June 2000 - Zope-Dev

My Aquisition Zen fell short...
by Bill Anderson 09 Jun '00

09 Jun '00

OK, been debugging the PTK problem with DTML Documents, as noted in the PTK list. I thought I would jump over here to get some more eyes/suggestions/etc. (Bug 81 in the PTK Tracker IIRC) I have narrowed the problem down tothe following situation: When in a Portal, a DTML Document calling a DTML Method (specifically, standard_html_header) is not finding getPortal. If you either include the guilty calls into the document it works. It also works if you wrap it up like this: <dtml-with "getPortal()"> <dtml-var standard_html_header> </dtml-with getPortal> Of course, as was pointed out, if your standard_html_header needs to do work based upon where you are calling it from, this will not really help you. So, I have concluded that the bug lies in the aquisition machinery, which I have not yet played much with yet. So, any Aquisition Priests want to make suggestions, pose questions, etc.? Note, I have also tried passing in the namespace, but no dice there, either. (On that note, Aquisition might be a good Chat...)

1 0

RE: [Zope-dev] Can't add propertysheets to ZClasses in 2.2
by Brian Lloyd 08 Jun '00

08 Jun '00

FYI - this is fixed in the Very Latest CVS :^) Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com > -----Original Message----- > From: Kevin Dangoor [mailto:kid@kendermedia.com] > Sent: Thursday, June 08, 2000 10:59 AM > To: zope-dev(a)zope.org > Subject: [Zope-dev] Can't add propertysheets to ZClasses in 2.2 > > > I've already submitted this to the collector, but I wanted to > make sure that > I'm not the only one with this problem. Using the CVS Zope, > if I create a > ZClass, I am unable to add a Property Sheet because of an > error (missing > "__len__"). > > I find it hard to believe that I'm the first person to try to > add a ZClass > in 2.2, but I didn't see this in the collector. > > Kevin > http://www.byproducts.com - Humor and Novelties > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) >

1 0

Can't add propertysheets to ZClasses in 2.2
by Kevin Dangoor 08 Jun '00

08 Jun '00

I've already submitted this to the collector, but I wanted to make sure that I'm not the only one with this problem. Using the CVS Zope, if I create a ZClass, I am unable to add a Property Sheet because of an error (missing "__len__"). I find it hard to believe that I'm the first person to try to add a ZClass in 2.2, but I didn't see this in the collector. Kevin http://www.byproducts.com - Humor and Novelties

1 0

RE: [Zope-dev] Request for comments: Directory storage
by Toby Dickenson 08 Jun '00

08 Jun '00

I don't have the two on comparable machines :-( Do you have a standard benchmark for comparing the relative performance FileStorage/DirectoryStorage on reiser fs? > > Mmmmm. I suspect NTs heavier file security checks will prove to be a > > significant disadvantage - benchmarks to follow. > > If you do benchmarks, you should do them comparing > DirectoryStorage/NTFS to DirectoryStorage/reiserfs, because > (at least at > mass object creation) DirectoryStorage is slower than > FileStorage (because > of the open() overhead). > I plan on optimizing the random access on huge number of > objects case. > > -Petru >

2 1

RE: [Zope-dev] Request for comments: Directory storage
by Toby Dickenson 08 Jun '00

08 Jun '00

> The version I sent to the list assumes a '/' directory > separator. I'm > releasing a fixed version (a snapshot of my working code) in > a couple of > seconds. Thats fine on windows too (a backslash is only required on the standard command line, but everywhere else a / is ok too) > I do think it's worth a try, but I doubt NTFS is as good > as ReiserFS > :) Mmmmm. I suspect NTs heavier file security checks will prove to be a significant disadvantage - benchmarks to follow.

2 1

DirectoryStorage 0.03
by Petru Paler 08 Jun '00

08 Jun '00

Note that this version (experimentally) uses a dbm database for storing serials. If you don't have/don't want to use gdbm, replace all occurences of gdbm with dbhash or dumbdbm. I didn't used anydbm because it has some strange problems with my python installation :) (but it will be fixed soon). Changelog: 0.03: - don't die if posix.fsync is not available - base class renamed to DirectoryStorage - added directory (re)creation and locking - added a 'magic' file - last oid file open/close bug - moved serials to an gdbm database 0.02: - converted to using os.path.join 0.01: - initial release -Petru

1 0

possible security flaw? - and, request for a phone conference.
by Jon Franz 08 Jun '00

08 Jun '00

Hello, First off, sorry for the cross-posting of this message to admin and to development. I'm a software developer for a major ISP in the Midwest region of the USA. Recently we began evaluating Zope for use in our web application development, internally and for our clients, and have been quite pleased with the wealth of features and add-ons available*; However, I need two points addressed if possible: 1) We are running Zope 2.1.4 mapped to the root of the apache install on a Linux (mandrake 7.0) box, and have found a rather nasty security - or at least, its what I'll call a nasty problem - because if you don't know about it, it could really bite you in the butt. Basically, if a user with manager privileges to a folder changes their password to be empty, then anyone (from permitted domains) can access the management screen for that folder Without Logging On... Zope assumes that you are the user without the password and treats you as if you have those rights. I found this problem when one day the welcome Zope page (default from install) didn't prompt me for a password when I clicked to enter the management screen. I did not realize what had happened until I went under the 'undo' tab and saw that all of my actions while I was snooping around for the problem were being listed as being done by one of the other developers... I went into the acl_users and fixed their password and everything is back to normal. I've tested this by setting my own password to an empty string, and it lets me log in... From a security standpoint, It should probably prompt for a user name and password, and simply accept a empty field for the password As the password for that user... Anyway, my point is to either inform the community of the bug, if it isn't known, or to find out if it is known and has been fixed in the newest release... If it has not been fixed in the newest release, I will be glad to create and provide a patch... 2) As an experienced web developer, I'm very keen on new technologies that can be reused and make my life easier - thus Zope is a godsend. However, my management is hesitant to start using Zope on a regular basis for our projects - they feel it is unproven and possibly unstable: Now, I realize, and have informed them of the facts, that Digital Creations makes their living off of Zope, and that new businesses are springing up almost everyday that are Zope-centric, and that many contracting/development firms are embracing it whole heartedly... But, my management is still kind of hesitant. Is there anyone among you in the community who would be willing to write about your experience with Zope in the professional development arena, to address their concerns? Even better, Would anyone be willing to participate in a conference call q & A session on Zope's suitability for use in professional web development? I cannot offer money for these, but I can promise my undying gratitude, and, I can promise that any and all add-ons and patches we create for Zope would be released back to the community at large... As a large website app dev firm, our contributions could be significant... Please email me privately if you wish to possibly participate in the phone conference. Thank you for your time and attention! * I have already made two modifications to the Zope source, one dealing with making 'border' a built in property (and used during tag output) of the image object. and another, simple hack to the basic dtml parsing routines that makes your dtml development a little faster by requiring less typing. Both of these will be available under my member area on Zope.org. Hopefully these will be the first of many patches and add-ons I get to contribute.

1 0

Re: [Zope-dev] Recursively adding ZClasses (continued)
by Rik Hoekstra 07 Jun '00

07 Jun '00

-----Original Message----- From: Jason Spisak <444(a)hiretechs.com> To: Rik Hoekstra <rik.hoekstra(a)inghist.nl> Cc: Kevin Dangoor <kid(a)kendermedia.com>; zope-dev(a)zope.org <zope-dev(a)zope.org> Date: woensdag 7 juni 2000 22:26 Subject: Re: [Zope-dev] Recursively adding ZClasses (continued) >Rik Hoekstra writes: > >> Thanks a lot Jason, >> >> I'll try it (though i'd swear I tried something very much alike) It was very much alike, but you were right ;-). The difference was that I did a (sort of cut down pseudocode) <dtml-with "manage_addProduct['ZECF']"> <dtml-in obligatoryitems> <dtml-call "ZECItem_add(_['sequence-item'], REQUEST)"> </dtml-in> </dtml-with> in which case the dtml-in interferes badly with the dtml-with so turning it around to <dtml-in obligatoryitems> <dtml-with "manage_addProduct['ZECF']"> <dtml-call "ZECItem_add(_['sequence-item'], REQUEST)"> </dtml-with> </dtml-in> which works. So is this subtle or what ?! But at least it's consistent >> >> > >> >This currently adds recursive ZClasses for me. All ZClasses are on the top >> >level of the Product, no nesting: >> > >> > <dtml-with "manage_addProduct['ZGL']"> >> > <dtml-with >> >"ComponentClass.createInObjectManager(_.getitem('unique_id', 1), REQUEST)"> >> >> hm, what is the 1 in the getitem argument doing there? Never used that >> before... > >I am using it to render the document, not just get me the code. The >document is a DTMLMethod that renders a Zope install unique id based on the >time. > Ah, yes. No need for that for me > >> >I cut a few things out that didn't have to do with the recursing, but you >> >bet the general picture. >> > >> >> >> Yes I bet it (sorry couldn't resist) >> > >Yeah, like this is the most complex DTML you've ever seen. ;) Hm. You don't want me to send some of the clobbered stuff I put together then. Still, I don't see how to do this in a cleaner way in a Python Method (it will look cleaner, but the voodoo will be about the same unless I'm badly mistaken). Thanks (and Kevin also) for your help in sorting this out. Rik

2 1

Packaging ZODB, ZEO, ...
by Andrew M. Kuchling 07 Jun '00

07 Jun '00

My ZODB article says little about installation, because there's no good answer at this point, beyond installing all of Zope and adding $ZOPE/lib/python to your PYTHONPATH. Next week I'm going off to California for a few days, and will have lots of time to kill, so I'd like to package ZODB separately. Question: how does DC want to do this? If I was following my own heading, I'd use the Distutils to separately package ExtensionClass, ZODB, and anything ZODB depends on. But I'd like to make this packaging official; what would DC like to do? Another point: I understand that packagizing all of Zope is on the TODO list, but it's such a big job that it won't be done any time soon, certainly not for 2.2. ZEO isn't released yet, though, so it can be placed in its final position in an otherwise-empty package. What would that location be, and what would be the package arrangement for Zope? zope.ZEO, zope.ZODB, zope.DocumentTemplate, &c., or something else? I leave on Sunday, so this needs to get this settled before then in order for me to know what to do while away. -- A.M. Kuchling http://starship.python.net/crew/amk/ Imagine a world where nothing is stable. In the West, we have three moving elements -- Air, Fire, Water -- but at least we can depend on the fourth. -- Philip, in Peter Greenaway's _8 1/2 Women_ (1999)

1 0

Re: [Zope-dev] Recursively adding ZClasses (continued)
by Rik Hoekstra 07 Jun '00

07 Jun '00

Thanks a lot Jason, I'll try it (though i'd swear I tried something very much alike) > >This currently adds recursive ZClasses for me. All ZClasses are on the top >level of the Product, no nesting: > > <dtml-with "manage_addProduct['ZGL']"> > <dtml-with >"ComponentClass.createInObjectManager(_.getitem('unique_id', 1), REQUEST)"> hm, what is the 1 in the getitem argument doing there? Never used that before... >I cut a few things out that didn't have to do with the recursing, but you >bet the general picture. > Yes I bet it (sorry couldn't resist) thanks again, and i'll let you know if it works. It would be highly inconsistent if it would work from one product folder (a different from the current one) and not for the other (the current). So I think this deserves some more digging. Rik

2 1