August 2000 - Zope-Dev

RE: [Zope-dev] Re: unit testing framework proposal
by Chris McDonough 15 Aug '00

15 Aug '00

Well, one method of attack is to develop the guts of your Product as a Python-only layer. Do all the "hard stuff" in the Python-only part of your Product. Develop unit tests to go along with this layer. Then, when you're ready to Zope-ify it, wrap a thin Zope layer around it. This works well with "small" products. The ZCatalog seems to have been developed this way. > -----Original Message----- > From: Stefane Fermigier [mailto:sf@fermigier.com] > Sent: Tuesday, August 15, 2000 4:20 PM > To: zope-dev(a)zope.org > Subject: [Zope-dev] Re: unit testing framework proposal > > > > Message: 2 > > From: Chris McDonough <chrism(a)digicool.com> > > To: "'zope-dev(a)zope.org'" <zope-dev(a)zope.org> > > Subject: [Zope-dev] unit testing framework proposal > > Date: Tue, 15 Aug 2000 14:10:14 -0400 > > > > Please see > > > http://dev.zope.org/Wikis/DevSite/Proposals/UnitTestingFramework for a > > propsal for inclusion of a unit testing framework within > Zope. Comments > > appreciated. > > Hi, > > I'm also very tempted to use systematically unit testing when > developing > Zope products, but I don't quite get how to do it, since Zope products > are so integrated within a whole framework. > > S. > > -- > Stéfane Fermigier, Tel: 06 63 04 12 77 (mobile). > <www.portalux.com>: le portail Linux / logiciel libre. > "Amazon: we patent the dot in .com" > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) >

1 0

Re: unit testing framework proposal
by Stefane Fermigier 15 Aug '00

15 Aug '00

> Message: 2 > From: Chris McDonough <chrism(a)digicool.com> > To: "'zope-dev(a)zope.org'" <zope-dev(a)zope.org> > Subject: [Zope-dev] unit testing framework proposal > Date: Tue, 15 Aug 2000 14:10:14 -0400 > > Please see > http://dev.zope.org/Wikis/DevSite/Proposals/UnitTestingFramework for a > propsal for inclusion of a unit testing framework within Zope. Comments > appreciated. Hi, I'm also very tempted to use systematically unit testing when developing Zope products, but I don't quite get how to do it, since Zope products are so integrated within a whole framework. S. -- Stéfane Fermigier, Tel: 06 63 04 12 77 (mobile). <www.portalux.com>: le portail Linux / logiciel libre. "Amazon: we patent the dot in .com"

1 0

ZClass properties and DTML
by Carl Robitaille 15 Aug '00

15 Aug '00

Hi, Here is a small introduction on what I'm trying to acheive. I want to have a simple bilingual News system on my web site, having headlines and text in both languages. At first, I read the ZDG and then some HOW-TOs to learn how to make ZClasses. So I created a new product, and a ZClass inside it. I then added the following properties 1) headline_en [string] 2) headline_fr [string] 3) text_en [text] 4) text_fr [text] Everything works fine, expect when these include DTML instructions. For example: <dtml-in "objectValues(['News Entry'])"> <p><dtml-var text_fr></p> </dtml-in> If one of the objects text_fr properties contains "<dtml-var some_var>: Some more text", then the resulting HTML will contain contain the dtml tag and not the rendered equivalent of "some_var". Is there a way to include DTML tags in properties? If not, what are my other options? Any comment or suggestion is very welcome. Carl

1 0

unit testing framework proposal
by Chris McDonough 15 Aug '00

15 Aug '00

Please see http://dev.zope.org/Wikis/DevSite/Proposals/UnitTestingFramework for a propsal for inclusion of a unit testing framework within Zope. Comments appreciated. Chris McDonough Digital Creations Publishers of Zope - http://www.zope.org

1 0

proposal for better spelling of security assertions
by Brian Lloyd 14 Aug '00

14 Aug '00

Hi all (esp. product authors!)- I've put a proposal for much-improved spelling of security information in Zope (and product) code at: http://dev.zope.org/Wikis/DevSite/Proposals/DeclarativeSecurity This is part of the ongoing push to improve usability (and comprehensibility) and I'd _really_ like to get this on the fast track for the next feature release of Zope. Please review this and make any comments (in the discussion page linked in the proposal) by Wednesday (Aug. 16th) to make sure your voice is heard! Thanks! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

RE: [Zope-dev] zope221b1 - zclass zexp import into clean database error
by Brian Lloyd 14 Aug '00

14 Aug '00

Shane has tracked this down to a mis-bugfix in the beta - the fix will be in the 2.2.1 final. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com > -----Original Message----- > From: Dr. Ross Lazarus [mailto:rossl@med.usyd.edu.au] > Sent: Saturday, August 12, 2000 9:49 PM > To: zope-dev(a)zope.org > Cc: Brian Lloyd > Subject: [Zope-dev] zope221b1 - zclass zexp import into clean database > error > > > More on testing zope221b1 - source tar, redhat 6.2 > I seem to be the only one reporting problems on the list (0-:) - it > really is just me. > Thought I better try again - start with a clean slate > > So, I restarted zope with a new empty Data.fs from the 221b1 source > distribution. > Started as superuser, made a real user with manager/owner rights. > Logged in as the real user, took ownership of the entire heirarchy. > Tried to import a zclass zexp file freshly exported from > 2.2.0 that I've > been happily using with 2.2.0 and previously. > Traceback appears below > > =========================================================== > Zope Error > Zope has encountered an error while publishing this resource. > > Error Type: Permission mapping error > Error Value: Attempted to map a permission to a permission, Add SMP > Blocks, that is not valid. This should never happen. (Waaa). > > > > -------------------------------------------------------------- > ------------------ > > Troubleshooting Suggestions > > The URL may be incorrect. > The parameters passed to this resource may be incorrect. > A resource that this resource relies on may be encountering an error. > For more detailed information about the error, please refer > to the HTML > source for this page. > > If the error persists please contact the site maintainer. > Thank you for > your patience. > > > > > Traceback (innermost last): > File > /usr/local/home/rossl/zope221b1/lib/python/ZPublisher/Publish.py, > line 222, in publish_module > File > /usr/local/home/rossl/zope221b1/lib/python/ZPublisher/Publish.py, > line 187, in publish > File > /usr/local/home/rossl/zope221b1/lib/python/Zope/__init__.py, line > 221, in zpublisher_exception_hook > (Object: Traversable) > File > /usr/local/home/rossl/zope221b1/lib/python/ZPublisher/Publish.py, > line 171, in publish > File > /usr/local/home/rossl/zope221b1/lib/python/ZPublisher/mapply.py, > line 160, in mapply > (Object: manage_importObject) > File > /usr/local/home/rossl/zope221b1/lib/python/ZPublisher/Publish.py, > line 112, in call_object > (Object: manage_importObject) > File > /usr/local/home/rossl/zope221b1/lib/python/OFS/ObjectManager.py, > line 508, in manage_importObject > (Object: Traversable) > File > /usr/local/home/rossl/zope221b1/lib/python/OFS/ObjectManager.py, > line 263, in _setObject > (Object: Traversable) > File > /usr/local/home/rossl/zope221b1/lib/python/OFS/ObjectManager.py, > line 271, in manage_afterAdd > (Object: Traversable) > File /usr/local/home/rossl/zope221b1/lib/python/ZClasses/ZClass.py, > line 422, in manage_afterAdd > (Object: ZBlockStore) > File > /usr/local/home/rossl/zope221b1/lib/python/OFS/ObjectManager.py, > line 271, in manage_afterAdd > (Object: Traversable) > File /usr/local/home/rossl/zope221b1/lib/python/App/Factory.py, line > 144, in manage_afterAdd > (Object: RoleManager) > File > /usr/local/home/rossl/zope221b1/lib/python/AccessControl/Permi > ssionMapping.py, > line 137, in manage_setPermissionMapping > (Object: RoleManager) > (Info: (['', 'Access contents information', 'Add Database > Methods', > 'Add Documents, Files, and Images', 'Add Documents, Images, > and Files', > 'Add External Methods', 'Add Folders', 'Add LDAPAdapter Object', 'Add > MailHost objects', 'Add Survey Creator', 'Add Sybase Database > Connections', 'Add TinyTable', 'Add User Folders', 'Add > Versions', 'Add > Vocabularies', 'Add Z Gadfly Database Connections', 'Add ZCatalogs', > 'Add ZWiki Pages', 'Add Zope Tutorials', 'Browse LDAPAdapter', 'Change > DTML Documents', 'Change DTML Methods', 'Change Database Connections', > 'Change Database Methods', 'Change External Methods', 'Change > Images and > Files', 'Change LDAPAdapter', 'Change TinyTable', 'Change Versions', > 'Change ZWiki Pages', 'Change configuration', 'Change permissions', > 'Change proxy roles', 'Change survey', 'Create class > instances', 'Create > survey', 'Delete objects', 'Edit Factories', 'FTP access', > 'Import/Export objects', 'Join/leave Versions', 'Manage Vocabulary', > 'Manage Z Classes', 'Manage ZCatalog Entries', 'Manage properties', > 'Manage users', 'Open/Close Database Connection', 'Open/Close Database > Connections', 'Query TinyTable Data', 'Query Vocabulary', > 'Save/discard > Version changes', 'Search ZCatalog', 'Submit survey', 'Take > ownership', > 'Test Database Connections', 'Undo changes', 'Use Database Methods', > 'Use Factories', 'Use mailhost services', 'View', 'View > History', 'View > management screens'], 'Add SMP Blocks', 0)) > Permission mapping error: (see above) > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) >

1 0

Re: [Zope-dev] Re: Zope security alert and hotfix product...
by Andrew Wilcox 14 Aug '00

14 Aug '00

>Now - should methods of mutable types be off-limits in the >future? [...] I don't think it would >be acceptable for 'append' to be off-limits in this case, so >the alternative is that the security machinery would somehow >have to be able to distinguish mutables created by the user >from those obtained from the secure environment. That would >probably mean that API code would have to make some sort of >security assertions about mutables they returned. I have another alternative -- Unless I really intend to return an unprotected mutable across subsystems, most often it's a mistake. Even if security isn't an issue, it leads to wonderfully obscure bugs if a customer of my class blithely modifies my return value. (I returned it to you, after all, you thought it was yours now!) If I do want to return a dictionary for you to *read*, I could just as easily code my intention and return a read-only class that implements __getitem__. Since on occasion I might deliberately want to return an unprotected mutable value for a good reason, what would be helpful is if the security system forbid me from returning unprotected mutable values unless I explicitly say I intend to do so. I'd encourage the check to recursively descend through tuples and, if we create a standard read-only dictionary for everyone to use, through read-only dictionaries. Note such a check would be just as helpful for products written using Python Methods, or DTML, as it would be for products written in plain Python. Then the security system doesn't need to keep track of where unprotected mutables came from. Once I've said explicitly that I intend to return an unprotected mutable, I can take care to return a copy that I don't use after I've passed it on to you. Andrew

1 0

Re: Zope security alert and hotfix product...
by Brian Lloyd 14 Aug '00

14 Aug '00

> > The issue involves the fact that the getRoles method of > user objects > > contained in the default UserFolder implementation returns > a mutable > > Python type. Because the mutable object is still > associated with the > > persistent User object, users with the ability to edit DTML could > > arrange to give themselves extra roles for the duration of > a single > > request by mutating the roles list as a part of the request > >processing. > > OK, so I can exploit this with something similar to > user.getRoles().append('A Role That I Dont Have') > > But, why isnt the append method covered by the new > inaccessible-by-default 2.2 security rules? Back when we were considering how much tightening would be considered acceptable in one dose, we ended up not preventing access to methods of mutable python types ([], {}). The main reason that we were aware of a fair number of people using this (including one or two internal things) for legitimate things: <dtml-var "REQUEST.set('some_stuff', [])"> <dtml-in other_stuff> <dtml-call "some_stuff.append(_['sequence-item'])"> </dtml-in> etc. So we made the decision not to break those things. The real problem, of course, is that the Zope APIs (and the APIs of add on products) should not return references to mutable subobjects. If an API method must return a mutable Python type, it should return a copy rather than a direct reference: def myMethod(self): # self.stuff is a dict # dont do this! return self.stuff # do this instead return self.stuff.copy() # or if stuff is a list either do: return self.stuff[:] # or return tuple(self.stuff) Now - should methods of mutable types be off-limits in the future? I'm not sure that the jury is in yet on that. Consider that PythonMethods (that soon will be part of the core) play by basically the same rules as dtml. While it might be pretty easy to argue that the list-juggling in my DTML example above is bad practice, I think most people would expect to be able to do: mylist=[] mylist.append('one') return mylist ...in a PythonMethod and have it work. I don't think it would be acceptable for 'append' to be off-limits in this case, so the alternative is that the security machinery would somehow have to be able to distinguish mutables created by the user from those obtained from the secure environment. That would probably mean that API code would have to make some sort of security assertions about mutables they returned. Exactly how that would work I don't know... Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

ZCatalog brains
by Steve Alexander 14 Aug '00

14 Aug '00

Is there any good reason that the "brains" returned by ZCatalog searches don't have a standard property that reflects the URL of the object they have meta-data from? This would seem to me to be more object-oriented, and would save calls to someCatalog.getpath(data_record_id_) in loops. Am I missing something? -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

2 3

Re: Zope security alert and hotfix product...
by Toby Dickenson 14 Aug '00

14 Aug '00

On Thu, 10 Aug 2000 14:15:29 -0400, Brian Lloyd <Brian(a)digicool.com> wrote: > The issue involves the fact that the getRoles method of user objects > contained in the default UserFolder implementation returns a mutable > Python type. Because the mutable object is still associated with the > persistent User object, users with the ability to edit DTML could > arrange to give themselves extra roles for the duration of a single > request by mutating the roles list as a part of the request >processing. OK, so I can exploit this with something similar to user.getRoles().append('A Role That I Dont Have') But, why isnt the append method covered by the new inaccessible-by-default 2.2 security rules? Toby Dickenson tdickenson(a)geminidataloggers.com

1 0