June 2000 - Zope-Dev

Zope security alert and 2.1.7 update [*important*]
by Brian Lloyd 15 Jun '00

15 Jun '00

Hello all, We have recently become aware of an important security issue that affects all released Zope versions including the recent 2.2 beta 1 release. The issue involves an inadequately protected method in one of the base classes in the DocumentTemplate package that could allow the contents of DTMLDocuments or DTMLMethods to be changed remotely or through DTML code without forcing proper user authorization. A Zope 2.1.7 release has been made that resolves this issue for Zope 2.1.x users. This release is available from Zope.org: http://www.zope.org/Products/Zope/2.1.7/ A patch is also available if it is not feasible to update your Zope installation at this time (the patch is based on 2.1.6): http://www.zope.org/Products/Zope/2.1.7/DT_String.diff If you are evaluating any of the recent 2.2 alpha or beta releases, you should apply the patch noted above if your site is accessible by untrusted clients. A forthcoming 2.2 beta 2 release will contain the fix for this issue. While we know of no instances of this issue being used to exploit a site, we *highly* recommend that any Zope site that is accessible by untrusted clients take the appropriate mitigation steps immediately. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Re: [Zope-dev] Logging for ZScheduler?
by Phillip J. Eby 15 Jun '00

15 Jun '00

At 01:58 PM 6/15/00 +1000, Stuart 'Zen' Bishop wrote: > >Its not a problem with ZScheduler, it a problem that no one has written >a plug-in logging system that is good enough for what you are trying to >do. The existing zLOG API is fine (well - it could be better), but just >needs someone to write the relevant modules. Hmm... I think I'll >add a section to the Interfaces Wiki... Hm... this could work well with Observer->Observable, too. Imagine firing ObservableEvents, and subscribing a "Log" object to them...

4 5

ZScheduler runs on Unix!
by Loren Stafford 15 Jun '00

15 Jun '00

I just got a chance to try out ZScheduler 0.0.5 on Solaris 2.6 and some version of Linux -- and it works. I've changed the CHANGES.txt file to reflect that fact without incrementing the product version number. It should now be safe to try the product out on Unix development systems. It remains, however, alpha software. http://www.zope.org/Members/lstaffor/ZScheduler Let me know how it works for you. -- Thanks -- Loren

1 0

Problem importing Membership alpha
by Bill Anderson 14 Jun '00

14 Jun '00

By any chance is this for Zope 2.2? (Traceback didn't reveal much of anything, FWICS) 8<=============== Zope Error Zope has encountered an error while publishing this resource. Error Type: ImportError Error Value: No module named Owned

3 3

Calling rendered objects from a product
by Carlos Neves 14 Jun '00

14 Jun '00

Hi, In the effort of developing a Cache scheme wich would work for highly dinamic data, and where the called page might be called with an enormous amount of dif query strings, I stumbled with a little problem... I need to call a rendered url, passed the REQUEST and wanted to do it directly to the self var. Not being able to do it, I have come with the solution of calling urllib with URL1, the called object and '?' + the query string... Not that fancy, but it works... slowly but smoothly. I am having a bit of trouble, though, when calling this Cache with 1000 connections and 100 simultaneous. The server times out and commits a silent suicide. It keeps working as far as the start script is concerned, but no longer responds to any requests. I have only the fact that I can call a dtml method with the values above with no trouble at all as a clue, so any pointer will be quite welcome. the cache prod is called CachePool and is available in: http://www.zope.org/Members/neli/CachePool -- Carlos Neves cneves(a)ruido-visual.pt

1 0

Zope, Apache and FastCGI
by Joachim Schmitz 14 Jun '00

14 Jun '00

hi, I try to setup Zope-2.1.4 with apache 3.3.12 and fastcgi 2.2.4. on a redhat 6.1 system. After following the instructions in WEBserver.txt, and in: http://www.zope.org/Members/kedai/apache_zope_fcgi I still can`t connect to Zope. I get the following error in the apache error-log: [Wed Jun 14 09:52:37 2000] [notice] FastCGI: process manager initialized (pid 16174) [Wed Jun 14 09:52:37 2000] [notice] Apache/1.3.12 (Unix) mod_fastcgi/2.2.4 configured -- resuming normal operations [Wed Jun 14 09:53:00 2000] [error] [client 10.2.1.1] (111)Connection refused: FastCGI: failed to connect to server "/usr/local/apache_1.3.12/htdocs/aixzope": connect() failed I tried it with unix-domain socket and the TCP-port. Any hint is welcome. Mit freundlichen Grüßen Joachim Schmitz Email: js(a)aixtraware.de Telefon: +49-2464-8851 FAX: +49-2464-905163

2 2

Folderish Objects and their contained objects
by Stephan Richter 14 Jun '00

14 Jun '00

Hello everyone, I am writing a folderish class (in Python) that gets its objects from a database using SQL. I want to call the object as follows: WEBURL/FolderishClassInstance/ObjectID What needs to be done? The Folderish class should contain something like a getObject class that is automatically called when an ObjectID is passed. The getObject method then executes a SQL statement getting the object from the DB and does an R2O (relational to object) mapping, which is trivial. So what am I asking? Is there such a method already defined, that gets an object from a folderish object? What is its name, so I can redefine it? I found two potential methods called __getitem__ and _getObj in the Zope code. Is it one of them? That let's me ask: How does the URL traversal get objects inside other objects? Right now I am developing that Product for a specific purpose, but I see great potential in generalizing it, so that all types of Zope objects can be saved in a database table. This would be different from the current SQLStorage product though, since it does not save pickle files in the DB, but the actual values with their correct type, which would make it much faster. Regards, Stephan -- Stephan Richter CBU - Physics and Chemistry Web2k - Web Design/Development & Technical Project Management

3 2

EMarket breaks 2.2.0b1
by R. David Murray 14 Jun '00

14 Jun '00

I was trying to test my ZCatalog bug against 2.2.0b1. My test case was, naturally, in the EMarket stuff I've been working on. So I installed EMarket. I then spent a while being puzzled by how the management interface of 2.2.0b1 was behaving (as those on the IRC can attest). I have figured out that EMarket somehow breaks the 2.2.0b1 management interface if you install it. I'm leaving on vacation for a few days, so I won't have time to look in to this until next week. (NB: just in case I checked this with the previous version of EMarket, the one without my additions, and it has the same broken behavior). --RDM

2 3

Client.py bug for ZScheduler
by Loren Stafford 14 Jun '00

14 Jun '00

A bug that affects ZScheduler was reported (with fix) some time ago at... http://classic.zope.org:8080/Collector/1112/view Any chance of getting this resolved before Zope version 2.2 is finalized? -- Thanks -- Loren

1 0

Zope 2.2 beta 1 released
by Brian Lloyd 14 Jun '00

14 Jun '00

Zope 2.2.0 beta 1 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.0b1/ This release contains refinements to the new ownership model as well as better undo management and many bug fixes. For more information, see: http://www.zope.org/Products/Zope/2.2.0b1/CHANGES.txt If you are still using a 2.1.x version of Zope, be sure to see the document http://www.zope.org/Products/Zope/2.2.0b1/upgrading_to_220 for information on the recent changes to the Zope security model and other upgrade information. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 3