February 2001 - Zope-Dev

Re: [Zope-dev] Greedy except clauses
by Anthony Baxter 09 Feb '01

09 Feb '01

> > Is it the sort of thing where it's just work putting a list of all of > > them (line numbers, &c) up on a web page, maybe crosslinked into cvsweb? > > Then people can go and pick them off, one at a time. ok dokey - so, is DC still running a source view web system? If so, you could easily enough run a daily job like: find . -name '*.py' -print | xargs grep -n 'except:' | cut -d: -f1,2 to get the list of them from the source, and put the root of a viewcvs URL on it. Hm, viewcvs doesn't really cut it for this, but lxr would... whatcha think?

1 0

RE: Re: [Zope-dev] ZSQL using LIKE operator
by Jon Franz 09 Feb '01

09 Feb '01

Usually tag-syntax/usage is discussed more on the basic Zope list, but to be honest, I've always found the distinctions between the two blurred: people who use Zope sometimes post on dev, people who develop products and/or patches sometimes post on Zope-general, and people are developing _On_ Zope seem to choose one via the close-my-eyes-and- point technique. Also, occasionally a random monkey will Spam one or both lists, resulting not only in complaints and searches for a collar/muzzle for the monkey, but the hiding of all bananas in site. What is worse, though, is when a monkey brings up a licensing issue/argument/troll on either list - this usually results in the sad shaking of heads by all other monkeys viewing the dispute for the umpteenth time, and a lot of worthless Spam filling the list as monkeys who should be doing something useful (coding, bug-finding, and grooming their friends for fleas) waste effort by arguing the same old arguments first heard in 3E10 BC when Grog couldn't decide whether to share Fire with Bant and the rest of the tribe, keep it to himself quietly, or patent it and one-click shopping. (He decided inventing the patent office would take too long...) Anyway, enough silly humor - I don't think your posts are off-topic, especially since the issues raised do end up revealing a deficiency (in my opinion!) in ZSQLMethods - the legality of unsafe <dtml-var> tags. > -----Original Message----- > From: Schmidt, Allen J. [mailto:aschmidt@nv.cc.va.us] > Sent: Friday, February 09, 2001 10:33 AM > To: 'Jon Franz' > Cc: 'zope-dev(a)zope.org' > Subject: RE: Re: [Zope-dev] ZSQL using LIKE operator > > > Not taken as being harsh from where I stand! The more we > know...the better! > Thanks for the guidelines and the URL. It has been passed on > to the group > that handles the MySQL on our server. Have not started using it for > Production, but will be soon. > > From a recent post, I noticed that this topic might be better > suited for the > normal Zope list. Would this be accurate? Comments welcome on accepted > topics. > > Thanks > > Allen > <<SNIP Discussion of safe SQL and the <dtml-sqlvar> and <dtml-sqltest> tags >>

1 0

RE: Re: [Zope-dev] ZSQL using LIKE operator
by Schmidt, Allen J. 09 Feb '01

09 Feb '01

Not taken as being harsh from where I stand! The more we know...the better! Thanks for the guidelines and the URL. It has been passed on to the group that handles the MySQL on our server. Have not started using it for Production, but will be soon. >From a recent post, I noticed that this topic might be better suited for the normal Zope list. Would this be accurate? Comments welcome on accepted topics. Thanks Allen -----Original Message----- From: Jon Franz [mailto:jfranz@one.net] Sent: Friday, February 09, 2001 10:18 AM To: 'Schmidt, Allen J.' Cc: 'zope-dev(a)zope.org' Subject: RE: Re: [Zope-dev] ZSQL using LIKE operator sqltest just creates the full string of the where clause segment for the test using the same kind of 'safe' sql-string logic as sqlvar: so you should be able to replace the value to test against with any valid python expression, such as the one below where the % operators are concatenated onto the variable holding the value you want to test against. :) As for the difference between <dtml-sqlvar> and <dtml-var sqlquote> (in case anyone is confused), an sqlvar tag requires a type value and will not only perform an sqlquote on the value being inserted into the statement, but will do any/all type conversion/stripping (letters from numeric values, etc) needed based upon the requested type. If anyone is concerned/puzzled by the security hazards I listed below, here is a URL describing problems associated with bad data used within queries and a mysql DB: http://www.mysql.com/doc/G/e/General_security.html See the bullet point beginning with 'Do not trust any data entered by your users.' Sorry if I seemed harsh in my original post, but security is my bread and butter, so I may tend to be Loud when I see something wrong... PS: In order to increase the safety of ZSQLMethods, maybe the basic <dtml-var> tag should be made illegal inside it? (forced usage of the safe form would break some existent code, possibly, but would avoid confusion such as this in general - and thus be safer) > -----Original Message----- > From: Schmidt, Allen J. [mailto:aschmidt@nv.cc.va.us] > Sent: Friday, February 09, 2001 7:01 AM > To: 'Jon Franz'; 'zope-dev(a)zope.org' > Subject: Bad: Re: [Zope-dev] ZSQL using LIKE operator > > > Got it. Making the change now. Thanks for keeping an eye on > this thread. > What about the sqltest suggestion on posted on this thread? > Or do sqltest > and sqlvar handle DB calls in a similar fashion? > Thanks > >> -----Original Message----- >> From: Jon Franz [mailto:jfranz@one.net] >> Sent: Thursday, February 08, 2001 3:54 PM >> To: 'zope-dev(a)zope.org' >> Subject: Bad: Re: [Zope-dev] ZSQL using LIKE operator >> >> >> No, this is bad!! Do NOT do this - it will allow Bad <<SNIP>

1 0

RE: Re: [Zope-dev] ZSQL using LIKE operator
by Jon Franz 09 Feb '01

09 Feb '01

sqltest just creates the full string of the where clause segment for the test using the same kind of 'safe' sql-string logic as sqlvar: so you should be able to replace the value to test against with any valid python expression, such as the one below where the % operators are concatenated onto the variable holding the value you want to test against. :) As for the difference between <dtml-sqlvar> and <dtml-var sqlquote> (in case anyone is confused), an sqlvar tag requires a type value and will not only perform an sqlquote on the value being inserted into the statement, but will do any/all type conversion/stripping (letters from numeric values, etc) needed based upon the requested type. If anyone is concerned/puzzled by the security hazards I listed below, here is a URL describing problems associated with bad data used within queries and a mysql DB: http://www.mysql.com/doc/G/e/General_security.html See the bullet point beginning with 'Do not trust any data entered by your users.' Sorry if I seemed harsh in my original post, but security is my bread and butter, so I may tend to be Loud when I see something wrong... PS: In order to increase the safety of ZSQLMethods, maybe the basic <dtml-var> tag should be made illegal inside it? (forced usage of the safe form would break some existent code, possibly, but would avoid confusion such as this in general - and thus be safer) > -----Original Message----- > From: Schmidt, Allen J. [mailto:aschmidt@nv.cc.va.us] > Sent: Friday, February 09, 2001 7:01 AM > To: 'Jon Franz'; 'zope-dev(a)zope.org' > Subject: Bad: Re: [Zope-dev] ZSQL using LIKE operator > > > Got it. Making the change now. Thanks for keeping an eye on > this thread. > What about the sqltest suggestion on posted on this thread? > Or do sqltest > and sqlvar handle DB calls in a similar fashion? > Thanks > >> -----Original Message----- >> From: Jon Franz [mailto:jfranz@one.net] >> Sent: Thursday, February 08, 2001 3:54 PM >> To: 'zope-dev(a)zope.org' >> Subject: Bad: Re: [Zope-dev] ZSQL using LIKE operator >> >> >> No, this is bad!! Do NOT do this - it will allow Bad <<SNIP>

1 0

Re: [Zope-dev] manage_options in 2.3
by Tres Seaver 09 Feb '01

09 Feb '01

"Chris Withers" <chrisw(a)nipltd.com> wrote: > > ActivePython 2.0, build 202 (ActiveState Tool Corp.) > > based on Python 2.0 (#8, Oct 19 2000, 11:30:05) [MSC > > Type "copyright", "credits" or "license" for more in > > >>> a = ('a','b','c','d') > > >>> print type(a) > > <type 'tuple'> > > >>> b = a[1:] > > >>> print b > > ('b', 'c', 'd') > > Hmmm... does 'normal' python work like that too? Probably... $ python Python 1.5.2 (#1, Feb 1 2000, 16:32:16) [GCC egcs-2.91.66 19990314/Linux (egcs- on linux-i386 Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam >>> a = ( 1,2,3,4 ) >>> a (1, 2, 3, 4) >>> a[ 1:3 ] (2, 3) > Ah well, you learn something new every day :-) Only on the good days -- the bad ones you spend in meetings. :) Tres. -- =============================================================== Tres Seaver tseaver(a)digicool.com Digital Creations "Zope Dealers" http://www.zope.org

3 2

2.3.0. Unindex_object Tried To Unindex Nonexistent
by Andy Dawkins 09 Feb '01

09 Feb '01

I'm having some more problems with the ZCatalog in Zope 2.3.0 I've got a name error in the file UnTextIndex.py Error Type: NameError Error Value: i I believe this is occuring when the catalog tries to unindex an object that isn't currently indexed. The traceback reports line 332: File /usr/zope/zope-2_3_0/lib/python/SearchIndex/UnTextIndex.py, line 332, in removeForwardEntry The line in question reads: LOG('UnTextIndex', ERROR, 'Unindex_objects tried to unindex nonexistent' ' document %s' % str(i)) The function never uses or declares i, however it does use documentId. I think perhaps the i should have been documentId but I thought i would check with you guys first. What do you think? -Andy

4 4

Bad: Re: [Zope-dev] ZSQL using LIKE operator
by Schmidt, Allen J. 09 Feb '01

09 Feb '01

Got it. Making the change now. Thanks for keeping an eye on this thread. What about the sqltest suggestion on posted on this thread? Or do sqltest and sqlvar handle DB calls in a similar fashion? Thanks -----Original Message----- From: Jon Franz [mailto:jfranz@one.net] Sent: Thursday, February 08, 2001 3:54 PM To: 'zope-dev(a)zope.org' Subject: Bad: Re: [Zope-dev] ZSQL using LIKE operator No, this is bad!! Do NOT do this - it will allow Bad characters in your SQL query that could allow mischievous people to tamper with your Db and possibly hack your box (depending upon what DB you are using, how it is configured, what user it runs as, etc) This is the whole reason the dtml-sqlvar tag exists - _Safe_ conversion to formats usable by your DB, including escaping of bad characters. instead, do This: SELECT * FROM table WHERE keywords LIKE <dtml-sqlvar "'%' + my_var + '%'" type=string> the expression inside the quotes will handle adding the %'s to the beginning and end of your string. Sorry about the correction, but this Can be a big security hazard... ~Jon Franz/'Coventry': http://www.zope.org/Members/Coventry >Message: 9 >Date: Thu, 08 Feb 2001 07:32:48 -0500 >Subject: Re: [Zope-dev] ZSQL using LIKE operator >From: Jens Vagelpohl <jens(a)digicool.com> >To: "Schmidt, Allen J." <aschmidt(a)nv.cc.va.us>, <zope-dev(a)zope.org> > >just write it out like: > >SELECT * FROM table WHERE keywords LIKE '%<dtml-var name="my_var">%' > >jens _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

1 0

Greedy except clauses
by richard＠bizarsoftware.com.au 09 Feb '01

09 Feb '01

I've run into several greedy except: clauses now, and have submitted patches to make them a little less greedy. Out of curiosity, I searched the Zope source for "unfiltered" except: clauses... % grep -rl "except:$" . |wc -l 102 ... erk Just picking some of the results of that search at random, I noticed places where underlying exceptions could be eaten where I'm sure they'd be better propogated up... BTW, I did that little search above when I had a stupid (read: cut'n'paste :) bit of code that recursed on itself. Python generates a RuntimeError when that happens. I didn't get the RuntimeError. Zope simply quit on me with no error message. I have no idea where the RuntimeError is being caught, but I would strongly argue that it shouldn't be! I'm willing to have a go at cleaning some of those except: clauses up, but I can't possibly do 102 of them (I have a product dealine coming up :) Richard -- Richard Jones richard(a)bizarsoftware.com.au Senior Software Developer, Bizar Software (www.bizarsoftware.com.au)

3 2

Object decision from WebDav/FTP
by Andy McKay 08 Feb '01

08 Feb '01

Where does Zope do the decision to turn an file sent via FTP or WebDAV into an object of a certain type? I want to fiddle with this so an image put via WebDAV is a myImage object (for example) rather than an Image.... Cheers. -- Andy McKay.

1 0

Bad: Re: [Zope-dev] ZSQL using LIKE operator
by Jon Franz 08 Feb '01

08 Feb '01

No, this is bad!! Do NOT do this - it will allow Bad characters in your SQL query that could allow mischievous people to tamper with your Db and possibly hack your box (depending upon what DB you are using, how it is configured, what user it runs as, etc) This is the whole reason the dtml-sqlvar tag exists - _Safe_ conversion to formats usable by your DB, including escaping of bad characters. instead, do This: SELECT * FROM table WHERE keywords LIKE <dtml-sqlvar "'%' + my_var + '%'" type=string> the expression inside the quotes will handle adding the %'s to the beginning and end of your string. Sorry about the correction, but this Can be a big security hazard... ~Jon Franz/'Coventry': http://www.zope.org/Members/Coventry >Message: 9 >Date: Thu, 08 Feb 2001 07:32:48 -0500 >Subject: Re: [Zope-dev] ZSQL using LIKE operator >From: Jens Vagelpohl <jens(a)digicool.com> >To: "Schmidt, Allen J." <aschmidt(a)nv.cc.va.us>, <zope-dev(a)zope.org> > >just write it out like: > >SELECT * FROM table WHERE keywords LIKE '%<dtml-var name="my_var">%' > >jens

1 0