May 2001 - Zope-Dev - Zope lists

zunit 0.2 comments
by Simon Michael 01 May '01

01 May '01

Hi Lalo, thanks for your work on ZUnit. I have just been playing with 0.2. To get it working in my zope account at Codeit, I moved Hiper from Shared/ to Products/ and changed the import statements. I also needed to make some changes of this kind: #manage_RunTestsForm = Globals.HTMLFile('Products/ZUnit/dtml/TestRunner/RunTests') manage_RunTestsForm = Globals.HTMLFile('dtml/TestRunner/RunTests',globals()) I'm having trouble figuring out the syntax of the "test_ids" property. Can you help ? best regards, -Simon

3 3

SECURITY alert and hotfix release
by Chris McDonough 01 May '01

01 May '01

Hello All, Dieter Maurer uncovered a potential security issue yesterday that necessitated a hotfix release. This hotfix addresses an important security issue that affects Zope versions up to and including Zope 2.3.2. The issue is related to ZClasses in that any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for unauthorized access within the Zope instance. We *highly* recommend that any Zope site running versions of Zope up to and including 2.3.2 have this hotfix product installed to mitigate this issue. - http://www.zope.org/Products/Zope/Hotfix_2001-05-01/README.txt - http://www.zope.org/Products/Zope/Hotfix_2001-05-01/Hotfix_2001-05-01.tgz

1 0

VirtualHostMonster bug?
by seb bacon 01 May '01

01 May '01

In VirtualHostMonster.py, there's the following code: def _setId(self, id): id = str(id) if id != self.id: BeforeTraverse.unregisterBeforeTraverse(container, self.meta_type) hook = BeforeTraverse.NameCaller(id) BeforeTraverse.registerBeforeTraverse(container, hook, self.meta_type, self.priority) my question - where's that 'container' meant to come from? i'm ripping off the BeforeTraverse hook code and I'm scratching my head. cheers, seb

1 0

Heads up -- big changes on trunk
by Shane Hathaway 01 May '01

01 May '01

This notice only applies to developers who are following the bleeding edge of Zope, the CVS trunk. It does not apply if you downloaded Zope from a web site. We're about to check in to the trunk the unified restricted code implementation which is currently on the RestrictedPython branch. The documentation and rationale can be found here: http://dev.zope.org/Wikis/DevSite/Projects/SupportPython21/RestrictedPython We looked at using Bastion and rexec, but neither of them provide the kind of granularity demanded by the Zope security model. So we created a new module, RestrictedPython, which is in fact usable outside Zope. Although the driving goal was to support Python 2.1, this project has given us an opportunity to work on some long-standing issues as well. The restrictions are clearer and finally both DTML and scripts use the same code to implement security. We've tried hard to make the new code work just right, including new unit tests and a couple of optimizations. But there is bound to be some breakage. Also, as the community was warned previously, the new code requires Python 2.1. Shane

3 4