September 2001 - Zope-Dev

monitor_client.py in Zope 2.4.1 not working properly
by Morten W. Petersen 26 Sep '01

26 Sep '01

Hi, I've been playing a bit with the monitor_client (ZServer/medusa), and it seems all exceptions aren't raised so it's visible in the client, it's seen in the debug output from Zope itself. Has anyone experienced this? -Morten

1 0

RE: [Zope-dev] Zope on Windows: enhancements proposed
by Adrian Hungate 26 Sep '01

26 Sep '01

I have to disagree about the Zope (%s), I have been known to run 2 or 3 Zope services, for different instances, and I always know that I can find them all huddled together at the bottom of the Service Manager - Very useful. Adrian... -- Adrian Hungate Try Zope - http://www.zope.org - You might like it. If you do, try my Zope products - http://www.zope.org/Members/haqa - You might like them too! -----Original Message----- From: Andy [mailto:andy@agmweb.ca] Sent: 25 September 2001 05:23 To: richard(a)bizarsoftware.com.au; zope-dev(a)zope.org Subject: Re: [Zope-dev] Zope on Windows: enhancements proposed > We'd like to propose that the service distributed with Zope move over to > using our code. Great, Im really looking forward to an improved Windows installation. But lets get it out there play with it before anything major happens like shipping Zope with it :) > As a separate issue - we're curious about the naming of the Zope installation > - why is it called WebSite (and the Zope service "Zope (WebSite)")? The name > clashes with another product that's fairly well-known in the windows > community originally from O'Reilly: http://www.oreilly.com/software/index.html > ... and since Zope is a fairly distinctive name ... It is annoying but Zope wins there because OReilly isnt making WebSite anymore. Its just a name, I find the Zope (%s) bit more annoying than anything :) > ps. happy to put this up as a project if required. Thats probably a good idea. What about other issues such as install and removing service easily later, STDERR logging not going to /dev/null, lack of start menu icons and other windows issues... Cheers -- Andy McKay _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

3 2

making wo_pcgi only rebuild when necessary.
by Anthony Baxter 26 Sep '01

26 Sep '01

I've got Zope code and installation pretty heavily automated here, but one thing that takes a while is that after a cvs update, I have to do a complete wo_pcgi on each box to make sure everything's up to date. This forces everything to be rebuilt. Is there anything that could be done to make it only rebuild what's needed? Anthony

1 0

RE: [Zope-dev] RE: Barriers to Zope popularity: Part 2: source co ntrol
by Jay, Dylan 26 Sep '01

26 Sep '01

> -----Original Message----- > From: Chris Withers [mailto:chrisw@nipltd.com] > Sent: Tuesday, 25 September 2001 10:59 PM > To: Jay, Dylan > Cc: 'zope-dev(a)zope.org' > Subject: Re: [Zope-dev] RE: Barriers to Zope popularity: Part > 2: source > control > > > "Jay, Dylan" wrote: > > > > > Zope looks nice but I found it has two potential problems. > > > > > > 1. WYSIWYG editing > > ZPT, WebDAV, etc Yes, I pointed these out as the solution in my email. > > > 2. Source control (by ClearCase) > > Well, I just used FS-based CMF skins and python Products > maintained with CVS to > control the 'code'. I don't believe 'data' should ever be put > under the kind of > source control you're talking about here... The discussion was about over-the-web code such as DTML, ZPT, ZClasses. Many sites (including most I've done) are mainly over-the-web code. I also agree that 'data' should not be source controlled (although I could see some content management applications where this distinction could get kind of murky).

3 2

Vulnerability in Zope
by ALife 25 Sep '01

25 Sep '01

Found vulnerability: retrieve a full path to local files in Zope. ---[ Example 1 (Linux): telnet www.zope.org 80 PROPFIND / HTTP/1.0 F G H J K L HTTP/1.0 500 Internal Server Error Server: Zope/Zope 2.3.2 (source release, python 1.5.2, linux2) ZServer/1.1b1 Date: Mon, 10 Sep 2001 15:38:59 GMT Content-Length: 7058 Ms-Author-Via: DAV Bobo-Exception-File: /usr/local/base/Zope-2.3.2-modified/lib/python/OFS/Property Sheets.py Bobo-Exception-Type: TypeError Content-Length: 7058 Ms-Author-Via: DAV Bobo-Exception-File: /usr/local/base/Zope-2.3.2-modified/lib/python/OFS/Property Sheets.py Bobo-Exception-Type: TypeError Content-Type: text/html Bobo-Exception-Value: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional// EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <HTML> <HEAD> <TITLE>Welcome to Zope.org</TITLE> <link rel="stylesheet" href="http://www.zope.org/zope_css" type="text/css"> </HEAD> <BODY B Bobo-Exception-Line: 369 ...  Host has closed connection. ---[ Example 2 (Linux): telnet www.zope.com 80 GGGG / HTTP/1.0 or NOTREALCOMMAND / HTTP/1.0 HTTP/1.0 404 Not Found Server: Zope/Zope 2.3.2 (source release, python 1.5.2, linux2) ZServer/1.1b1 Date: Fri, 21 Sep 2001 12:51:48 GMT Bobo-Exception-File: /usr/local/base/Zope-2.3.2-modified/lib/python/ZPublisher/H TTPResponse.py Content-Type: text/html Bobo-Exception-Type: NotFound Bobo-Exception-Value: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional// EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <HTML> <HEAD> <TITLE>Welcome to Zope.org</TITLE> <link rel="stylesheet" href="http://www.zope.org/zope_css" type="text/css"> </HEAD> <BODY B Content-Length: 5845 Bobo-Exception-Line: 547 < ... >  Host has closed connection. ---[ Example 3 (Win32): OPTIONS / HTTP/1.0 or NOTREALCOMMAND / HTTP/1.0 HTTP/1.0 404 Not Found Server: Zope/Zope 2.3.2 (binary release, python 1.5.2, win32-x86) ZServer/1.1b1 Date: Mon, 10 Sep 2001 15:06:43 GMT Bobo-Exception-File: D:\INSTOC~1\lib\python\webdav\NullResource.py Bobo-Exception-Type: Not Found Content-Type: text/html Location: http://SERVERNAME Bobo-Exception-Value: bobo exception Content-Length: 756 Bobo-Exception-Line: 122 <html><head><title>::</title></head><body bgcolor="#FFFFFF"> <h2>нЬХАЙЮ!</h2> <p>н ЬХАЙЮ ОПХ ОНОШРЙЕ НОСАКХЙНБЮРЭ ПЕЯСПЯ.</p> <hr noshade> </body></html>  Host has closed connection.

7 7

Addressing client-side trojan problem
by Ken Manheimer 25 Sep '01

25 Sep '01

Shane Hathaway <shane(a)zope.com> wrote: > sean.upton(a)uniontrib.com wrote: > > > Personally, I think this really should be an integration issue instead of a > > Zope issue: use a front-end proxy server (i.e. Squid) and set up ACLs to > > prevent this... > > > This hasn't been fixed because it's not well understood. Javascript can > POST an invisible form, AFAIK. The problem occurs on the browsers of > users who are *already authenticated*. It has nothing to do with Zope > or any server software, really. I recently saw a _very_ interesting description of how capability-based distributed computing (and the Principle of Least Authority) is used to address vulnerabilities to client side trojans, viruses, etc. I think the approach may apply to the web situation. "Capabilities" are a signficant, fairly established idea in the realm of distributed operating systems, but are not very familiar more generally. This description is by far the most approachable i've seen (and perhaps, the first i've understood:) - i highly recommend looking it over. It's in a substantial overview of the very nifty looking scripting language, E, which is specifically designed to provide secure, reliable, manageable distributed computing scripting. The relevant bits are at: http://www.skyhunter.com/marcs/ewalnut.html#SEC41 A page or two down it describes the ramifications for things like computer viruses, if you want to skip straight to the punch. That part doesn't quite capture the way i expect we would use it to address the client-side trojan problem. Offhand, i suspect we could use these principles with Zope cookies and capability-specific roles. This approach provides a means for implementing something along the lines that chris petrilli was suggesting a while back, with incremental, rather than either/or, role privileges. Ken klm(a)zope.com

2 1

DISCUSS: Community checkins for CVS
by James Johnson 25 Sep '01

25 Sep '01

> Does anyone think this is close enough that I can go ahead and get the > bootstrap group (under ten, selected by us) going? I'd like to avoid > making them sign and mail an agreement, then do it again if there's > substantive changes. Have fun with it.

1 0

RE: Barriers to Zope popularity: Part 2: source control
by Jay, Dylan 25 Sep '01

25 Sep '01

> -----Original Message----- > From: Kenichi Sato > Sent: Monday, 24 September 2001 5:49 PM > To: djay > Subject: Barriers to Zope popularity: Part 2: source control > > > Dear Mr. Jay, Dylan, > > I am Ken Sato, a manager of software development projects. I'm now > taking a look at Zope as a tool to publish project related > information internally. > > Zope looks nice but I found it has two potential problems. > > 1. WYSIWYG editing > 2. Source control (by ClearCase) > > Then, I found that you pointed out exactly same things in the > zope-dev mailing list. > (http://lists.zope.org/pipermail/zope-dev/1999-September/001602.html) > > Because the post was two years ago, I wonder if you have already > solved the above problems. It would be very helpful for me if you > could give me some information on this issue, please. Hope you don't mind me CC'ing this to zope-dev. I still see both these issues as important and still see the lack of progress towards Zope working well in traditional development environments being a real outage. Plus others may have different opinions about the current state of affairs 1. I have not used Zope Page Templates but these are supposed to solve the wysiwyg problem. They are an alternative to DMTLDocuments. They allow for much better seperation of code and presentation. Get you graphics people to use webdav to edit the html with whatever editor they want and the coding people argment the html rather than rip it appart. http://www.zope.org/Documentation/Articles/ZPT1 Personally I like DTML and back then I did suggest a way DTML could used in a similar way to Page Templates (basically have a view mode of a DTML document that incorparates the rendered content as well as the DTML code such that when the page is edited and saved back, it will save all the changed parts back to the where they came from, i.e. the different DTMLMethods that made up the page). but like most of my ideas I din't have the ability or time to implement it. 2. Hasn't really been solved. There are sort of attempts that work now with CVS (I havn't tried it) http://www.zope.org/Members/sspickle/ZCVSMixin This but there are proposals that will better solve this problem, but no implementation on the way that I can see. The problem is really one of synchronization. You want two different representations that are both kept upto date. One for zope to use, one for all the reasons we have things under source control. You may or may not want control of when the synchronization occurs. Here are some related proposals http://www.zope.org//Wikis/DevSite/Proposals/SynchronizationMechanismZCVSMix in http://www.zope.org/Wikis/DevSite/Proposals/SynchronizationTab http://www.zope.org/Wikis/DevSite/Proposals/RepresentingObjectsOnTheFilesyst em I also see a lot of parallels with the work going on with ZODB replication. If you had replication between a normal ZODB and some filesystem source control ZODB then you would have the source control synchronization problem solved maybe? http://dev.zope.org/Wikis/DevSite/Projects/ZEOReplicatedStorage/FrontPage

4 3

RE: Dreamweaver, Webdav and PUT.
by Terry Kerr 25 Sep '01

25 Sep '01

Hi, I discovered that if I define the PROPFIND method on the LockNullResource class as follows: def PROPFIND(self, REQUEST, RESPONSE): """Retrieve properties defined on the resource.""" self.dav__init(REQUEST, RESPONSE) cmd=davcmds.PropFind(REQUEST) result=cmd.apply(self) RESPONSE.setStatus(207) RESPONSE.setHeader('Content-Type', 'text/xml; charset="utf-8"') RESPONSE.setBody(result) return RESPONSE then the dreamweaver PUT works perfectly. I don't know enough about Webdav to know if this is a satisfactory fix or not, but it seems to work for me. The collector is down currently but I will put it in when it is back up unless others advise me not to. terry -- Terry Kerr (terry(a)adroit.net) Chief Technical Officer Adroit Internet Solutions (www.adroit.net) Phone: +61 3 9563 4461 Fax: +61 3 9563 3856 ICQ: 79303381

2 1

RE: [Zope-dev] Zope on Windows: enhancements proposed
by Adrian Hungate 25 Sep '01

25 Sep '01

I edit the registry... One of my many favourite pass-times, right up there with running out in traffic. Seriously though, once an instance is configured, why would you want to change it? (Assuming you get it right that is) Adrian... -- Adrian Hungate Try Zope - http://www.zope.org - You might like it. If you do, try my Zope products - http://www.zope.org/Members/haqa - You might like them too! -----Original Message----- From: Richard Jones [mailto:richard@bizarsoftware.com.au] Sent: 25 September 2001 07:33 To: Adrian Hungate; zope-dev(a)zope.org Subject: Re: [Zope-dev] Zope on Windows: enhancements proposed On Tuesday 25 September 2001 16:26, Adrian Hungate wrote: > I have to disagree about the Zope (%s), I have been known to run 2 or 3 > Zope services, for different instances, and I always know that I can find > them all huddled together at the bottom of the Service Manager - Very > useful. So does that mean they have different names in the service manager? How do you configure the instances? Richard

2 1