February 2001 - Zope-Dev

SECURITY alert and hotfix release...
by Brian Lloyd 23 Feb '01

23 Feb '01

Hello All, Casey Duncan uncovered a potential security issue today that necessitated a hotfix release. This hotfix addresses an important security issue that affects Zope versions up to and including Zope 2.3.1 b1. The issue is related to ZClasses in that a user with through-the-web scripting capabilities on a Zope site can view and assign class attributes to ZClasses, possibly allowing them to make inappropriate changes to ZClass instances. This patch also fixes problems in the ObjectManager, PropertyManager, and PropertySheet classes related to mutability of method return values which could be perceived as a security problem. We *highly* recommend that any Zope site running versions of Zope up to and including 2.3.1 b1 have this hotfix product installed to mitigate these issues if the site is accessible by untrusted users who have through-the-web scripting privileges. - http://www.zope.org/Products/Zope/Hotfix_2001-02-23/README.txt - http://www.zope.org/Products/Zope/Hotfix_2001-02-23/Hotfix_2001-02-23.tgz Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

REQUEST acting up and misplacing form elements in other
by morten＠esol.no 23 Feb '01

23 Feb '01

Hi zopers, I've been wondering what may be causing the REQUEST object to store form values in the other dictionary. Is this a new feature or simply a bug? Cheers, Morten

1 0

ZClass class attr security?
by Casey Duncan 23 Feb '01

23 Feb '01

In playing around with some ideas for enhancing ZClasses, I stumbled into the following: Using getClassAttr, you can retrieve any attribute of the Python ZClass including built-in ones like: icon _p_changed __doc__ _p_oid meta_type propertysheets manage_options __ac_permissions__ _p_serial __module__ _p_jar Somewhat more troubling is the fact that I can change these values using setClassAttr, possibly hosing things quite well. I don't know if this is a security flaw, but it looks kinda iffy to me, especially __ac_permissions__. This is a consequence of the fact that these user defined attributes are stored as straight class attributes. Perhaps they need to be stored in a dictionary in the ZClass, although this will unfortunately complicate inheritance. At the least, access to methods named _* should be restricted. I will write a patch for this if it is deemed necessary. Thoughts anyone? ===== | Casey Duncan | Kaivo, Inc. | cduncan(a)kaivo.com `-----------------> __________________________________________________ Do You Yahoo!? Yahoo! Auctions - Buy the things you want at great prices! http://auctions.yahoo.com/

1 0

Re: [Zope-dev] AttributeError validate using the Visitor pattern
by Itai Tavor 23 Feb '01

23 Feb '01

Hi David, You posted your questions 3 days ago, so maybe you found a solution by now... but this might still be useful to you. I just implemented a visitor similar to yours, with a few changes. It involves the following objects: Order and OrderLineItem. I created a Folder named 'displayItemVisitor' in Order containing: Order.displayItemsVisitor.displayItem (Python Script): <params>item</params> return item.accept(container, _) Order.displayItemsVisitor.visitLineItem (DTML Method): <td>&dtml-qty;</td> <td class="price"><dtml-var "getRetailAmount(qty, in_basket_date)" fmt=dollars-and-cents></td> The 'accept' method of OrderLineItem is: <params>visitor, _</params> return visitor.visitLineItem(container, _) And the whole thing gets used in the DTML method that displays an order, using: <dtml-in line_items> <dtml-var "displayItemsVisitor.displayItem(_['sequence-item'], _)"> </dtml-in> Interesting points: - I'm passing _ explicitly instead of relying on binding. I vaguely recall reading something about a problem binding the namespace. It might be fixed in the latest Python Scripts, I haven't tried the CVS version yet. - visitLineItem is called in the context of an OrderLineItem, so no <dtml-with item> is needed. - If you wanted the visitor to implement looping over the items (which is how the GoF do it) you could easily make something like: Order.displayItemsVisitor.displayItems (DTML Method): <dtml-in line_items> <tr> <dtml-var "_['sequence-item'].accept(container, _)"> </tr> </dtml-in> BTW, I never thought of using a visitor for this until you brought it up, so thanks! What I really like about it is that the same 'accept' method can be used by multiple visitors, each one implementing a different view of the object. So I can have displayItemsVisitor, displayItemsCompactVisitor, and displayItemsEditableVisitor, all calling item.accept(), and I avoid polluting my OrderLineItem class with multiple view methods. OTOH, it requires adding public access methods to OrderLineItem, because a view method in OrderLineItem can do <dtml-var price>, while the visitor must do <dtml-var "getPrice()">. Oh well, there's always a price to pay ;-) HTH, Itai R. David Murray wrote: >OK, having helped me figure out how to work around the bug in accessing >ZPatterns objects from a catalog, I've got a new challenge for you all. > >Now that I've got my list of objects, I want to generate a web page displaying >them. The page has the structure of a series of table rows. Inside each >row data about a single object is displayed, using a common format but >with certain differences depending on the type of object. To implement this, >I am trying to use the Visitor pattern from the Gang of Four book. > >So, I have a Folder displayItemList. This folder contains (at the moment) >three methods: displayTable, visitAuthor, and visitBook. displayTable >generates the html for the outer table, down to the <tr></tr> tags. >Between those tags, it calls <dtml-var "accept(me)">, where me is >this() for the displayTable method, and accept is a pythonscript method >defined on each of the object type's Specialist. Each accept method >is of the form: > >return visitor.visitBook(None,_,item=context) > >with _ bound to namespace on the bindings tab and 'visitor' being listed >in the arguments line. > >visitBook begins with the line: > ><dtml-with item> > >Trying to display my list, I get an AttributeError on 'validate', and >ZDebug flags the 'with' line as the error location. validate >appears nowhere in my code, so from all I can figure from a certain >amount of inspection of the source, Zope is looking for this method >on the DTMLMethod and not finding it. > >ZDebug says the namespace stack consists of a single entry, which looks like >the DTMLMethod itself (visitBook, presumably). Seems to me the namespace >stack should be deeper than that. > >I've been poking at this for a couple hours now without making any more >progress, so I'm going to quit for the day and come back to it tomorrow. >If anybody has any bright ideas, or sees something obvious I'm doing wrong, >please clue me in. Thanks! > >By the way, I also tried making accept be visitor.visitBook(context,_), >but that produced the same error and ZDebug could only point to the >call to accept as the error location. > >--RDM -- -- Itai Tavor -- "Je sautille, donc je suis." -- itai(a)optusnet.com.au -- - Kermit the Frog -- -- -- -- "If you haven't got your health, you haven't got anything" --

2 1

Traceback strangeness and default width/height (and those funny Python Methods)
by Erik Enge 23 Feb '01

23 Feb '01

Is it just me, or has the tracebacks provided by Zope when an Exception is raced gotten "worse"? In Zope 2.3.1b1 it usually says file: DT_In (or one of them), and doesn't even mention the file which the Exception was raised from. Also, When I set the default width/height with the new ZMI and bring up a Python Method window, it doesn't follow the default values I've put in. Maybe this is related to something else, because using the + and - on width doesn't work very well either.. Maybe it is this old crappy version of IE I'm running... And another thing about those Python Methods. When an Exception is raised and it gives me the line number it seems to miss the correct line by one. Ie. if I raise an Exception on the first line in a Python Method, it tells me that it was raised on line 2.

1 0

ZCatalog & distinct in SQL
by Valérie Aulnette 23 Feb '01

23 Feb '01

Hi, I am using PTK and it does work with ZCatalog. I need to do the list of values that are in the catalog but I need do do like a "select distinct" in SQL to have each value only once. Do you know how to do that in ZCatalog ? Thanks. Valerie. ___________________________________________________________ Do You Yahoo!? -- Pour dialoguer en direct avec vos amis, Yahoo! Messenger : http://fr.messenger.yahoo.com

2 1

Re: [Zope-dev] Python Script
by Cyril Elkaim 23 Feb '01

23 Feb '01

Hi Steve, In the zclass definition I have a bunch of Image objects together with the following script. SCRIPT s_center(width, height, image): import string result = None for item in container.objectItems(): if string.strip(item[0]) == image: image_width = int(item[1].getProperty("width")) image_height = int(item[1].getProperty("height")) left = (int(width) - image_width) / 2 top = (int(height) - image_height) /2 result = "left:" + str(left) + "px; top:" + str(top) + "px" return result /END_SCRIPT This script works fine if I test it inside the test tabs of the zclass. But if I run it from an instance 'container.objectItems()' returns nothing. I understand why but my problem is how to get access of the images from the instance. What I need is something giving a reference to the zclass definition from one of its instance. I think I can use the DOM model and walk through until I find it but it should be better to have a direct access from the instance itself, wrong? Thanks, Cyril

2 4

Zope and persistence in product dev.
by Jan Murre 23 Feb '01

23 Feb '01

Hi all, I have the following question about Persistence in Zope. I am developing a Product. This product is using some classes internally. These classes are non Zope classes. I found out in one of the How-To's that the Zope persistence machinery can be triggered with the expression: _p_changed = 1, so I am able to make my non Zope classes persistent. I use the following setup: class ZopishClass: def __init__ (self, id): self.id = id self.listOfNonZopeClass2 = [] class NonZopeClass1: def __init__ (self, id): self.id = id self.subListOfNonZopeClass2 = [] class NonZopeClass2: In the subListOfNonZopeClass2 I store a subset of the instances of NonZopeClass2 that are in listOfNonZopeClass2. Now my question is: Should is store id's in the subListOfNonZopeClass2, or should I store 'real' instances. According to the "Programming Python" book the pickling process takes care or storing objects only once, but it seems that this is not true for Zope persistence. Anybody that can help me out? Regards, Jan Murre

1 0

Python Script
by Cyril Elkaim 23 Feb '01

23 Feb '01

Hi All, I must say that I have very hard time with both Scripts and Zclass. My problem is the context and the container proprties of a script inside a Zclass. If I understand well the context is an URL point of view, the object accessed through the web. The container is fixed, it's the object in the database, OK? Now what is the container in the case of a Zclass _instance_. When I test a script inside the zclass _definition_ the container.objectItems() returns correctly all the other methods of the definition. When I run the script inside an _instance_ of that zclass it returns nothing. So is an instance the same container of its zclass definition or something else? What I should want to do is to access the images inside a zclass definition from the script running in an _instance_ 'context' of that zclass. BTW some pointers explaining the hierarchy in both the URL point of view and the database point of view would be very welcomed :-) Thanks in advance, Cyril

2 3

Bugs in Zope Membership Component 0.8.0b1
by Dirksen 23 Feb '01

23 Feb '01

Hi Bill, All PythonScripts in ZMC 0.8.0b1 look like a direct port from Python Methods, so I found some bugs due to the incompatibility between these two version of scripts. 1. In 'passwordForm', 'import string' should be added. 2. In 'passwordPolicy', 'self' should be ommited in the parameters list. 3. 'register', I think, should be proxy to 'Manager', like the original version. There's another bug: anonymous user can access account's manageMe method! Say if there's an account 'dummy', anyone can open 'www.dumy.com/test/acl_users/dummy/manageMe'. I think the permission to view 'manageMe' should be hooked up to that of viewing management screen. I see that you have made some special arrangements in the 'Define Permission' tab of 'Portal Member' ZClass definition, but that doesn't seem to protect its instance, which is a puzzle to me: what's the use to define permissions in ZClass definition or products? Cheers, Dirksen __________________________________________________ Do You Yahoo!? Yahoo! Auctions - Buy the things you want at great prices! http://auctions.yahoo.com/

2 1