October 2001 - Zope-Dev

product distribution compliance
by Behrens Matt - Grand Rapids 25 Oct '01

25 Oct '01

The TTW Product distribution tab is not compliant with <http://www.zope.org/Wikis/DevSite/Proposals/FinishedProductGuidelines>. Products/..., not lib/python/Products/... is what it should be doing. The attached patch makes it so. Incidentally, where are we supposed to be sending patches? Trawling recent mailing list archives comes up with several conflicting answers. klm@, ColDev, the ML...? -- Matt Behrens <matt.behrens(a)kohler.com> System Analyst, Baker Furniture

1 0

ZCatalog bug, probably BTrees, what Zope version is this fixed in?
by Chris Withers 25 Oct '01

25 Oct '01

Hi, I have a ZCatalog search that returns 213 results. As soon as I add a sort_on and sort_order to the request doing this search, the number of results drops to about 60. This reminds me of some bugs in the BTrees package that I remember being solved in the not too distant past. Can someone please confirm to me what version of Zope I need to use to get these fixes? If it's not in a release yet, _please_ can it make it for 2.4.2. cheers, Chris

1 1

howto: background processes, queued events and ZEO?
by Jay, Dylan 25 Oct '01

25 Oct '01

I have a very computationally expensive task that I need to perform for users of my system. The idea is that when they access the page that needs the results of this process they will be returned a note saying to wait while the calculations are done. The calculation request is queued and eventually picked up by a background process and run. Only one calculation is run at once. My current attempt at implementation is using Xron DTML Methods. However from looking at the code I gather that this will not scale well if I decide to use ZEO (I think every client will have a background dispatcher so the task would be run multiple times). Using ZEO I'd like to nominate one or more servers to be the workhorses and do all the calculations. Anyone tried doing something like this or can suggest the best approach?

2 1

startup security status (say that five times fast... well, ok, it wasn't so tough after all)
by Behrens Matt - Grand Rapids 24 Oct '01

24 Oct '01

I have a patch in hand that addresses MOST of the issues I brought up, but the biggie (tricking root into killing arbitrary processes) is a hard one to solve. I have many options, and I'd like opinions... Right now, the pid file is written out by the user that ZServer drops to after starting. This is bad because if that user is compromised, the pid file can be overwritten, and root can be tricked into killing (an) arbitrary process(es) the next time 'stop' is run. The obvious solution was to move the writing of the file up before the setuid() call. Now, the unprivileged user can't *change* the pid file. However, because the var directory must be writable by the unprivileged user, the unprivileged user can *remove* then *rewrite* the pid file, and we're back where we started. Solutions: 1. Have the stop script check ownership of the pid file to make sure it's still root's baby. This solution seems easiest, but something about it doesn't seem right to me. When something doesn't feel right to me, there's probably a way to fool it... 2. Enforce the sticky bit on the var directory. From Solaris' chmod(2) manpage: If a directory is writable and has S_ISVTX (the sticky bit) set, files within that directory can be removed or renamed only if one or more of the following is true (see unlink(2) and rename(2)): o the user owns the file o the user owns the directory o the file is writable by the user o the user is a privileged user (Privileged user means 'root'.) We only need to enforce the sticky bit if we start as root and are doing the requisite setuid(). My patch already has a test for this. 3. Have the pid file written into another directory that only root can write to. The rest of this should probably be another mail, but I figured I'd cover what my patch also does: 1. No longer defaults to running as 'nobody'. As I've explained, running as 'nobody' and the requisite permission settings that need to go with running as 'nobody' can set your Zope data up for compromise on your local system. If -u is not specified z2.py will SystemExit. 2. Warns you if you decide that you REALLY want to run as 'nobody', either with -u or by being nobody when starting z2. 3. Tells you when and who it actually setuid()s to. 4. Warns you if your umask isn't sufficient to protect your data files (experiment: pack your Data.fs and check its permissions.) All messages in this patch are going through zLOG for cleanliness' sake. -- Matt Behrens <matt.behrens(a)kohler.com> System Analyst, Baker Furniture

2 3

CoreSessionTracking onStart
by Godefroid Chapelle 24 Oct '01

24 Oct '01

Hi, I am trying to use the onStart method of a session data manager.... But I do not get how to give the path so that my method get called... I could not find any information of the real way to use it. Can someone help me ? Thanks -- Godefroid Chapelle BubbleNet sprl rue Victor Horta, 30 1348 Louvain-la-Neuve Belgium Tel + 32 (10) 457490 Mob + 32 (477) 363942 TVA 467 093 008 RC Niv 49849

2 1

Re: [Zope-dev] Versions (still)
by Oliver Bleutgen 24 Oct '01

24 Oct '01

> So there I was in this discussion about Zope versioning (again) and there > were two features requested that seemed perfectly reasonable at the time, > - to have a list of all the objects changed by a version Sorry if this is obvious, but at least neither ZopeFind nor locked_in_version() seem to be mentioned anywhere in zope's (2.3.3) online docu, so I thought I might post it: <dtml-in "ZopeFind(PARENTS[-1],search_sub=1,obj_expr='locked_in_version()')"> <LI>found <dtml-var title_or_id html_quote> in Version <dtml-var locked_in_version> </dtml-in> > - to be able to individually commit or discard changes in a version on a > per > object basis > This is would be extremely useful for those times when you forget to check > out of a version and accidentally lock the root folder (This happens quite > a > bit). Simple I thought, but ugh versions go all the way down to > FileStorage > and got into ZODB stuff I didnt understand. I would have thought having a > little refactoring to give two more methods: getVersionContents and > commitObject would be possible, but Im scratching my head at FileStorage > now. Hehe, I feel with you, looking at how versions work takes one straight to Filestorage.commitVersion and some very low level code. > Before I embark down this path is there an easier way? The question is if this is worth the effort, in the light of the new versioning discussion. The weaknesses of the current implementation of versioning puts some pressure to create something new IMO. cheers, oliver

2 1

BUG or FEATURE?
by Sidnei da Silva 24 Oct '01

24 Oct '01

Today i've got a problem with the dtml-with tag, as follows: I was trying to set a variable, using REQUEST.set inside a dtml-in, inside a dtml-with, but it only works the first time i call REQUEST.set. Subsequent calls do not modify the variable, and do not raise an exception. Not even a simple error. I dont know how it was supposed to work, but i think that if the REQUEST was immutable inside a dtml-with, it should be not allowed to call REQUEST.set inside it. Here goes some example code: <dtml-with REQUEST> ... ... <snip> ... ... <dtml-in some-list> <dtml-if condition> <dtml-call "REQUEST.set('var', sequence-item)"> <== only works first time it gets called and dont raise an error. ... ... </dtml-with> See ya! -- Sidnei da Silva X3ng Consultoria e Desenvolvimento Ltda. sidnei(a)x3ng.com.br

3 4

Re: [Zope-dev] help identifying a structure inside Zope.
by Anthony Baxter 24 Oct '01

24 Oct '01

>>> Chris McDonough wrote > I'd be tempted to suspect the BTrees module setstate code. Yeah? This is something that you'd expect to see with it? Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

help identifying a structure inside Zope.
by Anthony Baxter 24 Oct '01

24 Oct '01

I'm hunting for a very very obscure python-crashing bug on Solaris with Zope2.4 on Python2.1.1. The structure that's getting corrupted looks something like: 299, (300, (301, (302, (303, ( 304, ( 3, "c_o_s" ) ) ) ) ) ) (nested tuples) I'm wondering if anyone can think of somewhere inside Zope that generates this sort of structure? "c_o_s" is a string we use in our code as a property, a database column, and a REQUEST variable. As far as we can tell, it's not something being generated by our code... Thanks, Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

How to report stuff with the collector down?
by Lennart Regebro 24 Oct '01

24 Oct '01

Hi all! I tried to figure out how to report bugs and stuff without the collector, but couldn't find anything. Any official way? Anyway, I found this minor bug in FileStorage.py. If you try to pack a db with a packdate that is earlier than the date of the first object in the database, you get a "Errno 22, Invalid argument" error. This is because read_index bails out already at the first object and returns position 4L. Whe _reduntant_pack then tries to seek(-8) it of course fails. Now, I haven't tried tha absolute latest versions of Zope, but a check in the CVS indicated that the problem is still there. I chenged this part of FileStorage.py (row 1275 in v1.71.2.3): packpos, maxoid, ltid = read_index( file, name, index, vindex, tindex, stop, read_only=1, ) if self._redundant_pack(file, packpos): raise FileStorageError, ( 'The database has already been packed to a later time\n' 'or no changes have been made since the last pack') to this: packpos, maxoid, ltid = read_index( file, name, index, vindex, tindex, stop, read_only=1, ) if packpos == 4L or self._redundant_pack(file, packpos): raise FileStorageError, ( 'The database has already been packed to a later time\n' 'or no changes have been made since the last pack') Note the "if packpos == 4l or" part. This means that you get the message that it's already packed. I have also some other small "improvements" (on MailHost, f ex) that I'd like to submit to the community. Well, *I* think it's an improvement. :-)

8 12