DA now fully supports 64-bit ODBC. A problem with 64-bit integers has been resolved in this release. Also new in this release is support for the upcoming Zope 2.10. We have successfully tested the mxODBC Zope DA with the latest beta of the upcoming Zope version. ________________________________________________________________________ UPGRADING If you have already bought mxODBC Zope DA 1.0.x licenses, you can use these license for the 1.0.10 version as well. There is no need to buy new licenses. The same is true for evaluation license users. ________________________________________________________________________ MORE INFORMATION For more information on the mxODBC Zope Database Adapter, licensing and download instructions, please visit our web-site: http://zope.egenix.com/ You can buy mxODBC Zope DA licenses online from the eGenix.com shop at: http://shop.egenix.com/ ________________________________________________________________________ Thank you, -- Marc-Andre Lemburg eGenix.com Professional Python Services directly from the Source (#1, Jul 10 2006) >>> Python/Zope Consulting and Support ... http://www.egenix.com/ >>> mxODBC.Zope.Database.Adapter ... http://zope.egenix.com/ >>> mxODBC, mxDateTime, mxTextTools ... http://python.egenix.com/ ________________________________________________________________________ ::: Try mxODBC.Zope.DA for Windows,Linux,Solaris,FreeBSD for free ! ::::

1 0

Security alert: use of Through-the-Web reStructuredText
by Jim Fulton 08 Jul '06

08 Jul '06

Recently, a serious security flaw was found in Zope 2 due to it's improper support for allowing reStructuredText to be edited through- the-web. reStructuredText has directives that allow inclusion of any file a Zope process could read and inclusion of data obtained from fetching arbitrary URLs. In a trusted environment, these directives have legitimate uses. The feature of including files and URL results should not be enabled for text entered from untrusted sources, which applies to most through-the-web interactions. The recent hotfix: http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05 addresses the problem for Zope 2. It is safe to allow reStructuredText through the web with care. The inclusion of files or URL results can be disabled, but the programmer must explicitly disable the feature. It is not disabled by default. It is also critical that a developer who exposes through-the-web reStructuredText have tests to verify that the file/url inclusion feature has been disabled. Zope 3 itself, as released, doesn't have this problem because it doesn't allow reST entry through the web. There are third-party applications, however, including 2 packages in the Zope 3 subversion tree that do have this problem. I strongly urge you to avoid using any Zope package that allows through-the-web input of reStructuredText unless you can verify that file/url has been properly disabled. The zwiki and bugtracker packages do not currently disable file/url inclusion and should not be used in situations in which users who are not highly trusted have access to these applications. If you are using a Zope 3 checkout, these packages are currently included and enabled. I plan to remove these packages from the Zope 3 repository tree within the next few hours. If you are using a checkout-based Zope 3 installation that exposes these packages to untrusted users, you are strongly urged to disable these packages by removing the following files from your package-includes directory: zwiki-configure.zcml bugtracker-configure.zcml Removing these files will also avoid problems when you update your checkout later, as these will refer to non-existent packages. Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

1 0

Serious security problem with Zope 2
by Jim Fulton 05 Jul '06

05 Jul '06

We have recently discovered that there are (still) very serious security problems with the integration of reStructured Text (docutils) into Zope 2. We have prepared a hot fix for this problem: http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/ See: http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/ README.txt for installation instructions. It is important to install this hotfix as soon as possible. This fix will disable the reStructuredText 'raw' directive. Much thanks goes to Tres Seaver for analyzing the problem and developing the hotfix! Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

1 0

linktally 0.1.0: Keep track of your most popular CMS content
by Martijn Pieters 04 Jul '06

04 Jul '06

Pareto is happy to announce the first preview release of linktally, version 0.1.0: http://plone.org/products/linktally What is linktally ----------------- Zope, and most CMS-es in fact, is not optimized to write on every page access. This makes page counters impractical. Add a squid cache and most visits won't even be seen by your CMS. Instead, linktally utilizes your Squid, Apache or Zope log file to periodically tally content accesses, storing these in a sqlite3 database. A separate, CMS-specific tool then provides rankings (by type if need be) for the past week, month and year. This initial release includes a CMF tool to provide rankings by past week, month, or year, for all tracked content or for specific types only. We've deployed this tool in a few Plone sites already. Note that this is an initial preview alpha release, and is still missing some features. In the future it should support more than just Apache Combined format, for example. Plugins for other CMS-es like Silva, CPS or even non-python systems are also on the TODO list. Martijn Pieters

1 0

VPW: early registration deadline
by Brian Quinlan 28 Jun '06

28 Jun '06

What's New? =========== The deadline for early-bird registration for the Vancouver Python Workshop is this Friday, June 30th. Early-bird registration is significantly discounted over normal registration, so register now at: http://www.vanpyz.org/conference/registration.html About the Vancouver Python Workshop =================================== The conference will begin with keynote addresses on August 4st by Guido van Rossum [1] and Jim Hugunin [2]. Further talks (and tutorials for beginners) will take place on August 5th and 6th. Ian Cavén [3] will give the closing address. The Vancouver Python Workshop is a community organized and designed for both the beginner and for the experienced Python programmer with: * tutorials for beginning programmers * advanced lectures for Python experts * case studies of Python in action * after-hours social events * informative keynote speakers More information see: http://www.vanpyz.org/conference/ or contact Brian Quinlan at: brian(a)sweetapp.com Vancouver ========= In addition to the opportunity to learn and socialize with fellow Pythonistas, the Vancouver Python Workshop also gives visitors the opportunity to visit one of the most extraordinary cities in the world [4]. For more information about traveling to Vancouver, see: http://www.vanpyz.org/conference/vancouver.html http://www.tourismvancouver.com http://en.wikipedia.org/wiki/Vancouver Important dates =============== Early registration (discounted): May 22nd to June 30th Normal registration: from July 1st Keynotes: August 4th Conference and tutorial dates: August 5th and 6th [1] Guido van Rossum (Google) is the inventor of Python and has managed its growth and development for more than a decade. Guido was awarded the Free Software Foundation Award in 2002 and Dr.Dobb's 1999 Excellence in Programming Award. Guido works at Google and spends half of his time on Python. [2] Jim Hugunin (Microsoft) is the creator of numerous innovations that take Python into new application domains. Jim's most recent project, IronPython integrates Python into Microsoft's .NET runtime. Jim's previous project, Jython is Python for the Java runtime and was the second production-quality implementation of Python. Before that, Jim's Numeric Python adapted Python to the needs of number crunching applications. Jim works at Microsoft adapting the .NET runtime to the needs of dynamic languages like Python. [3] Ian Cavén is the primary developer of the Lowry Digital Images motion picture restoration system. This Python and Zope-based system has been used to restore over 150 motion pictures. Highlights include Citizen Kane, Sunset Boulevard and both the Indiana Jones and Star Wars trilogies. While Ian was Chief Scientist at Lowry Digital, his rack of computers grew from a few Macintoshes on his desktop to over six hundred Macintosh and Linux servers - at one point earning Lowry the title as the second biggest installation of parallel processing Maintoshes in the world. In 2005, Lowry Digital Images was acquired by DTS (the famous movie audio company) and renamed DTS Digital Images. The motion picture restoration system has been discussed in publications as diverse as IEEE Spectrum, USA Today, the BBC NEWS, the New York Times and Apple.com. Ian has been a Python enthusiast since 1999. [4] http://news.bbc.co.uk/2/hi/business/2299119.stm http://edition.cnn.com/2006/BUSINESS/06/15/btn.cities/index.html Cheers, Brian

1 0

VPW: Talk schedule available
by Brian Quinlan 26 Jun '06

26 Jun '06

What's New? =========== The talk schedule for the Vancouver Python Workshop is now available: http://www.vanpyz.org/conference/talkschedule.html This years line-up might be even stronger than in 2004, so check it out! About the Vancouver Python Workshop =================================== The conference will begin with keynote addresses on August 4st by Guido van Rossum [1] and Jim Hugunin [2]. Further talks (and tutorials for beginners) will take place on August 5th and 6th. Ian Cavén [3] will give the closing address. The Vancouver Python Workshop is a community organized and designed for both the beginner and for the experienced Python programmer with: * tutorials for beginning programmers * advanced lectures for Python experts * case studies of Python in action * after-hours social events * informative keynote speakers * tracks on multimedia, Web development, education and more More information see: http://www.vanpyz.org/conference/ or contact Brian Quinlan at: brian(a)sweetapp.com Vancouver ========= In addition to the opportunity to learn and socialize with fellow Pythonistas, the Vancouver Python Workshop also gives visitors the opportunity to visit one of the most extraordinary cities in the world [4]. For more information about traveling to Vancouver, see: http://www.vanpyz.org/conference/vancouver.html http://www.tourismvancouver.com http://en.wikipedia.org/wiki/Vancouver Important dates =============== Talk proposals accepted: May 15th to June 15th Early registration (discounted): May 22nd to June 30th Normal registration: from July 1st Keynotes: August 4th Conference and tutorial dates: August 5th and 6th [1] Guido van Rossum (Google) is the inventor of Python and has managed its growth and development for more than a decade. Guido was awarded the Free Software Foundation Award in 2002 and Dr.Dobb's 1999 Excellence in Programming Award. Guido works at Google and spends half of his time on Python. [2] Jim Hugunin (Microsoft) is the creator of numerous innovations that take Python into new application domains. Jim's most recent project, IronPython integrates Python into Microsoft's .NET runtime. Jim's previous project, Jython is Python for the Java runtime and was the second production-quality implementation of Python. Before that, Jim's Numeric Python adapted Python to the needs of number crunching applications. Jim works at Microsoft adapting the .NET runtime to the needs of dynamic languages like Python. [3] Ian Cavén is the primary developer of the Lowry Digital Images motion picture restoration system. This Python and Zope-based system has been used to restore over 150 motion pictures. Highlights include Citizen Kane, Sunset Boulevard and both the Indiana Jones and Star Wars trilogies. While Ian was Chief Scientist at Lowry Digital, his rack of computers grew from a few Macintoshes on his desktop to over six hundred Macintosh and Linux servers - at one point earning Lowry the title as the second biggest installation of parallel processing Maintoshes in the world. In 2005, Lowry Digital Images was acquired by DTS (the famous movie audio company) and renamed DTS Digital Images. The motion picture restoration system has been discussed in publications as diverse as IEEE Spectrum, USA Today, the BBC NEWS, the New York Times and Apple.com. Ian has been a Python enthusiast since 1999. [4] http://news.bbc.co.uk/2/hi/business/2299119.stm http://edition.cnn.com/2006/BUSINESS/06/15/btn.cities/index.html Cheers, Brian

1 0