July 2000 - Zope-Dev

Ids starting with _
by Chris Withers 01 Aug '00

01 Aug '00

Dieter Maurer wrote: > > I wonder why starting folders with _ is so bad in Zope? > In the time, when everything was allowed what was not explicitely > forbidden, an easy way was necessary to forbid access. Jim > (and, therefore, Zope) used: > > anything starting with "_" is private: no DTML access, no Web access. > > Now, with the change to a security policy "Everything is > forbidden when not explicitely allowed", the need for > such a rule based on naming dwindles. Maybe, it will disappear > sometime in the future. Maybe this is something for dev.zope.org? cheers, Chris

3 4

Strange local(?) bug in uploading files
by Peter Arvidsson 01 Aug '00

01 Aug '00

I have a major problem with uploading files. I am doing a form to upload PDF-files This is what it looks like (with only the relevant code): pdf_form: <form method="POST" action="pdf_method" enctype="multipart/form-data"> Title:<br> <input type="text" size="70" name="titlepdf:required"><br> PDF:<br> <input type="file" size="58" name="pdf:required"><br> <input type="submit" name="add" value="Next"><br> </form> pdf_method: <dtml-call "REQUEST.set('ts', ZopeTime())"> <dtml-call "REQUEST.set('pdfid',_.str(_.int(ts)))"> <dtml-call expr="manage_addFile(pdfid, file=pdf, title=titlepdf)"> When I run this code in 2.1.6 it almost works. The content_type is wrong but if you edit this property and set it to "application/pdf" it works. (This is another strange problem.. this should be set automaticlly. I doesnt work when I pass content_type='application/pdf' either.) However when I try to run this in Zope 2.2 i get the following error (with traceback): Error Type: AttributeError Error Value: seek Traceback (innermost last): File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/ZPublisher/Publish.py, line 187, in publish File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: ElementWithAttributes) File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/ZPublisher/Publish.py, line 171, in publish File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: pdf_method) File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: pdf_method) File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/OFS/DTMLMethod.py, line 167, in __call__ (Object: pdf_method) File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/DocumentTemplate/DT_String.py, line 502, in __call__ (Object: pdf_method) File /usr/local/zope/lib/python/DocumentTemplate/DT_Util.py, line 342, in eval (Object: manage_addFile(pdfid, file=pdf, title=titlepdf)) (Info: pdf) File <string>, line 0, in ? File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/OFS/Image.py, line 125, in manage_addFile (Object: ElementWithAttributes) File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/OFS/Image.py, line 271, in manage_upload (Object: 965062238) File /usr/local/new.test.version.of.zope.DO.NOT.REMOVE/lib/python/OFS/Image.py, line 304, in _read_data (Object: 965062238) AttributeError: (see above) I tried to look in the python-files for manage_addFile but I didnt see anything wrong there (however I am a python newbie :) Why do I get this error in 2.2? I have tried everything and consulted the irc-channel but noone could help me. Is this a bug in 2.2 or am I doing something wrong?

2 1

Re: Collector #1457: DateTime strftime() -- still broken
by Steve Alexander 31 Jul '00

31 Jul '00

support(a)digicool.com wrote: > > Steve Alexander reported: > > > This is a patch to address collector item 1455. > > > > Here's a working patch to make formatting of a DateTime instance work as generally expected, when you use > > > > <dtml-var "_.DateTime()" fmt="%d %H %z"> > > > > or whatever. > > > > It could be made more efficient by compiling the two regular expressions into class attributes. However, a bug in ts_regex stops it using compiled regular expressions in gsub. > > > > See the following URL for a description of the regex bug. > > > > http://lists.zope.org/pipermail/zope-dev/2000-July/006105.html > > > > > > with patch: > > > *** lib/python/DateTime/DateTime.old.py Sun Jul 23 20:03:04 2000 > > --- lib/python/DateTime/DateTime.py Mon Jul 24 14:01:37 2000 > > *************** > > *** 1376,1382 **** > > return millis > > > > def strftime(self, format): > > ! return strftime(format, gmtime(self.timeTime())) > > > > # General formats from previous DateTime > > def Date(self): > > --- 1376,1385 ---- > > return millis > > > > def strftime(self, format): > > ! diff=_tzoffset(self._tz, self._t) > > ! format = ts_regex.gsub('\(^\|[^%]\)%Z', '\\1'+self._tz, format) > > ! format = ts_regex.gsub('\(^\|[^%]\)%z', '\\1%+05d' % (diff/36), format) > > ! return strftime(format, gmtime(self.timeTime()+diff)) > > > > # General formats from previous DateTime > > def Date(self): > > > > Thanks for the report. Per popular demand based on list > feedback, strftime() now formats using the current timezone > representation of the DateTime object (consistent with all > of the other DT formatting methods). > > For those who really needed it to format based on GMT, you > can use the toZone() method to get a copy of the DateTime > object represented in GMT and call the formatting methods > on that object: > > <dtml-var "myDate.toZone('GMT')" fmt="%y, %m, %d"> > > or > > <dtml-var "myDate.toZone('GMT').strftime('%y, %m, %d')"> > > -Brian I just looked at the fix in CVS. I'm sad to report that it is still broken. Here's the patched method from CVS: def strftime(self, format): # Format the date/time using the *current timezone representation*. jfirst = _julianday(self._year, 1, 1) - 1 jtoday = _julianday(self._year, self._month, self._day) julian = jtoday - jfirst time_info=(self._year, self._month, self._day, self._hour, self._minute, self._nearsec, (self._dayoffset + 6) % 7, julian, 0) return strftime(format, time_info) This gets time.strftime to format the time in the DateTime instance, shifted by an appropriate amount. However, if you try and format with %z or %Z to display the timezone information, it always comes out as GMT. So, the implementation has gone from correct but not useful, to generally useful but technically incorrect. To see the problem, apply the patch and try this DTML snippet: <dtml-let time1="_.DateTime('2000/07/23 14:03 BST')"> Time: <dtml-var time1 fmt="%B %d, %Y %H:%M %Z"> <br> Time: <dtml-var "time1.fCommonZ()"> <br> </dtml-let> This prints out the following: Time: July 23, 2000 14:03 GMT Time: July 23, 2000 2:03 pm GMT+1 They are being presented as different times. The first one should read "Time: July 23, 2000 14:03 GMT+1". A solution is to replace the %Z and %z format substrings with correctly calculated values, as in my original patch, included towards the start of this message. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

1 0

Re: ZScheduler and SSL
by Loren Stafford 31 Jul '00

31 Jul '00

Jim, It wouldn't be hard to modify ZScheduler to utilize some SSL-capable client program instead of Client.py. There are just three lines in ZScheduler/Dispatcher.py that deal with the client interface (search for 'client'). You might also have to munge the URL that you feed to the client program (to get https:// instead of http://). (Hmmm. Not even MS Outlook is SSL aware.) What that client program might be, I don't know. But I wouldn't be surprised if to find that you could call MSIE or Navigator or Mozilla with a command-line interface. Does anyone else have any experience with this? If there is a generally available solution to this SSL client problem, I wouldn't mind building it into ZScheduler as an option. At the very least, I could encapsulate the client interface in a separate module. Then you could conveniently replace that module with your own. -- Loren ----- Original Message ----- From: "Jim Sanford" <jsanford(a)atinucleus.com> To: "Loren Stafford" <lstaffor(a)dynalogic.com> Sent: July 31, 2000 07:03 AM Subject: Re: ZScheduler and SSL [was: Zope.org feedback] > Every link is hard coded and is fully qualified so I don't > use absolute_url in any of my code. What Zope does is beyond > my knowledge. > > I access Zope via PCGI behind MS IIS 4.0 and have had no > other problems with SSL. Speed is not a problem because we > have a accelerator card that handles the SSL number > crunching. > > Looks like I will have to figure out a way to handle > scheduled events (primarily executing reports and emailing > them to different list sof people, primarily management > types.) Probably with an external method. > > Jim > > ----- Original Message ----- > From: "Loren Stafford" <lstaffor(a)dynalogic.com> > To: "Jim Sanford" <jsanford(a)atinucleus.com> > Sent: Sunday, July 30, 2000 4:48 PM > Subject: ZScheduler and SSL [was: Zope.org feedback] > > > Have you run into other problems with Zope and SSL? For > example, the > absolute_url method -- does it it always return > http://something or does it > return the same protocol specifier used for the request? > > I ask, because ZScheduler depends on absolute_url. I also > wonder whether the > value of absolute_url will always be correct for ZScheduler > purposes in > virtual-hosting environments. > > -- Loren > > ----- Original Message ----- > From: "Jim Sanford" <jsanford(a)atinucleus.com> > To: "Loren Stafford" <lstaffor(a)dynalogic.com>; "Zope List" > <zope(a)zope.org> > Sent: July 28, 2000 03:39 PM > Subject: Re: Zope.org feedback > > > > We have no http access to our site. > > > > It is a corporate Client Relationship Management, Job > Tracking and Order > Processing, Production and Tracking system that is accessed > > from all over the world. > > > > I will send this to the list to see if any one else can > provide help. > > > > > > ----- Original Message ----- > > From: Loren Stafford <lstaffor(a)dynalogic.com> > > To: Jim Sanford <jsanford(a)atinucleus.com> > > Sent: Friday, July 28, 2000 5:14 PM > > Subject: Re: Zope.org feedback > > > > > > > > > > > URL: http://www.zope.org/Members/lstaffor > > > ZScheduler uses Client.py. > > > > > > Would it be correct to say that if my entire site is > only accessible via > > SSL (https) that ZScheduler will not work? > > > > I hadn't thought about this before, so you probably know > more about it > than > > I do. But given that the python lib that Client.py uses > for http > > (httplib.py) doesn't support https, then you're right. > > > > Solutions? > > > > 1. Permit http traffic to your site if it comes fromt the > same IP and is > for > > URLs that end in "/trigger". I suppose that IP spoofing > makes this > something > > of a security hole. How bad? > > > > 2. Enhance either Client.py or httplib.py to support at > least enough https > > to get the job done. I know nothing about this. Is it > reasonably doable? > Is > > there a Zopista willing and able to do it? > > > > 3. ....? > > > > -- Loren

2 1

Are full pathnames in error messages a security bug?
by R. David Murray 31 Jul '00

31 Jul '00

I don't know if this has been raised before, but the following excerpt from the most recent SANS security alert concensus made me think: ---------- Forwarded message ---------- [...] --> {00.31.014} Apache TomCat leaks system information Apache's TomCat server has been found to provide various types of system information to an attacker-such as full system paths being displayed in error messages. TomCat also comes with the "snoop" servlet, which provides even more detailed information about the system when invoked. ---------------------------------------- Obviously the 'snoop' servlet is the reason this was posted, but still, they are calling full path information a security leak. Not perhaps something to put high on a priority list, but should there be a way to prevent full path information from appearing in error messages? It would have the side benefit of making the error messages more readable <grin>. --RDM

1 0

dtml-var tag suggestion
by Casey Duncan 31 Jul '00

31 Jul '00

I have been using dtml to create dynamic JavaScripts for some forms I am creating. In doing this I came upon the standard problem of inserting strings containing double quotes into a JavaScript such as where title = '"Quoted String"': form.select.options[0].text = "<dtml-var title>"; And you wind up with this rendered: form.select.options[0].text = ""Quoted String""; I know there is the html_quote and sql_quote options to alleviate this problem elsewhere. From what I can figure there is no other quote fixing magic option for the above in the current dtml-var implementation. Perhaps an options could be added to dtml-var in the future to handle this; maybe something like "slash_quote". So that you get this rendered: form.select.options[0].text = "\"Quoted String\""; Just a thought. For now I am just going to convert all double quotes to single quotes automagically. I guess I could modify DT_var.py, but I know it'll get stomped the next time I upgrade my install. I guess I could submit my changed version for inclusion in a future release, how about that?

2 2

Re: zscheduler question
by Loren Stafford 31 Jul '00

31 Jul '00

Klaus, Thank you for being an alpha tester of ZScheduler. Let's carry on these discussions on zope-dev (as long as it's still an alpha product), for the benefit of other alpha testers, and to benefit from the ideas of other developers. From: "Klaus Ahrens" <ahrens(a)informatik.hu-berlin.de> > Loren Stafford wrote: > > > > Here's a simple DTML method that adds a simple ZEvent. You'll have to modify > > it for your subclass and parameters. > > > > <dtml-with "manage_addProduct['ZScheduler']"> > > <dtml-call expr="manage_addOneTimeZEvent( > > this(), > > 'votingEventId1', > > 'Voting Event Title 1', > > file = 'Content-Type: text/plain\n\nBANG!!!', > > executeAt = _.DateTime()+14 > > )"> > > </dtml-with> > > > > -- HTH > > -- Loren > > thank you very much for the quick response! > > some details are not quite clear for me: > > - i see that after calling (for testing purposes: viewing !?) > such a dtml-method creates a new zevent, which when it's due > does the requested action, but after that, the zevent should > vanish ! but how? As ZScheduler is currently designed, ZEvents don't automatically vanish. Past events that have not been rescheduled continue to exist and continue to be catalogued with a "null" time (DateTime(0)). I'll have to think about whether auto-deletion is an essential feature, and how it should be implemented. What do other developers think? What does 'cron' do? To delete ZEvents programmatically, you have to use the manage_delObjects method. It takes a list of object IDs as its argument. In the context of the parent folder of the events: manage_delObjects(['votingEventId1', 'votingEventId2', ...]) If all your ZEvents are in one folder you can make a list of the IDs of 'null' events thus: <dtml-call "REQUEST.set('nullZEvents',[])"> <dtml-in "objectValues(['ZEvent'])"> <dtml-if "executeAt==_.DateTime(0)"> <dtml-call "nullZEvents.append(id())"> </dtml-if> </dtml-in> <dtml-var nullZEvents> You could also use the Schedule (which is a catalog of ZEvents) to find all expired ZEvents. <dtml-in "Schedule( nextEventTime=_.DateTime(1), nextEventTime_usage='range:max' )"> <dtml-with "Schedule.getobject(data_record_id_)"> <dtml-var id> </dtml-with> </dtml-in> You could even make one of these methods a repetitive ZEvent that runs every day (or whatever interval) and removes "null" ZEvents. Would that approach suit your application? Clearly these methods are a little sketchy. You'll have to do a little DTML programming to get them to do what you want in your environment. > moreover: if there are several pending zevents > they must have different id's: so i need some automatic > numbering scheme for multiple zevents and some > ...deleteOneTimeEvent (... ????this()???? ...) -magic > as a side effect of the triggered action. i have no idea how > to do that !? You need to append some kind of "uniquifier" to the id of the ZEvent before you create it. You could create a counter property and increment it each time you use it (not recommended for frequent use). You could use some form of DateTime(). I seem to remember a discussion of this subject on zope-dev. > > - one problem with DateTime which has to do with a > time zone bug (i suppose) is the following: all scheduled > DateTimes go off by one hour, even > > _.DateTime() and > _.DateTime()+0 > > or > > _.DateTime('gmt+1') and > _.DateTime('gmt+1')+0 > > > report different times: > > 2000/07/31 11:16:46.517 GMT+1 (<--- now) > 2000/07/31 10:16:46.5327 GMT+1 > > ! some millis due to the execution seuqence are not > the problem > > i know, that has nothing to do with zscheduler > but do you have any clue ? ZScheduler depends on having a correctly-functioning DateTime module. I've been reading the discussions on zope and zope-dev lists with some consternation, but I think others have analyzed the problem thoroughly. ZScheduler's use of DateTime is very simple and straight-forward. It does not do anything to make it an more or any less vulnerable to DateTime anomalies. I can only advise that you keep "up-to-date" with the latest DateTime discussions (on both zope and zope-dev) and patches. -- HTH -- Loren

1 0

RE: Additional Quoting; Exposing Auxiliary Tag Functions via "_"
by Casey Duncan 31 Jul '00

31 Jul '00

Dieter Maurer writes: > The existing "quote features" name the context for which quoting > is needed. The context determines what needs to be quoted and > how quoting has to be done. > Your proposal does not state the context but only the how. > Otherwise, I would think such an extension would be good. You are right here. I just came up with "slash_quote" off the top of my head. "string_quote" is a good language-neutral name I think that is similar in spirit to the present format options. > Thus, I propose: > 1. new quoting directive "string_quote" quoting Python strings > i.e. ", ' and \ are quoted. > This would work for Javascript (and other languages with > C-like quotation and string literals), too. > 2. all auxiliary functions for DTML tags, especially quoting, > should be available via the namespace. > To avaid namespace pollution, they may go into a separate > module, say 'aux'. > E.g. I would like to use quoting, formatting etc. > inside DTML embedded Python expressions in a form like that: > <dtml-var "... _.aux.fmt(x,'%m/%d/%Y')..."> > and > <dtml-var ".... _.aux.sql_quote(x)..."> This idea has merit, and extends the usefulness of these options to parts of an expression rather than just the whole thing. I think calling the module 'aux' might not be the best for code readability sake though. Perhaps it should just be called fmt or format. Perhaps like so: <dtml-var "... _.fmt.expr(x, '%.2f') ..."> and <dtml-var "... _.fmt.string_quote(x) ..."> newbie format methods could be added too (Feature creep alert!) like: <dtml-var "... _.fmt.currency(x) ..."> in place of the first one.

1 0

Re: [Zope-dev] ZPatterns design question
by Steve Alexander 31 Jul '00

31 Jul '00

"Phillip J. Eby" wrote: > > At 11:09 PM 7/30/00 +0100, Steve Alexander wrote: > >Let's say I have an AddressBook specialist. > > Why? :) > > Seriously, what is the function of "address book" in your application? Is > it to find people in general? Or...? As in your example later, the Addresses specialist is at a different level of abstraction than other specialists. The domain expert tells me that he want to keep particular information about Suppliers: what they supply, and their address details. However, he also wants to store the address details of any other contacts he wishes. He'll sometimes need to search through all of the contacts and suppliers (and in future, anyone that has an address) by phone number or name or address. The domain expert calls the thing that allows him to do the searching (and also browsing) of addresses his "address book", and it reflects a real paper-based artifact. I'm sure I could rename it "Contacts" or "Addresses" without causing too much confusion, though. >From the way I just described it, there is no requirement for the addresses to be stored all in one place. There is a requirement that you can search and browse through all addresses, and return the appropriate object. So, I guess a good way to go is to add an "address" propertysheet to Contact and Supplier, and have triggers that add the address details of both to an Address catalogue. > >---- > >Bunch of questions: > > > >Is this the ZPatterns ideomatic way to do this? > > Dunno. Explain the problem you're trying to solve, and I'll > tell you the simplest way I know to do it. ^^^^^^^^^^^^^^^^ Aha... the missing link :-) > >What kind of propertysheet should I be using? > > Depends on what your application needs. I can see circumstances where the > best place for that sheet could be LDAP, SQL, or the ZODB. I wasn't being very clear there. What kind of propertysheet should I be adding to my DataSkin-derived ZClasses? There are two kinds: "Common instance" and "DataSkin attribute". It looks to me like at present the "DataSkin attribute" flavour will work better with SkinScript. > In which case, I think your > confusion comes from terminology. I would expect to store "Contacts" or > "Entries" in an addressbook, and these would have address sheets, as would > "Suppliers" or whatever else. That makes sense. Suppliers are sored in the Suppliers specialist, and general Contacts are stored in the Contacts specialist. The contacts specialist provides searching appropriate to the domain of addresses and contacts. > Anyway, to answer your question - I think that your getItem() for an > address specialist wants to return some object with an address sheet. But > not an address object. Contact, Entry, Supplier, TennisBuddy... whatever > the heck kind of object it is. This is starting to make much more sense. Many thanks. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

1 0

ZPatterns design question
by Steve Alexander 31 Jul '00

31 Jul '00

Let's say I have an AddressBook specialist. It stores Address records as DataSkin-derived ZClass instances (meta_type Address). The AddressBook has various methods to list the addresses, search the addresses, enter new addresses. The Address ZClass has a single propertysheet: address. When I add a new Address, a Trigger causes the AddressBook's catalog to catalog the new address. When I delete an address, it gets removed from the catalog. Let's say I want to combine my AddressBook with a Suppliers specialist. The Suppliers specialist knows about DataSkin-ZClasses called Supplier. A Supplier has its own propertysheet "supplies" that has information about the kind of goods and services supplied. A Supplier also has an address. Suppliers appear in the AddressBook. When I get a Supplier from the Suppliers specialist, I want it to have two propertysheets: supplies and address. ---- Implementation: When I create a new Supplier, I also create a new Address in the AddressBook that has the same key (read "id") as the new Supplier. The Suppliers specialist has some sort of SheetProvider that either asks the AddressBook for the "address" sheet for a particular key, or (not so good) delegates directly to the Rack where the Address objects are stored. ---- Bunch of questions: Is this the ZPatterns ideomatic way to do this? Can I use SkinScript to get propertysheets from another specialist? Is the SheetProvider that gets the address for the Supplier objects also responsible for adding and deleting Address objects? Do I need an Address object for each Supplier object? What kind of propertysheet should I be using? Should the method in the AddressBook specialist be returning an Address object, or just an address propertysheet? Or, more generally: Adding sheets to a "party" seems to be one of the important ZPatterns ideas. What is the best way of implementing it, using the simple case of two specialists as an example? Thanks. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

2 1