January 2001 - Zope-Dev

Found an fatal error in Zope 2.3.0 :)
by Radek Hnilica 31 Jan '01

31 Jan '01

Hello all, While trying to debianize, compile and install new zope 2.3.0 I found that file z2.py doesn't contain necesary first line. I look to previous version 2.2.4 and there it is. #!/usr/bin/env python The source was taken from zope.org. I'v also look at CVS and there it's missing to. -- Radek Hnilica <Radek_Hnilica at LinuxFan dot COM>

2 1

Indexing/Searching lots of XML-data
by Thomas Weholt 31 Jan '01

31 Jan '01

Hi, I got alot of XML-files I want to publish using Zope. What I need is to be able to upload them into specific folders, index them, let users search their contents and have the result displayed in some form, hopefully using XSLT and getting a nice browser-friendly output. Any clues? Best regards, Thomas Weholt

1 0

Poor programming practice?
by Robin Becker 31 Jan '01

31 Jan '01

I have been trying to make use of the builtin medusa ftp_server classes and after struggling a while came across the strange practice some internal zope developer has of dynamically changing classes at runtime. ie in ZServer.FTPServer I came across from medusa.ftp_server import ftp_channel, ftp_server, recv_channel ....... ....... # Override ftp server receive channel reponse mechanism # XXX hack alert, this should probably be redone in a more OO way. def handle_close (self): .......... self.readable=lambda :0 # don't call close again recv_channel.handle_close=handle_close which makes it virtually impossible to re-use medusa's ftp_server in a reasonable way. The comment says it all. The real problem is that ftp_channel uses a method make_recv_channel which uses a global class recv_channel and the recv_channel class has a particular method which zope wants to override. How ought this kind of situation to be handled more cleanly? -- Robin Becker

2 3

python methods & zope - security hole ?
by Joseph Wayne Norton 31 Jan '01

31 Jan '01

Evan - I believe I have found a situation while using python methods that exposes a security hole. A user that can create python methods can grant the Manager role to himself by simply writing and then calling the manage_users method. This issue might also apply to other scenarios. I created a simple test case to check the behavior ... - create a user without any roles in a acl_users folder (see below) - create a python method such as the one below that grants root access to the user (see below) - create a dtml method that calls the python method .... this method should have view and access content information granted (see below) to the user created in the first step. In my case, I'm simply using the anonymous role ... but it could be another role setup for developers, content editors, etc. - execute the dtml method (see below) I also created a similiar test case for dtml methods and the dtml method behaved as I expected .... preventing the user from obtaining the manage_users role because they do not have the role in the first place. I just want to confirm if this is a known issue or a new issue (or feature or mistake in my zope setup). I'm currently running with zope 2.2.5 and python methods 0-1-7. If this is indeed an issue, it might be worthwhile to simply document this issue on the PythonMethods product page. thanks, - joe n. ############################################################################### # Here is the output of this behavior ... UserName: dummy_non_manager Roles: () Has 'View' ?: 0 Has 'Manage users' ?: 0 user 'dummy_non_manager' roles '['Manager']' user 'dummy_manager' roles '['Manager']' UserName: dummy_non_manager Roles: ('Manager',) Has 'View' ?: 1 Has 'Manage users' ?: 1 ############################################################################### # Here is the python method args: self,REQUEST body: ret = '' users = {'dummy_manager' : ['Manager'],'dummy_non_manager' : ['Manager']} for u in users.keys(): roles = users.get(u) REQUEST.set('name', u) REQUEST.set('roles', roles) self.acl_users.manage_users('Change',REQUEST) ret = ret + ('user \'%s\' roles \'%s\' \n' % (u, roles)) return ret ############################################################################### # Here is the dtml method: <dtml-var standard_html_header> UserName: <dtml-var "REQUEST['AUTHENTICATED_USER'].getUserName()"> Roles: <dtml-var "REQUEST['AUTHENTICATED_USER'].getRoles()"> Has 'View' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('View',REQUEST['AUTHENTICATED_USER'])"> Has 'Manage users' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('Manage users',REQUEST['AUTHENTICATED_USER'])"> <dtml-var "acl_users_roles_python_method(REQUEST)"> UserName: <dtml-var "REQUEST['AUTHENTICATED_USER'].getUserName()"> Roles: <dtml-var "REQUEST['AUTHENTICATED_USER'].getRoles()"> Has 'View' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('View',REQUEST['AUTHENTICATED_USER'])"> Has 'Manage users' ?: <dtml-var "REQUEST['AUTHENTICATED_USER'].has_permission('Manage users',REQUEST['AUTHENTICATED_USER'])"> <dtml-var standard_html_footer> -- -- Joseph Norton norton(a)alum.mit.edu +81-3-3822-6936 2-10-7 Tabata, Kita-ku, Tokyo 114-0014, Japan (〒114-0014 東京都北区田端２丁目10-7)

1 0

Zope Service Won't Start
by Nai A. Tzeo 31 Jan '01

31 Jan '01

Hello, I've encountered a slight problem. My company is running Zope as an NT service and it's been running great for a few months but it stopped working today. I was installing ZmxODBCDA by copying the files from the zip to Zope. After copying the files over, I restarted Zope via NT Service. Keeps throwing start service due to logon failure. I don't know what to do. Rebooted and deleted all the files I was installing and still can't get the server started. Anyone has any suggestion? I'm a total newbie and am at lost. There are going to be a lot of piss off people tomorrow if I don't get this working tonight. TIA, Nai

3 2

2.30 help system authentication problem?
by Ross Lazarus 30 Jan '01

30 Jan '01

I never allow anonymous to have any permissions in my zope root and I have just noticed that I have to grant the view right to anonymous or the help button gives me an authentication error - even when I'm logged in as manager/owner. Is it just me? New 2.30 source install on solaris 2.6 using an old Data.fs (which has been through many upgrades...) I'll put this in the collector if anyone can confirm it please.

2 1

Security hole in CookieCrumbler
by Shane Hathaway 30 Jan '01

30 Jan '01

Hi folks, It turns out that the released versions of the CookieCrumbler product have a terrible security hole. I recommend you uninstall it immediately. I'm not going to be able to deal with the problem fully today, but if you're interested in getting a solution right away you can grab today's PTK from CVS which contains a version of CookieCrumbler without the hole. Thanks to Phil Harris for finding the problem. Shane

1 0

ZPatterns
by Tom Deprez 30 Jan '01

30 Jan '01

Hi, Is there any way to get ZPatterns working even if you don't have a C++ compiler on Win32? Isn't there a working dll version available, somewhere? Thanks, Tom.

3 2

ANN: CoreSessionTracking 0.7
by Chris McDonough 30 Jan '01

30 Jan '01

A new release of the "CoreSessionTracking" product is out. The product allows you to associate state with anonymous visitors between requests. The latest version (0.7) fixes a fairly serious kid-clicking-related bug found by Randall Kern that effects RAM-based ("internal") session data containers. If you need to upgrade from 0.6, all that is required is to untar/ungzip this release on top of the 0.6 release files. Then you must restart. You can find the product at http://www.zope.org/Members/mcdonc/Products/CoreSessionTracking/index_html - C

1 0

LoginManager and Control_Panel - The Never Ending Story
by Itai Tavor 30 Jan '01

30 Jan '01

Hi, I posted several questions about this problem, but got no replies. I thought I'd try again with a bit more information. The problem is accessing Control_Panel from a folder that contains a LoginManager. I tested the same setup using a plain acl_users and found one difference. Zope/ acl_users/ user_1 (Manager) Test1/ acl_users/ (User Folder) user_2 (Manager) cnt1 (owned by user_1, Manager proxy role) cnt2 (owned by user_2, Manager proxy role) Test2/ acl_users/ (LoginManager) user_3 (Manager) cnt1 (owned by user_1, Manager proxy role) cnt2 (owned by user_3, Manager proxy role) cnt1 and cnt2 are DTML Methods containg: <dtml-var Control_Panel fmt=html-quote> Logging in to /Test1/ with user_2, both /Test1/cnt1 and /Test1/cnt2 return the Control_Panel object. Loggin in to /Test2/ with user_3, /Test2/cnt1 return the Control_Panel object. /Test2/cnt2 returns KeyError: Control_Panel. ZDebug reports: Unauthorized: User itai, who is the owner of /OzCoasters/cnt2, is defined in the context of /OzCoasters, which is not an ancestor of /Control_Panel. Hope anyone can understand this... it's confusing the stuffing out of me. But basically, the Manager proxy role allows a method to access Control_Panel regardless of where its owner and the logged in user are defined. But with LoginManager, Control_Panel is only accessible if the owner is defined in a regular User Folder above the LoginManager. Any idea why this is happening? Any suggestions on how to test it? I know it's more likely to be a problem in my implementation of the user-supplied parts of LoginManager than a bug in LM... but my LM works in all other ways, and it doesn't seem to be doing anything wrong. Any help would be, er, helpful (To borrow the words of King Arthur. Hey, a python reference! Do I get points for that?) -- -- Itai Tavor -- "Je sautille, donc je suis." -- itai(a)optusnet.com.au -- - Kermit the Frog -- -- 'Supposing a tree fell down, Pooh, when we were underneath it?' -- -- 'Supposing it didn't,' said Pooh after careful thought. --

1 0