March 2000 - Zope-Dev

Security gap in "Manage users" & "Manage permissions" permissions (IMHO)
by Lalo Martins 31 Mar '00

31 Mar '00

One thing I like about proxy roles is that you can't give a proxy role for a role you don't have. Equally, IMHO when you have the "Change permissions" permission you shouldn't be able to grant permissions you don't have. And if we want completeness, when you have "Manage users" you shouldn't be able to give roles you don't have _except_ if you're Manager (because otherwise it would be impossible to create new roles...) Is there a flaw in my reasoning? (What I'd like to do in practice is create an "Admin" role for a subsite and grant "Manage users" to this role, so that they can create new users and grant the "Admin" and "Narrador" roles for other users. But as it currently stands, if I give them "Manage users" they can grant "Manager" to themselves and do pretty much anything.) []s, |alo +---- -- Hack and Roll ( http://www.hackandroll.org ) News for, uh, whatever it is that we are. http://www.webcom.com/lalo mailto:lalo@hackandroll.org pgp key in the personal page Brazil of Darkness (RPG) --- http://zope.gf.com.br/BroDar

2 1

Subclassing ZObjectManager in ZClasses
by Alexandre Ratti 31 Mar '00

31 Mar '00

[This message was 1st posted 2 weeks ago on the main zope list.] Hello, I've been playing with ZClasses and I ran into an issue with ZObjectManager. Summary: (when creating a folderish ZClass and cascading base classes) if ZObjectManager isn't subclassed at 1st level, objects can be added to the folderish ZClass instances but they don't show in the manage_main object list. [Zope 2.1.4 on Win32, pure ZClasses, no Python around] More details: 1) I first tried this simple setup. It worked fine: ZClass_for_CatalogAware ZClass_for_Renderable ZObjectManager | |_MyTestClass MyTestClass is folderish and works as expected. 2) This setup worked fine too: ZClass_for_CatalogAware ZClass_for_Renderable ZObjectManager | |_MyBaseClass |_MyTestClass1 |_MyTestClass2 I can create a custom base class and use it in several ZClasses. They are folderish and work as expected. 3) Then I tried this setup: ZClass_for_CatalogAware ZClass_for_Renderable | |_MyBaseClass |_ZObjectManager |_MyTestClass Here I first created MyBaseClass, then I subclassed it together with ZObjectManager when creating MyTestClass. MyTestClass looked OK; I created a Content view linked to manage_main; I allowed adding standard object types such as Folder and File. However, when I add objects in an instance of MyTestClass they do not show in the object list (Content view). I *think* they are actually added because I cannot add an additional one with the same ID: I get an "ID already in use" error. When testing further I got the same results when CatalogAware and Renderable were not around. Same results too when subclassing Folder instead. It's not that bad, but I can't create a standard base class, then use it to create a folderish variant. Does anyone understand why? Cheers. Alexandre

1 0

RE: [Zope-dev] [Patch] Optimization for development mode
by Brian Lloyd 31 Mar '00

31 Mar '00

Geez, never mind me - I'm an idiot :) I was running the wrong one (1.5.1). Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com > -----Original Message----- > From: Toby Dickenson [mailto:tdickenson@geminidataloggers.com] > Sent: Friday, March 31, 2000 8:58 AM > To: 'Brian Lloyd' > Cc: 'Patrick Phalen'; zope-dev(a)zope.org > Subject: RE: [Zope-dev] [Patch] Optimization for development mode > > > > Where are you seeing the getmtime() implementation in your > > installation? (what module?) > > os.path is a synonym for the module ntpath > > > Python 1.5.2 (#0, Oct 11 1999, 09:59:20) [MSC 32 bit (Intel)] on win32 > Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam > >>> import os.path > >>> dir(os.path) > ['__builtins__', '__doc__', '__file__', '__name__', > 'abspath', 'basename', > 'comm > onprefix', 'dirname', 'exists', 'expanduser', 'expandvars', > 'getatime', > 'getmtim > e', 'getsize', 'isabs', 'isdir', 'isfile', 'islink', > 'ismount', 'join', > 'normcas > e', 'normpath', 'os', 'split', 'splitdrive', 'splitext', > 'splitunc', 'stat', > 'st > ring', 'varchars', 'walk'] > >>> os.path > <module 'ntpath' from 'd:\python\lib\ntpath.pyc'> > >>> > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) >

1 0

RE: [Zope-dev] [Patch] Optimization for development mode
by Brian Lloyd 31 Mar '00

31 Mar '00

> >FYI guys - it looks like getmtime doesn't exist on windows > >(and possibly other platforms) - think we'll be able to > >get around that by sniffing the stat() structure though. > > Not true! the implementation on windows, in python 1.5.2 is... > > def getmtime(filename): > st = os.stat(filename) > return st[stat.ST_MTIME] Hmm - here's what I get with a stock Py 1.5.2 from python.org for windows: >>> import sys, os >>> dir(os.path) ['__builtins__', '__doc__', '__file__', '__name__', 'basename', 'commonprefix', 'dirname', 'exists', 'expanduser', 'expandvars', 'isabs', 'isdir', 'isfile', 'is link', 'ismount', 'join', 'normcase', 'normpath', 'os', 'samefile', 'sameopenfil e', 'samestat', 'split', 'splitdrive', 'splitext', 'stat', 'string', 'varchars', 'walk'] >>> os.path.getmtime Traceback (innermost last): File "<stdin>", line 1, in ? AttributeError: getmtime >>> Where are you seeing the getmtime() implementation in your installation? (what module?) Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

RE: [Zope-dev] [Patch] Optimization for development mode
by Toby Dickenson 31 Mar '00

31 Mar '00

> Where are you seeing the getmtime() implementation in your > installation? (what module?) os.path is a synonym for the module ntpath Python 1.5.2 (#0, Oct 11 1999, 09:59:20) [MSC 32 bit (Intel)] on win32 Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam >>> import os.path >>> dir(os.path) ['__builtins__', '__doc__', '__file__', '__name__', 'abspath', 'basename', 'comm onprefix', 'dirname', 'exists', 'expanduser', 'expandvars', 'getatime', 'getmtim e', 'getsize', 'isabs', 'isdir', 'isfile', 'islink', 'ismount', 'join', 'normcas e', 'normpath', 'os', 'split', 'splitdrive', 'splitext', 'splitunc', 'stat', 'st ring', 'varchars', 'walk'] >>> os.path <module 'ntpath' from 'd:\python\lib\ntpath.pyc'> >>>

1 0

RE: [Zope-dev] [Patch] Optimization for development mode
by Brian Lloyd 31 Mar '00

31 Mar '00

FYI guys - it looks like getmtime doesn't exist on windows (and possibly other platforms) - think we'll be able to get around that by sniffing the stat() structure though. Thanks for the info! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com > -----Original Message----- > From: Patrick Phalen [mailto:zope@teleo.net] > Sent: Thursday, March 30, 2000 1:59 AM > To: zope-dev(a)zope.org > Subject: Re: [Zope-dev] [Patch] Optimization for development mode > > > Good eye, Shane! It does feel more responsive now. > > [Shane Hathaway, on Wed, 29 Mar 2000] > :: Ever since I started using Zope I thought its management > :: interface was a little sluggish. Today I found out why, and > :: the correction is very easy. If you are running Zope in > :: development mode, especially in Unix, you will notice a > :: healthy improvement in responsiveness. > :: > :: It turns out that because of a small bug, every time a DTML > :: file is read from the file system (including management > :: pages) it is re-parsed whether the file was modified or not. > :: The reason is because the current logic checks not only the > :: file modification date but also the file access date, which > :: changes every time the file is read. > :: > :: Open lib/python/App/special_dtml.py in a text editor. > :: Change one line (probably line 115) from: > :: > :: t=os.stat(self.raw) > :: > :: to: > :: > :: t=os.path.getmtime(self.raw) > :: > :: Restart Zope and enjoy a slightly faster development cycle! > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) >

3 2

Zope-wide config. file
by Andrew M. Kuchling 31 Mar '00

31 Mar '00

Am I right in thinking that Zope doesn't read a configuration file at any point? For example, let's say you wanted to make the format of Zope's log file customizable like Apache's, so you can give it a log format such as "%h %l \"%{User-agent}i\" \"SSL %{HTTPS}x\"". Where would you let the Zope administrator set this? I suggest there should be some global config file read on Zope's startup, and products or Zope subsystems could get at its contents to read parameters of interest. So, for example, the log file example would be configured like: [zLOG] Format = %h %l ... -- A.M. Kuchling http://starship.python.net/crew/amk/ Rainie, mythologies take longer to die than people believe. They linger on in a kind of dream country that affects all of you. -- Death, in SANDMAN #20: "Façade"

2 1

ZServer speed enhancement (I hope)
by Andy Dustman 31 Mar '00

31 Mar '00

I got to poking around inside medusa's guts and said, "Hey, asyncore.poll() is the innermost loop, why not rewrite it in C?" So I did. The result is at: ftp://starship.python.net/pub/crew/adustman/_asyncore-0.0.0.tar.gz Untar it in ZOPEHOME/lib/ZServer, read medusa/README, and run the build.py script. Restart Zope. That oughta do it. This is so alpha, it's double-secret-no-warranty. I've tested it a bit, will be testing it more. It could easily be leaking memory. It seems to work okay. I hope that for heavily loaded sites with many connections that it will produce a noticable performance improvement. But then, you probably shouldn't try this on a heavily-loaded site yet, unless you can tolerate some downtime... If you want to make this a standard piece of Zope (or medusa), that's okay by me, just let me know. -- andy dustman | programmer/analyst | comstar.net, inc. telephone: 770.485.6025 / 706.549.7689 | icq: 32922760 | pgp: 0xc72f3f1d "Therefore, sweet knights, if you may doubt your strength or courage, come no further, for death awaits you all, with nasty, big, pointy teeth!"

1 0

Collector Update
by Tres Seaver 31 Mar '00

31 Mar '00

After a quick review of the Collector, I have modified it such that the details of "normal" bugs/features are immediately visible to anonymous users. We hope that this information will make life simpler for the Zope community, and that we will be able to work toward a steady resolution of the open issues. I also added a checkbox to the submission form for issues which you believe to be security-related. These issues will be tagged with a special status, and not immediately visible to anonymous users. We intend to re-mark such issues as quickly as possible, but would like to have an opportunity to assess them before publicizing them. Thanks to all who feed the Collector's voracious maw! Tres. -- ========================================================= Tres Seaver tseaver(a)digicool.com tseaver(a)palladion.com

2 1

Object persistence problems...
by Brett Carter 31 Mar '00

31 Mar '00

Here's the beef: I've got a product I wrote in python that defines what amounts to a factory function that creates new objects of type 'foo' - let's call it manage_addFoo. The 'foo' class is of course defined in this same product. I've also created another class called fooFolder which simply contains the line: addFoo = manage_addFoo I then inherit this class into a new ZClass I define, simply so I can access the method manage_addFoo without needing the Manager role. However, when I call the addFoo function from dtml, I get an object which dissapears whenever I restart zope -- it appears in the management interface but when I try to access it, it can't be found. Even more interesting is that when I create the exact same object via the management interface, it works fine, and is still there after I restart zope. What gives?

2 1