The Zope News for October 1, 2001 by Chris McDonough (chrism@zope.com) (also available online at http://www.zope.org/Documentation/ZWN/ZWN-2001-10-01) Welcome to the Zope News! The top stories this time around include: Zope 2.4.1 final released, Zope's CVS repository opened up to community contribution, Zope security bug found and fixed, Zope wins WebTechniques Web Tools award, OzZope gets going, and Zope.org Member areas need some attention. And now for something completely different... Front Matter This is a two-week-belated release of the Zope News, which means it covers the entire month of September plus a day. I believe I speak for Zope Corporation and the Zope community in extending condolences to the people who lost friends and family in the attacks in New York and at the Pentagon on September 11. These events serve to remind us how small we really are as well as to remind us how large a difference just one person can make. Hopefully we will gather strength from our communities, recover, and welcome better days in due time. Zope Core Software Development and Releases The final Zope 2.4.1 release was put up for download on September 4. It's available from http://www.zope.org/Products/Zope/2.4.1 . The venerable Zope "Collector" bug tracker has been down for several weeks due to a hard disk crash in which most of the issue data was lost. Ken Manheimer has established a new project to get a replacement online tout suite. It's available at http://www.zope.org//Wikis/DevSite/Projects/CollectorReplacement . The Collector is dead! Long live the Collector! Software Development Proposals and Projects Michael Bernstein's SecurityJihad proposal has changed its name to SecurityCleanup due to recent events. It can be seen at http://dev.zope.org/Wikis/DevSite/Proposals/SecurityCleanup Richard Jones' work on a proposal for a "Batteries Included" distribution of Zope for Mac OS X and Windows (http://dev.zope.org/Wikis/DevSite/Proposals/BatteriesIncludedDistribution). has sparked many peoples' interest. A discussion seems ready to ensue on the Zope Packagers' mail list ( http://lists.zope.org/pipermail/zope-packagers/ ). The ComponentArchitecture development project ( http://www.zope.org/Wikis/DevSite/Projects/ComponentArchitecture ) is probably the proposal most likely to have a visible impact on Zope. Many comments have been gathered within its Wiki this month. Two "Enterprise Zope" proposals were released by myself which deal with extending Zope's "forensic" logging capabilities to include data like memory usage and CPU utilization ( http://dev.zope.org/Wikis/DevSite/Proposals/ExtendedForensicLogging ) as well as an additional proposal about "tolerating" memory leaks and Zope "hangs" in production ( http://dev.zope.org/Wikis/DevSite/Proposals/ToleratingHangsAndLeaks ). A proposal for "pluggable" splitter implementations for the ZCatalog was created by Andreas Jung. Having pluggable splitters could make the task of cataloging of non-English text much easier. http://www.zope.org/Wikis/DevSite/Proposals/PluggableSplitters Brian Lloyd is championing a proposal for allowing mappings to be created on a per-Folder basis between content types and file extensions. http://www.zope.org/Wikis/DevSite/Proposals/ObjectTypeAssociationAndDeathToI... Matt Kromer has gotten busy developing a proposal for extending the default Zope user folder to better handle local roles. http://www.zope.org/Wikis/DevSite/Proposals/ExtendedUserFolderForLocalRoles . Security Notices A new security hotfix for Zopes 2.2.0 - 2.4.1 was released on October 1. The issue solved by the hotfix involves the "fmt" attribute of dtml-var tags. Without the hotfix, Zope does not check security access to methods invoked through "fmt". This issue could allow partially trusted users with enough knowledge of Zope to call, in a limited way, methods they would not otherwise be allowed to access. It is recommended that those running the effected versions of Zope apply the hotfix. For more information and to download the fix, visit http://www.zope.org/Products/Zope/Hotfix_2001-09-28/security_alert Documentation Development and Releases Pierre-Julien Grizel and Olivier Deckmyn's book "Zope" (in French, Eyrolles) has been available for some time now (since July it seems), but its had not even the inkling of a mention in the Zope News. Let's fix that: http://zope.editions-eyrolles.com/ . Looks like a good (and long!) one for all you French-speaking Zopers. Nicolas Pettiaux is launching a project to translate the Zope Book into French. He's looking for folks who want to help. He has a Source Forge project set up at http://sourceforge.net/projects/zopedocfr/ Someone has translated the Zope Content Manager's Guide (ancient, I say!) to Italian. http://www.zope.org/Members/ubik-art/wiki/ZCMG-it News Summaries Seb Bacon and John Edwards cry for help doing CMF list summaries: "Jon and I could really do with some help from anyone with any time who's interested in the CMF. It's quite time-consuming, and I think we've only managed one summary in the last 6 weeks. Thing is, I don't think anyone's really got the time, and this is always going to be a problem with this kind of effort." If you've got the time, please give them a hand in summarizing CMF maillist traffic. The Zope-dev maillist summary was also not released this month. Zope Corporation Goings-On After much attention to lawyering, Zope Corporation has opened up the Zope source code CVS repository to external contributions! This is a momentous occasion in Zope development. Until now, checkin privlege to the Zope source code was held solely by members of Zope Corporation. Individuals from an initial seed group were extended the opportunity to have CVS checkin access. Folks who are known to have accepted the invitation are Steve Alexander, Chris Withers, Andy McKay and Stephan Richter. It's likely that ZC will work out the kinks in the external contribution process using the members of this initial seed group. Committers can make checkins to both Zope and the CMF. Information about the process of becoming a contributor is available from http://dev.zope.org/CVS/ContributorFAQ . Guidelines for new committers are available from http://dev.zope.org/CVS/CommitterGuidelines . A more general description of the Zope development process is available from http://www.zope.org/CVS/ZopeDevelopmentProcess . A general description of the same data for CMF is available from http://dev.zope.org/CVS/CMFProcedures . In case you couldn't tell, we're very excited to be allowing direct community contributions to the CVS repository! Tres Seaver is the Zope Track chair of the 10th Annual International Python Conference ( http://www.python10.com/ ), in Washington DC, happening in Frebruary. Sign up for the conference early and meet all the Python and Zope folks! (Be warned that there's a small extra charge not covered by the conference admission to actually view the live Tim Peters, however.) EuroZope Goings-On The http://www.eurozope.org website appears to be misbehaving at the moment, so I'm unable to tell if anything has changed. (Cop out!) Zope Sightings There was a long string of messages on comp.lang.python midmonth that dealt with the "suitability" of Zope for large corporate websites and extranets. A near flamewar ensued over something almost unrelated to Zope, but when that was over, lots of folks praised Zope and some took the opportunity to slight it for various reasons. Search groups.google.com for zope on Sep. 7 - 10. Zope won WebTechniques Magazine's 2001 Web Tools Readers Choice award in the category "Infrastructure", sharing the somewhat bizarre stage with editors' choice Mac OS X and Honorable Mentionee IBM's DB2. http://www.webtechniques.com/wtawards/2001/ Two new sites about Zope have sprouted up this month: Zope Forum ( http://www.zope-forum.org ) and MetaZope ( http://pluggable.metazope.org/metazope ). The former is a PHP site run by EasyNet, and appears to be a site that allows discussion *about* various Zope maillists. The latter is a spiffy-looking CMF site that doesn't have much content yet, but looks great. The venerable ZopeZen weblog site ( http://www.zopezen.org ) run by Andy McKay has had a brain transplant. Whereas before, ZopeZen was run on Squishdot, it is now powered by CMF. It also makes CMF look great. OzZope ( http://www.ozzope.org ) is a new Australian Zope regional advocacy site. Its keepers have this to say about the site: "OzZope.org provides a new site for the emerging Zope community in Australia. Join in the development of a growing community focussed on bring the benefits of Zope to a range of application areas and a collective Zen" There was a meeting of the DC Zope/Python User's Group (ZPugDC) on Sept 26 at which Guido presented new features of Python. I was supposed to bring a projector. I shamefully forgot about the meeting entirely, and 30 - 40 people were forced to cram into a room built for 10 to get a look at Guido's presentation as a result. I heard it went well. Many, many heartfelt apologies to everybody that was crammed in there. I really, really, royally screwed up and I feel awful. :-( More information about ZPug and the Sept 26 meeting is available from http://www.zpug.org Zope.org Meta Matter The Zope.org website had its best month (by volume) since the heady days of March. 5,218,317 hits were recorded to the site in the month of September. Webalizer traffic statistics output for the systems that make up www.zope.org is available at http://ns1.zope.org:82/ . I suspect this may be at least partly the result from being linked from a few high-profile media sites in September. It's rumored that a demo version of the new Zope.org software that's been so widely discussed (http://www.zope.org//Wikis/DevSite/Proposals/CollaborationEnhancement) will be showing up Real Soon Now. NOTE! As a result of the migration to the CMF version of Zope.org, some object types that exist on the current Zope.org will not exist on the new site. Most of the content in Member folders will be migrated to the new Zope.org automatically, but some items (such as DTML methods, XML Documents, and ZTopics) will be intentionally "left behind". If you've made use of a Zope.org Member area, to ensure that all of your data is migrated, you may wish to read Martijn Pieter's pronoucement on the matter and act accordingly: http://lists.zope.org/pipermail/zope/2001-September/100298.html Zope.org Almanac The Zope.org Almanac lists select new or updated content spotted on Zope.org since the last release of the Zope News. Selected News Items Bug-Fix for PackageProduct patch http://www.zope.org/Members/haqa/PatchKit/news-4.1.3 ZUG Switzerland Kick-Off Powhow http://www.zope.org/Members/gregweb/ZUGS_koph ZShrink demonstration/bug tracking site and new release http://www.zope.org/Members/codestackers/ZShrink/zshrink_demo_site zOpen Directory 0.3 released (new product) http://www.zope.org/Members/CodeSyntax/zOpenDirectoryNewsItem ZMySQLDA-2.0.8 Released http://www.zope.org/Members/adustman/News/ZMySQLDA-2.0.8 ZUserFolder 0.8.1 Released http://www.zope.org/Members/tmclaugh/zuserfolder_news_0.8.1 Searchable External Objects (PDF's,MS-Word and more) http://www.zope.org/Members/tmclaugh/ExtDocument_1 Australian Zope UserGroup - first meeting http://www.zope.org/Members/dlutzy/ozzope-meeting01 ZQuest 1.0.0 beta 2 was just released http://www.zope.org/Members/srichter/zdpNews/zQuest1.0.0b2 Wing IDE 1.1b7 + Zope http://www.zope.org/Members/sdeibel/wing-zope-news7 PatchKit bugfix http://www.zope.org/Members/haqa/PatchKit/news-4.1.4 exUserFolder has been updated for 2.4 http://www.zope.org/Members/TheJester/RandomJunk/exUserFolder_0_6_0 World Trade Center Collapse: photos from eGenius http://www.zope.org/Members/egenius/wtc_911 MatLab DA & Method Released http://www.zope.org/Members/srichter/zdpNews/matLabDA0.2.0 Latex Method 0.1.0 released http://www.zope.org/Members/srichter/zdpNews/latexMethod0.1.0 Graph Method 0.1.0 released http://www.zope.org/Members/srichter/zdpNews/graphMethod0.1.0 Membership, CMF and exUserFolder collide. http://www.zope.org/Members/TheJester/RandomJunk/exUserFolder_0_7_0 NIP Launches Personal Zope Hosting Option http://www.zope.org/Members/NIP/PersonalZopeHosting Zope training in Paris, France, Oct. 15-18 http://www.zope.org/Members/sf/zope-train-1 Localizer 0.6.1 released http://www.zope.org/Members/jdavid/news/Localizer061 MetaPublisher 1.2.6 released http://www.zope.org/Members/beehive/MP1dot2dot6.html Selected Updated or New How-Tos Dtml-tree update http://www.zope.org/Members/rscanon/dtml-tree Automatically export folders using cron http://www.zope.org/Members/fritz/howto_export_folders_using_cron Automatically compress Data.fs using cron http://www.zope.org/Members/fritz/howto_compress_datafs_using_cron Protect Manage Access Using RewriteRule http://www.zope.org/Members/march/howtos/ProctectManageAccessUsingRewiteRule Debugging Zope with Wing IDE: Installation and Setup http://www.zope.org/Members/sdeibel/wing-debugging Debugging Zope Products with Wing IDE: A Tutorial http://www.zope.org/Members/sdeibel/wing-detail Setting up Zope as FastCGI under Apache on Debian http://www.zope.org/Members/ajlouie/fastcgidebian Configure Apache Virtual Hosts and Zope using SiteRoot http://www.zope.org/Members/fritz/howto_apache_and_siteroot Only one index_html http://www.zope.org/Members/march/howtos/OnlyOneIndexHtml kernel: table is full (english) http://www.zope.org/Members/pasquall/20010907002 Installing Zope-Perl on Debian http://www.zope.org/Members/ajlouie/zoperl Advanced Production Site Setup with ZEO http://www.zope.org/Members/dshaw/AdvancedSiteSetup Virtual Hosts via Apache (but nearly all content in Zope) http://www.zope.org/Members/mwr/VHosts_With_Zope_Default How-To connect to a WinNT-MSSQLServer from a Linux-Zope http://www.zope.org/Members/zorton/zope_linux_to_mssqlserver Yet Another FastCGI How-To: single-server, no virtual hosting, Zope serves root content http://www.zope.org/Members/zigg/YetAnotherFastCgiHowto Selected New Or Updated Software Products Portail Pour Tous (Portal For All) http://www.zope.org/Members/dgeorgieff/popoto Openflow http://www.zope.org/Members/vds/OpenFlow Photo and Photo Folder http://www.zope.org/Members/rbickers/Photo backup_zope.fcm http://www.zope.org/Members/fritz/backup_zope compress_datafs.fcm http://www.zope.org/Members/fritz/compress_datafs MySQL Database Documentation http://www.zope.org/Members/fquin/MySQLDBDocumentation SQL Blender http://www.zope.org/Members/adustman/Products/SQLBlender Structured Text Document http://www.zope.org/Members/philikon/STXDocument ZClasses to Python Products http://www.zope.org/Members/MikeW/ZtoP DBObjects R2O-mapping framework http://www.zope.org/Members/srichter/Products/DBObjects Znolk SQL Wizard: A Wizard that creates forms for manipulating SQL data http://www.zope.org/Members/zwork/Znolk_SQL_Wizard CMF-friendly Audio object http://www.zope.org/Members/bowerymarc/CMFAudio ReplaceSupport http://www.zope.org/Members/shh/ReplaceSupport ExtFile/ExtImage http://www.zope.org/Members/MacGregor/ExtFile Formulator http://www.zope.org/Members/faassen/Formulator Replicated FileStorage http://www.zope.org/Members/htrd/ReplicatedFileStorage ZShrink http://www.zope.org/Members/codestackers/ZShrink MultiPageForm http://www.zope.org/Members/lemuren/MultiPageForm Zope Cascading StyleSheets http://www.zope.org/Members/haqa/ZStyleSheet My Media Manager http://www.zope.org/Members/gittew/MyMediaManager CMF-based PropertyManager-like objects http://www.zope.org/Members/natsukashi/Products/CMFPropertyCore Psycopg Zope Postgres Database Adapter http://www.zope.org/Members/fog/psycopg CMF-based MailMessage and MailFolder objects http://www.zope.org/Members/natsukashi/Products/CMFMail CMF-based Address Book http://www.zope.org/Members/natsukashi/Products/CMFUsrManOrg ZBabel Translation System http://www.zope.org/Members/TheJester/ZBabel KebasData: grabs data from any URL http://www.zope.org/Members/kedai/KebasData Zope Controller GUI http://www.zope.org/Members/richard/zope_controller GenericUserFolder (GUF) http://www.zope.org/Members/Zen/GenericUserFolder Radius-based User Folder implementation http://www.zope.org/Members/Zen/ZRadius Zope Chat example product http://www.zope.org/Members/jwashin/ZRTChat User Manager http://www.zope.org/Members/Ioan/UserManager Zope Unicode Support http://www.zope.org/Members/htrd/wstring MailHost Bcc HotFix http://www.zope.org/Members/regebro/mailhostbcchotfix Quick & Easy Zope Portal http://www.zope.org/Members/Ioan/QEportal Navigable Folder http://www.zope.org/Members/fquin/NavigableFolder Datagrok Document http://www.zope.org/Members/datagrok/DGDocument ZSwGenerator http://www.zope.org/Members/sherpya/ZSwGenerator Extensible User Folder http://www.zope.org/Members/TheJester/exUserFolder Zope@Zope.org Mail List Summary for Sep 1 - 30 People can't get enough of drinking from the firehose that is the Zope@Zope.org mail list! There've been roughly a bazillion messages posted since August 31, 2001 (the day of the last Zope News). Selected interesting messages and threads include those below. Jan-Frode Myklebust asks about database connection pooling and a lively discussion ensues: http://lists.zope.org/pipermail/zope/2001-September/098905.html Leland Myrick inquires if Zope can and should be used in an inventorying system. Somebody says no!: http://lists.zope.org/pipermail/zope/2001-September/098903.html Mitchell Modell kicks off the seemingly monthly discussion about HTTP basic auth and why some browsers show the rendered version of a page instead of a management screen: http://lists.zope.org/pipermail/zope/2001-September/098916.html Jerome Alet answers Robert Rotterman's question about how to upload a batch of files. Some discussion about alternate mechanisms ensues. http://lists.zope.org/pipermail/zope/2001-September/098919.html Darran Edmundson asks when to opt for a "backend DB" over ZClasses and gets some weaselly (but correct!) answers: http://lists.zope.org/pipermail/zope/2001-September/098944.html Tony McDonald asks about load balancing with ZEO/Apache on Solaris and gets a wealth of information out of Sean Upton and others: http://lists.zope.org/pipermail/zope/2001-September/098948.html Trevor Toenjes asks if there's a way to capture a referring URL that is not subject to fakery and gets a thumbs down. http://lists.zope.org/pipermail/zope/2001-September/098960.html Mitch Pirtle asks how to do distributed development with Zope and gets answers ranging from skins to CVSMixin. http://lists.zope.org/pipermail/zope/2001-September/098963.html Chris Withers asks which is better for Zope, MySQL or PostgreSQL. The unavoidable ensues: http://lists.zope.org/pipermail/zope/2001-September/098966.html alex@quad.com.ar asks how to use ZPT with DreamWeaver and gets the obvious answer first (use file extensions, even though they're unnecessary in Zope): http://lists.zope.org/pipermail/zope/2001-September/098997.html Dan Shafer asks the ever-fun "when does the ZODB run out of steam" question, and I do my best to answer: http://lists.zope.org/pipermail/zope/2001-September/099012.html Vincenzo Di Somma announces his company's OpenFlow workflow engine, and this kicks off (of all things!) a discussion about how sad Zope.org's search feature is: http://lists.zope.org/pipermail/zope/2001-September/099052.html Kevin Lewandowski asks if there is any way to emulate Apache's "deny from" directive using ZServer only and gets some really weird and useful answers (I just would have said no): http://lists.zope.org/pipermail/zope/2001-September/099173.html Trevor Toenjes kicks off a discussion about using click-stream analsys tools with Zope. http://lists.zope.org/pipermail/zope/2001-September/099273.html David Lutz wonders why Netcraft delisted so many Zope sites in September: http://lists.zope.org/pipermail/zope/2001-September/099477.html Kerekes Lajos wonders how he can use ZCatalog with non-English text. Much discussion about the ZCatalog "splitter" follows: http://lists.zope.org/pipermail/zope/2001-September/099646.html Tres Seaver asks for submissions for papers for the 10th annual International Python Conference "Zope Track": http://lists.zope.org/pipermail/zope/2001-September/099705.html Sean Upton talks about scaling media sites after the September 11 disaster causes high hit rates on many folks' servers. http://lists.zope.org/pipermail/zope/2001-September/099810.html Marc Lindahl asks about steering ZServer startup messages to syslog and gets some tips: http://lists.zope.org/pipermail/zope/2001-September/100070.html BwanaZulia imparts his wisdom on the design of Zope sites: http://lists.zope.org/pipermail/zope/2001-September/100110.html End Matter The opinions expressed in Zope News are solely the authors', and not the opinions of Zope Corporation, The Zope Community at-large, or the Spanish Inquisition. If you or your company are doing something interesting with Zope, please submit a blurb to Zope Weekly News for possible inclusion by emailing Chris McDonough ( mailto:chrism@zope.com ). For prior editions of the Zope News, see http://www.zope.org/Documentation/ZWN/ What Is Zope? Zope is an open source web application server that can be used for managing website content, building intranets, and creating portals. For more information, see http://www.zope.org Zope is built using the Python programming language. For Python information, see http://www.python.org -- Chris McDonough Zope Corporation http://www.zope.org http://www.zope.com "Killing hundreds of birds with thousands of stones"