May 2000 - Zope-Dev - Zope lists

RE: [Zope-dev] Zope 2.2.0 alpha 1 released...
by Brian Lloyd 17 May '00

17 May '00

> > This release contains the new changes to the Zope security > > model to protect against the server-side trojan issue: > > > > http://www.zope.org/Members/jim/ZopeSecurity/ServerSideTrojan > > Hmm. Let's say an object is owned by user Joe. I export the > object and > reimport it in a different Zope installation, where Joe > doesn't exist. Who > owns the object? nobody? No - you do :) Importing is the moral equivalent of "creating" the object. Whenever you create, copy, cut & paste or import you will get ownership of the resulting new object. To me, the more hairy issue is what if Joe *does* exist in the different Zope installation, and you *do* want Joe to continue to have ownership? Currently, you must either arrange for Joe to do the import (which will give him ownership directly), or import it and use an external method to assign ownership (which is a pain). One thing we've thought of is that perhaps superuser (and only superuser) could be able to assign ownership through a web interface, which could make this sort of thing a bit easier. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 2

XMLDocument beta release 2
by Chimezie Thomas-Ogbuji 17 May '00

17 May '00

Changes: 1) Changed ClobXMLDocument to XMLDocument 2) moved XMLDocument and XSLTMethod into a seperate product called XMLDocument (easier to install) 3) Refer to Anthony Baxter's patch for Zope 2.2 alpha and CVS version (same?) in ZDOM release docs 4) Added refresh capability (simply added empty refresh.txt) to Product 5) changed docmentation to reflect this Hopefully this should reduce installation complication and as soon as Fourthought releases latest version of 4Xpath, 4Dom, and 4Xslt the installation process will be further simplified. This is another late night release so I appologize for any typos and incorrect links in advance (but bear in mind it IS a beta in guise of an alpha :) ) -- Chimezie Thomas-Ogbuji Junior Consultant Fourthought Inc. (303) 583 9900 ext 104 cogbuji(a)fourthought.com Installing XMLDocument beta --------------------------- This document describes installing XMLDocument beta on Unix. Important Notes XMLDocument requires 4DOM which is installed by the ZDOM installation. Simply installing ZDOM should resolve this dependency XMLDocument requires 4XPath and 4XSLT XMLDocument also requires Bison, Swig, and Flex. The RPMs for these can be downloaded at the corresponding locations Bison (ftp://rpmfind.net/linux/MandrakeCooker/cooker/Mandrake/RPMS/bison-1.28-4mdk…) Swig ftp://rpmfind.net/linux/MandrakeCooker/cooker/Mandrake/RPMS/swig-1.1p5-4mdk… Flex (might already be installed) ftp://rpmfind.net/linux/MandrakeCooker/cooker/Mandrake/RPMS/flex-2.5.4a-11m… Installing If necessary, install all the dependent packages (as well as Zope) Download this files from our FTP server (ftp.fourthought.com) /pub/4Zope/XMLDocument/XMLDocument-beta.tgz /pub/4Zope/XMLDocument/XMLImporter-beta.tgz /pub/4Zope/XMLDocument/4Suite-Base-0.8.0beta1.tar.gz /pub/4Zope/XMLDocument/4XPath-0.9.0beta2.tar.gz /pub/4Zope/XMLDocument/4XSLT-0.9.0beta2.tar.gz Installing XMLDocument and XSLTMethod: decompress XMLDocument-beta.tgz to your Zope directory (It's now a seperate product) Installing XMLImporter: decompress XMLImporter-beta.tgz to an arbitrary directory. make sure (Zope install directory)/lib/python is in your PYTHONPATH * read the python files in test_suite for examples on how to use XMLImporter Installing XPath, and XSlt: Simply untar the appropriate packages and follow the instructions in INSTALL Assuming you've satisfied the dependencies, you should be done! questions? email: consultants(a)fourthought.com XMLDocument beta is a collection of Zope products and python tools that integrate XML into Zope, above and beyond the current XMLDocument product. Like ZDOM, it is the result of a collaborative venture by Digital Creations and Fourthought Inc. XmlDocument This is a Zope product that wraps XML content for use in Zope. In many ways it behaves similarly to the original XMLDocument, except it only creates a single Zope object upon import or creation. XMLImporter This python module allows users to externally import XML content into the Zope database in a 'controlled' manner. The user has full range of control over import parameters. XSLT Method This is a Zope product that wraps an XSLT stylesheet for use in Zope. Like a DTML method, it can be invoked on a ClobXmlDocument instance and return the resulting XSLT transformation. Fourthought provides custom technological solutions based on open technologies. 4Suite is a powerful set of Python tools developed by Fourthought for Web-based applications in areas such as Intranets, E-Commerce and knowledge-management. Elements of 4Suite have been adopted as core XML technologies in Zope and in the Python XML distribution links: Fourthought: http://fourthought.com 4Suite: http://fourthought.com/4Suite/ DOM 2 Spec: http://www.w3.org/TR/2000/CR-DOM-Level-2-20000307/ Zope http://www.zope.org contact: consultants(a)fourthought.com RELEASE NOTES 5/16/2000 Moved ClobXMLDocument and XSLTMethod to seperate products chanted ClobXMLDocument to XMLDocument _______________________ XMLDocument beta supports the import and manipulation of XML files in Zope through the use of XSLT. See (XPath: http://www.w3.org/TR/1999/REC-xpath-19991116, and XSLT: http://www.w3.org/TR/1999/REC-xslt-19991116) XMLImporter is currently used as a python based tool to input XML files as Zope Objects. The mapping functionality and XSLT transform are used to manipulate the incomming XML stream into a set of Zope Objects. The transform is applied to the incoming XML to allow manipulation and compression of the incomming XML. See http://216.164.72.7:7780/Wiki/Members/jim/ZDOM/InitialNotes under the heading optimization. The final set of objects created by XMLImporter is defined by the mapping dictionary where keys are the tagNames to be created, and the values are references to python classes. A current limitation of the system is that Zope must not be running during an import. Clob XML Document is a Zope Object that represents a complete XML document. Interfaces are provided to edit the content of the document, and modify how the document is displayed when viewed. XSLTMethod is a Zope Object that applies an XSLT transform to an object. An XSLTMethod can be accessed as any other method of an object. With the ZDOM pakage installed, the XSLTMethod can be applied to any Object in the Zope application. Special processing is currently restricted to Clob XML Documents. When an XSLTMethod is applied to a Clob XML Document the contents of the document are used as a source, not the object itself. INSTALLATION --------------- Please see INSTALL.txt for Installation and package dependencies TODO ___________ 1. Allow XMLImporter to be called through the HTML interface 2. Allow Exporting of Zope Objects to XML (expand current export functionality) 3. Allow XSLT special processing on other objects (through _getDom interface) 4. Allow external parameters into XSLTMethod 5. Fix minor UI bugs in XSLTMethod (copy, cut, paste) 6. Fix processing error when applying XSLT programatically see: http://216.164.72.7:7780/Wiki/Members/jim/ZDOM/Issue%20with%20__call__%20an…

1 0

Re: [Zope-dev] Re: [zope-xml] XMLDocument beta release
by Anthony Baxter 17 May '00

17 May '00

>>> Chimezie Thomas-Ogbuji wrote > Initially ClobXmlDocument started off as a seperate Product, however > because of the various changes to internal Zope code, an incomplete > grasp of the Product API, and the fact that XMLDocument is intended to > be merged into Zope eventually, it was decided that it would be coded as > internal products. There doesn't seem to be any reason why it has to go there, tho - there's a number of existing "internal" Zope products that go in lib/python/Products. In particular OFS and Products/OFSP are already the dumping ground for all the unloved puppies in the Zope world :) so not putting stuff there is a Good Thing. Making it something that installs into existing directories makes it much harder to install, and makes it much more vulnerable to being broken when Zope is upgraded. > I haven't gone over the code changes, and it may be messy to determine > them, but could you outline the changes you made? It would make it > easier for integration into the next release Okay. I ripped apart ClobXMLDocument and made it derive from DTMLDocument, rather than copy all of DTMLDocument's code. I also fixed the appropriate imports &c to make it work from a directory in Products. As an added advantage it now works with 2.2alpha as well (since the old code that was copied from DTMLDocument didn't work in 2.2) XSLTMethod I've done something similar to - the only piece left to do is the __call__ method - it copies the one from DTMLMethod for now. To make it work under 2.1.6, you'll want to keep your existing __call__ method, but lose the rest. > The final intent is for ClobXMLDocument to evolve to a fully > heirarchical zope/dom tree (upon initial parse) and not just to contain > the parsed XML as text -- much like the current XMLDocument. The > feature set for the beta was for ClobXMLDocument to be a 'wrapper' -- a > parsed object entity, if you will -- of XML content. Eventually, > ClobXMLDocument (or XMLDocument as it will be called) itself will be a > top level DOM node of the XML content. Good. I was wondering :) since the current one seems pretty limited in what it can do from Zope. I'm glad that it's going to be moving to a fuller featured thing. Thanks, Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

RE: Superuser ownership (was "Adding LoginManager at the root")
by Tres Seaver 16 May '00

16 May '00

> -----Original Message----- > From: Phillip J. Eby [mailto:pje@telecommunity.com] > Sent: Tuesday, May 16, 2000 12:58 PM > To: Tres Seaver; Kevin Dangoor > Cc: zope-dev(a)zope.org; Zope-PTK(a)zope.org > Subject: Superuser ownership (was "Adding LoginManager at the root") > > > At 11:25 AM 5/16/00 -0400, Tres Seaver wrote: > > > >Hmm, LoginManager might be able to exploit the "revert to unowned" > >behavior of objects belonging to former users: > > > > * Create a temporary user temporarily; > > > > * Assign it to REQUEST.AUTHENTICATED_USER; > > > > * Construct the DTML Methods; > > > > * Delete the user. > > > >Oops, nope, this still won't work, because then the > superuser won't be > >able to call those DTML Methods to add users (I think). > Maybe leaving > >the "cruft" user in place is sensible, except that (for instance) it > >presents the same kind of problem as the recent piranha mess (default > >passwords). We could pass in the id and password of the new manager > >in the constructor form, I guess. > > > > Maybe I'm missing something, but couldn't all this be solved by having > objects created by the superuser always be owned by "nobody" > with respect > to ownership (not owner-role)? Wouldn't that fix this entire > issue (and > many others we probably haven't thought of yet)? Nope, because objects owned by 'nobody' would be almost useless -- the intersection of nobody's permissions with any other users' is an empty set. ========================================================== Tres Seaver Digital Creations tseaver(a)digicool.com

1 0

current namespace in an object method
by fog＠mixadlive.com 16 May '00

16 May '00

Hi *, little question. Sometimes I need to directly call a method on an object defined in a product (ok, i am talking about Translator again, don't flame me ;) <dtml-call "REQUEST.set('mail_body', translator.localize('body')"> the translator object does its magic and gets the right version of body, but fails if body contains dtml-var commands, because inside the localize function i don't have access to the local namespace ('_'.) At now i pass it as an argument to localize(), but i would like better to have access to _ from the body of the function. what i am missing here? thanx, federico -- Federico Di Gregorio MIXAD LIVE System Programmer fog(a)mixadlive.com Debian GNU/Linux Developer & Italian Press Contact fog(a)debian.org A short story: I want you. I love you. I'll miss you. -- Me

1 0

Re: [zope-xml] XMLDocument beta release
by Anthony Baxter 16 May '00

16 May '00

aside: the updated patch to allow the FT ZDOM to apply against current CVS didn't have paths for the filenames (oops) - I've got a new version up at http://www.zope.org/Members/anthony/patches/4ZDOM-vs-CVS-0512.patch >>> Chimezie Thomas-Ogbuji wrote > This document describes installing XMLDocument beta on Unix. > > XMLDocument requires 4DOM which is installed by the ZDOM installation. > Simply installing ZDOM should resolve this dependency > XMLDocument requires 4XPath and 4XSLT Does it require the newer (beta) versions of 4DOM that are in the 4DOM directory, or can we use the existing (0.8.3) release versions? Hm. It seemed to want to find xml.xslt, which isn't in the current code, so I guess so... :) > Download this files from our FTP server (ftp.fourthought.com) > /pub/4Suite/4Zope/XMLDocument/XMLDocument-beta.tgz > /pub/4Suite/4Zope/XMLDocument/XMLImporter-beta.tgz > /pub/4Suite/4Zope/XMLDocument/4Suite-Base-0.8.0beta1.tar.gz > /pub/4Suite/4Zope/XMLDocument/4XPath-0.9.0beta2.tar.gz > /pub/4Suite/4Zope/XMLDocument/4XSLT-0.9.0beta2.tar.gz note that the path instead appears to be /pub/4Zope/XMLDocument/... > Installing ClobXmLDocument and XSLTMethod: > decompress XMLDocument-beta.tgz to a temporary directory like so: > > cd (some temporary directory) > tar -xzf (location of downloaded file)/XMLDocument-beta.tgz > > run the stage.py script file. By default, it installs XMLDocument > to /usr/local/src/Zope. If you have installed Zope in a different location Hm. This installs stuff in lib/python/OFS and lib/python/Products/OFSP, rather than in a seperate Product - why is that? A small amount of butchery, and I've got something that a) goes into lib/python/Products/FTXMLDocument b) works under the current CVS. I've fixed a lot of XSLTMethod, but not all of ClobXMLDocument (yet). In case someone else wants to work on it (I'm not sure how much time I'll have tonight), the work so far is at: (warningwarning: lightly lightly tested.) http://www.zope.org/Members/anthony/patches/ftxml-beta-cvs-anthony0.tgz A couple of questions about the ClobXMLDocument - it appears to just be a DTMLDocument, with an internal attribute that's the parsed XML as a DOM structure. This parsed DOM isn't exposed to Zope at all, at least as far as the normal ZDOM stuff goes (it looks like XSLTMethod knows how to find it, but that's about it) - would it be an idea to expose this? Would the ZDOM stuff you guys did allow Zope to traverse through this sort of DOM? More questions later, no doubt. thanks, Anthony

2 1

Superuser ownership (was "Adding LoginManager at the root")
by Phillip J. Eby 16 May '00

16 May '00

At 11:25 AM 5/16/00 -0400, Tres Seaver wrote: > >Hmm, LoginManager might be able to exploit the "revert to unowned" >behavior of objects belonging to former users: > > * Create a temporary user temporarily; > > * Assign it to REQUEST.AUTHENTICATED_USER; > > * Construct the DTML Methods; > > * Delete the user. > >Oops, nope, this still won't work, because then the superuser won't be >able to call those DTML Methods to add users (I think). Maybe leaving >the "cruft" user in place is sensible, except that (for instance) it >presents the same kind of problem as the recent piranha mess (default >passwords). We could pass in the id and password of the new manager >in the constructor form, I guess. > Maybe I'm missing something, but couldn't all this be solved by having objects created by the superuser always be owned by "nobody" with respect to ownership (not owner-role)? Wouldn't that fix this entire issue (and many others we probably haven't thought of yet)? (Please move follow-ups to zope-dev)

1 0

Re: [Zope-dev] Using Zope as replacement for BSCW ?
by Gerhard Gonter 16 May '00

16 May '00

Thanks to all replies and suggestions, both on and off the list concerning out attempt to replace BSCW. I guess, we'll just add Zope to our toolbox and maybe we'll move services over sometime. +gg -- Gerhard.Gonter(a)wu-wien.ac.at Fax: +43/1/31336/702 g.gonter(a)ieee.org Zentrum fuer Informatikdienste, Wirtschaftsuniversitaet Wien, Austria

1 0

Turn-off undo.
by Fabio Augusto Mazzarino 16 May '00

16 May '00

Hi folks: I'm having some problems with undo level, due to a poll flood, my Data.fs file have grown from 2MB to 150MB which turns Zope to a turtle (too slow), I already packed Data.fs, but I want to prevent this from happening. So I need to turn off undo, so Data.fs won't grow anymore. Does anybody knows how can I do this? Thanks for your help. mazza.br

2 1

Zope 2.2.0 alpha 1 released...
by Brian Lloyd 16 May '00

16 May '00

Hello all, Zope 2.2.0 alpha 1 has been released - you can download it from the usual place on Zope.org: http://www.zope.org/Products/Zope/2.2.0a1/ *Note that for alpha releases we package only a source release and a win32 binary release since win32 users generally don't have a compiler readily available.* This release contains the new changes to the Zope security model to protect against the server-side trojan issue: http://www.zope.org/Members/jim/ZopeSecurity/ServerSideTrojan It also contains the new help system, a built-in Zope tutorial and many bug fixes. For more information, see the CHANGES.txt file for the release: http://www.zope.org/Products/Zope/2.2.0a1/CHANGES.txt) Note: sites that allow untrusted users to edit DTML or other executable content will need to set object ownership appropriately after applying the new release for the new security rules to protect you. See the document "upgrading to Zope 2.2" for this and other important upgrade information: http://www.zope.org/Products/Zope/2.2.0a1/upgrading_to_220 Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 3