August 2000 - Zope-Dev

Logs stamped with wrong time
by Steve Alexander 23 Aug '00

23 Aug '00

I've put this in the Collector: http://classic.zope.org:8080/Collector/1550/view -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

1 0

Logs stamped with wrong time
by Steve Alexander 23 Aug '00

23 Aug '00

Zope 2.2 CVS checkout August 21. I'm in the BST timezone, which is GMT+1. All the entries in Z2.log are one hour behind where they should be. 127.0.0.1: - - [23/Aug/2000:15:15:39 +0100] "POST /fmr/mail_test/manage_edit HTTP/1.0" 200 10139 "http://zope.cat-box.net/fmr/mail_test/manage_main" "Mozilla/4.61 [en] (WinNT; I)" I was watching this in the log using "tail -f", and the time was 16:15 BST. I also checked the time on the machine: $ date Wed Aug 23 16:15:42 BST 2000 Something awry in the time formatting in ZServer/medusa/http_server.py Line 260: def log_date_string (self, when): return time.strftime ( '%d/%b/%Y:%H:%M:%S ', time.gmtime(when) ) + tz_for_log This looks wrong -- it is formatting the time for GMT, but adding on a spurious timezone to the end. I guess time.gmtime should become time.localtime. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

1 0

Xron and security
by Steve Alexander 23 Aug '00

23 Aug '00

Hi Loren, > I'd be glad to listen to well considered proposals for how Xron should > handle security. Consider this a "straw man". On installation, Xron creates a user in the root user folder called "XronUser". Xron is resonsible for setting this user's password. Therefore, it is known to both the Xron product, and also to the root user folder. When a Xron method is run, there is a property that indicates whether it is called anonymously, or authenticated as XronUser. The Xron product could change the password of XronUser every day to a new random value. The domains associated with XronUser could be just localhost.localdomain (not sure about this). Or based on whatever the machine's host-name is (probably better). Site administrators can assign local roles to XronUser as necessary. If Phillip Eby's proposed changes to the access file get included in some future version of Zope, XronUser could be included as one of these bootstrap users by simply writing to a file. -- Steve Alexander Software Engineer Cat-Box ltd http://www.cat-box.net

2 2

Bug in careful_getattr()?
by Jeff Hoffman 22 Aug '00

22 Aug '00

Hello, I have been fighting a problem with PythonMethods/ZClasses. I have a ZClass, MyTestClass, which has four methods: method1 (DTML Method) method2 (DTML Method) showMethods (DTML Method) showMethods2 (PythonMethod) showMethods is defined as: <dtml-var standard_html_header> method1 = <dtml-var "_.hasattr(this(), 'method1')"> method2 = <dtml-var "_.hasattr(this(), 'method2')"> nullmethod = <dtml-var "_.hasattr(this(), 'nullmethod')"> <dtml-var standard_html_footer> and showMethods2 is defined: print getattr(self, 'method1') print getattr(self, 'method2') print getattr(self, 'nullmethod') return printed showMethods, when invoked on an instance of my ZClass, returns: method1 = 1 method2 = 1 nullmethod = 0 Bingo. showMethods2, the PythonMethod, results in an AttributeError in DT_Util.py:135. Digging into the Zope source, I see: validate=md.validate # line 135 if validate is None: return v By inserting some print statements, I notice that md is an empty dictionary ([]) when careful_getattr() is called. Therefore, the validate=md.validate line throws an AttributeError. I fixed the "problem", and my code as a result, by changing this to read: try: validate=md.validate except: validate=None if validate is None: return v I have a really strong feeling, though, that I just opened a whole can of worms. Does my change break an intended behavior of Zope? Is it supposed to throw an AttributeError when md does not have a 'validate'? If so, is there a bug in PythonMethods that is causing md to not be initialized properly before the call to careful_getattr()? I am pressed for time on this project, and could really use some insight, here. I am fresh out of ideas, and have hit the limits of my knowledge. Thanks, --Jeff --- Jeff K. Hoffman 704.849.0731 x108 Chief Technology Officer mailto:jeff.hoffman@goingv.com Going Virtual, L.L.C. http://www.goingv.com/

1 0

Extended expression syntax for 'sort' attribute of dtml-in tag (sort-python="...").
by Adam Karpierz 22 Aug '00

22 Aug '00

Very please for discussion and acceptance: http://classic.zope.org:8080/Collector/1542/view Regards -- Adam Karpierz karpierz(a)alpha.pl

1 0

Patch for extended expression syntax of dtml-tag attributes.
by Adam Karpierz 22 Aug '00

22 Aug '00

Very please for discussion and acceptance: http://classic.zope.org:8080/Collector/1541/view Regards -- Adam Karpierz karpierz(a)alpha.pl

1 0

Bugs in new Security Stuff :P (part 3)
by Chris Withers 22 Aug '00

22 Aug '00

Finally... I'm not convinced the new security stuff deals properly with attributes other than simple methods. here's the evidence, again from Squishdot (guess what I've been doing ;-) You remember the Posting class? Well, Posting's objects have a text attribute called 'subject' Unless you have __allow_access_to_unprotected_subobjects__=1, you get the following error after you hit cancel on the authentication dialog box that pops up: (well, I was getting an unauthorized error on subject, now I just get no response from the server, not even an password dialog box :( That's really bad...) Anyway, on to the next example... If you modify Squishfile by adding and: __ac_permissions__=( ('View', ['file_name', 'file_type', 'content_type', 'file_bytes', 'file_kbytes', 'date_created', 'date_modified','icon','index_html'], ('Anonymous', 'Manager')), ) and a: Globals.default__class_init__(Squishfile) at the end, things should work fine, of course they don't. Right now, I'm just getting no response from the server, what I was getting (which was better ;-) is an unauthorized error on 'icon'. icon is defined in Squishfile as follows: icon='misc_/Squishdot/squishfile_img' ...and is protected by the 'View' permission as you can see above. What is going on ?! Chris PS: When do you and do you not mix in RoleManager? What does it do and when is it needed? PPS: If anyone wants to test this for themselves, let me know and I'll check my code into the Squishdot public CVS (on a branch! ;-)

1 1

aq_inContextOf/can anyone explain this zmonitor log?
by Bob Pepin 22 Aug '00

22 Aug '00

Hi, I just experienced some very weird behaviour from aq_inContextOf while I was trying to get Cut and Paste to work (I had to trace to the whole security stuff to do this, and read the C source for the acquisition stuff the figure out what aq_inContextOf does of course... thanks for having such a great, consistent, mature and well-documented design Zope-guys...) oh, btw, Copy & Paste seems to work only for objects that have their User Source at the / level because of the behaviour of inContextOf. well, here's the log: Python 1.5.2 (#5, Aug 10 2000, 15:45:20) [GCC 2.95.2 19991024 (release)] Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam Welcome to <secure_monitor_channel connected 127.0.0.1:2625 at 859f680> >>> import Zope import Zope >>> app=Zope.app() app=Zope.app() >>> iee=app.iee iee=app.iee >>> doc1=app.iee.doc1 doc1=app.iee.doc1 >>> doc1.aq_inContextOf(iee) doc1.aq_inContextOf(iee) 0 >>> doc1.aq_inContextOf(app) doc1.aq_inContextOf(app) 1 >>> doc1.aq_inContextOf(app.iee) doc1.aq_inContextOf(app.iee) 0 >>> iee.doc1.aq_inContextOf(app.iee) iee.doc1.aq_inContextOf(app.iee) 0 >>> iee.doc1.aq_inContextOf(iee) iee.doc1.aq_inContextOf(iee) 1 >>> app.iee.doc1.aq_inContextOf(iee) app.iee.doc1.aq_inContextOf(iee) 0 >>> app.iee.doc1.aq_inContextOf(app.iee) app.iee.doc1.aq_inContextOf(app.iee) 0 >>> doc1.aq_inContextOf(iee) doc1.aq_inContextOf(iee) 0 >>> doc1=iee.doc1 doc1=iee.doc1 >>> doc1.aq_inContextOf(iee) doc1.aq_inContextOf(iee) 1 >>> doc1.aq_inContextOf(app.iee) doc1.aq_inContextOf(app.iee) 0 >>> doc1=app.iee.doc1 doc1=app.iee.doc1 >>> doc1.aq_inContextOf(app.iee) doc1.aq_inContextOf(app.iee)

2 2

Bugs in new Security Stuff :P (part 2)
by Chris Withers 22 Aug '00

22 Aug '00

Okay, next up, if it's a security error, it should throw a security error! :( Squishdot Posting's can have file attachments. class Posting(Persistent, Implicit,RoleManager): ... # protected by 'View' permission def attachment(self): file=self.file return file and (file,) or None ... These are stored as attributes in a totally un-security aware class: class Squishfile(Acquirer,Persistent): def file_name(self): return self._name ... posting_html is a DTML method and, in 2.2, fails is this bit (which used to work! ;-): <dtml-if attachment> <dtml-in attachment> <A HREF="./<dtml-var file_name url_quote>"> <IMG SRC="<dtml-var SCRIPT_NAME >/<dtml-var icon>" HEIGHT="16 WIDTH="16" BORDER="0" ALT="Click to download attachment"></A> <A HREF="./<dtml-var file_name url_quote>"><dtml-var file_name></A> <dtml-var file_kbytes>KB (<dtml-var file_bytes> bytes) </dtml-in attachment> </dtml-if attachment> However, the error is rather strange: Error Type: KeyError Error Value: file_name (traceback in PS) This, believe it or not, is actually a security error, since I can make it go away by mixing RoleManager into Squishfile and adding __allow_access_to_unprotected_subobjects__=1 to the class. Why do I get this, which I presume is due to file_name not being available in the stacked namespaces, rather than a security dialog box? confusedly, Chris PS: The above code works fine in the management interface, without any changes to Squishfile, which was the subejct fo my previous post.

1 1

ZServer logging bug (was: Fighting with ZServer)
by Dieter Maurer 21 Aug '00

21 Aug '00

Dieter Maurer writes: > Since this afternoon, I am fighting with ZServer. > .... > > At home: Zope 2.1.6, Intel Linux 2, Linux Netscape 4.5 > > All images are always shown correctly. > However, there is no log entry in "var/Z2.log" for > about 50 % of the requests that are answered by > a 304 response. It is non-deterministic whether > a log entry is written or not. This is partially analysed: ZServer looses log entries, when its client closes the connection too fast. On my linux machine, ZServer looses all log entries, when it answers requests with code 304 to a local httplib client that immediately deletes the reply after "getreply". ZServer uses a "producers.hooked_producer" for logging. Such a producer calls its hook function when the primary producer runs out of data. The hook function performs the logging. When the client closes its socket immediately, then, probably, not all data of the producer is consumed and the hook function is not called --> no log entry. The problem occurs in Zope 2.1.6 and Zope 2.2.1b1 (CVS 2000-8-19). Apparently, the problem is not restricted to code 304. Requests answered with code 404 (not found) seem to be affected, too. Dieter

1 0