August 2000 - Zope-Dev

.zexp Security Concerns
by Chris Withers 08 Aug '00

08 Aug '00

Hi, A few people have recently been asking about the ability to import .zexp's into the FreeZope accounts NIP offers. This is something we'd like to offer but need to understand the security risks first. IIRC, the reason why import is not available straight 'through the web' is that there are security implications. Could someone run these by me again... cheers, Chris

2 1

Bug in DateTime.py
by Karsten Petersen 08 Aug '00

08 Aug '00

Hi, today I had *very* strange effects with the following code: <dtml-let bla="_.DateTime('2000/08/08')"> <dtml-var bla><br> <dtml-var expr="bla.parts()"><br> <dtml-var expr="bla.strftime('%Y/%m/%d')"><br> </dtml-let> on my system it gave me: 2000/08/08 (2000, 8, 8, 0, 0, 0, 'GMT+2') 2000/08/07 Well - this was not quite what I expected. :) I tracked the problem down to the timezone: When no time is given, the time is initialized with 00:00. So after applying gmtime in the strftime function (DateTime.py line 1379) it got shifted out and - hoppla - we have gone one day back in time. :) When I apply the attached patch, the output gets correct. But there are more usages of gmtime in the file and I don't know right now if that is correct. Perhaps someone who has a deeper insight in date'n'time math than me should have a look at it. Greets, Karsten -- ,-, Student of Computer Science at Chemnitz University of Technology ,-, | | EMail: Karsten(a)kapet.de WWW: http://www.kapet.de/ | | '-' Home: kapet(a)dollerup.csn V72 / 230 Phone: +49-177-82 35 136 '-'

2 1

RE: [Zope-dev] Re: Replaceable Property question
by Brian Lloyd 07 Aug '00

07 Aug '00

> > So, how long before this becomes a project and gets finished? > > 2.2.1 would be great :-)) > > thanke for the great work, > > Chris Note that third-dot releases are bug-fix only. New features go into second-dot releases. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

4 4

Replaceable Property question
by Chris Withers 07 Aug '00

07 Aug '00

I've stuck this in the Proposals Wiki as well so feel free to comment here or there :-) Will there be any access to the method/object that is being overridden from inside the one overriding it? Something like: 'self.__class__.my_method("blah")' ...but also accessible from DTML? Also, will folders have replaceableness for their contents? (so you could, for example, have a root index_html which could not be over-ridden lower down? cheers, Chris

2 6

RE: [Zope-dev] Weird thing happend with "Pack"
by Brian Lloyd 07 Aug '00

07 Aug '00

> Under Control_Panel/Database I pressed the "Pack" button with > "days older > than" set to '0'. Ahh, the Data.fs became about 500k, that's > more like > it. For some odd reason, I decided to enter '3' at "days older than" > and press "Pack". Dunno why. > > After I did that it got ugly. Now it reported that the Data.fs was > about 400k. Hm, I thought, and checked the var/ directory. It was > smaller... strange. I decided to check if the rest of my site was > still ok, but it wasn't. When got into localhost/manage every object > had their titles changed to 'L'. A bit odd. Very inconvinient. :) Erik - This is a known issue with Zope versions < 2.2 (its fixed in 2.2 final). It will bite you if you pack to a given time and then subsequently pack to an earlier time, as in your example. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

RE: [Zope-dev] dual processors??
by Chris McDonough 07 Aug '00

07 Aug '00

Steve, It sounds a little underpowered to me. But you should probably just try it if it's what you've got. There are some Zope benchmarks contributed by BwanaZulia at http://www.zope.org/Members/BwanaZulia/zope_benchmarks/benchmarks.html. BTW, questions like this are probably better posed to the main Zope mailing list (zope(a)zope.org) > -----Original Message----- > From: Steve Nicholson [mailto:Steve.Nicholson@yoursolutions.com] > Sent: Sunday, August 06, 2000 8:33 PM > To: Zope-Dev mailing list > Subject: [Zope-dev] dual processors?? > > > Hi I'm looking at running Linux RH 6.1 and zope on a dual > processor P90 Dell > powerEdge server, 128Mb RAM. Is this a viable proposition > for hosting, I'm > not anticipating millions of hits?? I realise it's not the > fastest thing in > town but for a good price it gives me a RAID drive for reliability. > > Does Zope take advantage of the Dual processors? > What sort of load will it handle, hits etc? > What improvement is there over one processor? > > This box can be upgraded to P166's what would be the improvement? > Is anyone out there running Linux on Dell EX590-2, can I > expect lots of > problems or easy to set-up? > > Pointers to sites with more information would be appreciated. > > I haven't got it yet, so want to find out more before I waste to much > time/energy/money on it. > > Thanks for any help/advice you can offer. > > Steve. > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) >

3 2

Re: Zope Mailing Lists and ZCatalog
by Michel Pelletier 07 Aug '00

07 Aug '00

Andy Dawkins wrote: > > Michel > > In case you are not aware, we at NIP currently host a complete archive of > the Zope mailing lists that are publicly available. Yep. > We are using ZCatalog to index all the messages from the Mailing list > archives. To give you an idea of numbers, the Zope mailing list alone is > over 30,000 messages. > The problem we have is getting that many objects in to the Catalog. If we > load the objects in to the ZODB, then catalog them, the machine either runs > out of memory or, if we lower the sub transactions, It runs out of hard > drive space. This is because you are indexing more content than you have virtual+tmp memory to store the transaction in. Zope is transaction, as I'm sure you know, so it has to store the transaction somewhere so it can roll it back if neccesary, and memory+tmp storage is where that goes (subtransactions are swapped out to tmp). > If we use CatalogAware to catalog the objects as they are imported the > Catalog explodes to stupid sizes because CatalogAware doesn't support Sub > transactions. Subtransactions are a storage thing, and really don't have anything to do with catalogaware, if you have a subtransaction threshold set then subtransactions will be used for any cataloging operation, catalogaware or not. > We could solve these issues by regularly packing the database during the > import, but it isn't a perfect solution. I'm not sure what you mean with these last to paragraphs, it seems like you have two problems: 1) you are mass indexing and running out of memory 2) you are indexing lots of content quickly and your database is growing The answer to 1 is to not mass index and incrimentatly index over time. The answer to 2 is to use a storage that does not store old revisions, like berkeley storage. > Also as messages arrived over time the Catalog would once again explode > dramatically, > Basically we(NIP) would like to know if you(Michel/DC) are planning to > improve ZCatalog/CatalogAware, if you are planning a successor to ZCatalog > or basically any information that could be useful to us regarding the > current development and urgency of ZCatalog/CatalogAware. There isn't anything wrong with the Catalog (for this particular problem), or at least, there isn't anything in the catalog to fix that would solve your problem. We've had customers index well over 50,000 objects; you just have to understand the resource constraints and work with them, for example, don't mass index, use storages that scale to high write environments, etc. > Thanks in advance for your assistance. NP. -Michel

3 2

Server Side Trojan Issue really dead?
by Chris Withers 07 Aug '00

07 Aug '00

Hi, This comes from a chat on #zope and some worries I've had since the server side issue was raised. Unless I'm mistaken, the new security model doesn't solve the issue because ownership isn't changed by editing. Lets take the example of a ZWiki page which executes any DTML in its contents when it is rendered. Jim in a Manager Paul is a Manager DrEvil has the ability to edit ZWiki Pages, but not call the DEE (Delete Everything, Everywhere ;-) Method So, Jim comes along an creates a ZWiki Page describing the new security model. DrEvil comes along, edits the page and plants a <dtml-call "DEE(backup='no')"> in the page. He can't view this page since, as I understand it, code is executed with the lower of the owner and the viewer's permissions. Paul comes along to read the new ZWiki page, and IIUC, inadvertently executes DEE and deletes everything, everywhere, because he is a manager, and Jim (still the owner) is a manager and so DEE executes. Have I missed something? cheers, Chris

5 9

ZPatterns and Discussion objects
by Chris Withers 07 Aug '00

07 Aug '00

Steve Alexander wrote: > I wonder whether ZPatterns could give you the direct references you > wanted in another message? > > Using a Customizer folder, you potentially get two references to an > object's data: the DataSkin-derived object somewhere under the > Customizer folder in the ZODB; and the id in the sheetprovider that > represents the "flesh" inside the dataskin. > > I haven't thought this through very much, and it certainly isn't useful > with ZPatterns as-is. But there could be a usable idea in there > somewhere :-) Dunno, lets find out what everyone else thinks :-) cheers, Chris

1 0

dual processors??
by Steve Nicholson 07 Aug '00

07 Aug '00

Hi I'm looking at running Linux RH 6.1 and zope on a dual processor P90 Dell powerEdge server, 128Mb RAM. Is this a viable proposition for hosting, I'm not anticipating millions of hits?? I realise it's not the fastest thing in town but for a good price it gives me a RAID drive for reliability. Does Zope take advantage of the Dual processors? What sort of load will it handle, hits etc? What improvement is there over one processor? This box can be upgraded to P166's what would be the improvement? Is anyone out there running Linux on Dell EX590-2, can I expect lots of problems or easy to set-up? Pointers to sites with more information would be appreciated. I haven't got it yet, so want to find out more before I waste to much time/energy/money on it. Thanks for any help/advice you can offer. Steve.

1 0