September 2001 - Zope-Dev

Re: [Zope-dev] New: Cross Site Scripting vulnerability
by Oliver Bleutgen 23 Sep '01

23 Sep '01

Aargh, I sent that first to zope(a)zope.org ... >> Hello message board. This is a message. >> <SCRIPT>malicious code</SCRIPT> >> This is the end of my message. > I don't really see your point other than a carelessly implemented app may > expose these kind of vulnerabilities. Python (and hence Zope) has a > library > for stripping out this sort of malicious HTML. > Search for Strip-o-Gram or Squishdot on Zope.org for examples of how this > can be used. umm chris, you're right, but this example http://www.zope.org/Documentation/<SCRIPT>alert(document.domain)</SCRIPT> executes the script. I don't exactly see why/where but I feel this really shouldn't happen. As I see it, it's more a problem of zope's standard_error page, which constructs links to the classic zope site. I don't see a zope-specific bug here, too. cheers, oliver

1 0

questions about writing a DA
by StevenLee 23 Sep '01

23 Sep '01

hi,all I have got several questions here,and maybe you can give me some advice. What I am trying to do is write a product which can communicate with ODBC Socket Server, a win32 server application that allow applications to have access to Data Sources managed by Windows ODBC DataSource Administrator. And now a class written in python can communicate with ODBC Socket Server. BTW,the class mentioned above handles the connection to the server,sending SQL statement,and Receiving results. As far as I know, in Zope,to access Data Sources,one must create a Database connection and ZSQLMethods associated with it to get the results. (but I have doubt about this, IMHO,there must be some other way to do so,but what is it.). Now,I am rather confused about how to solve the problem. First,is what I need to write a DA? or just a common product? Second,if it's a DA, how can I use the existing class? I have read the article named "how to write a DA" in the how-tos,but it is quite abstract to me. Third,where can I find more about the DataBase Connection and ZSQLMethod ? especially on how they work together to access databases. OK,I am not sure whether I have made me understood, in fact,I am not quite clear myself. if you have any questions about that,I will reply ASAP. thanks for your great patience,I will be grateful if you can give me some advice. thank you! Best Wishes yours sincerely Steven Lee

2 1

Simple question about namespaces
by Sidnei da Silva 21 Sep '01

21 Sep '01

Hello everyone, Im trying to do something like this: when a user access: http://www.mysite.com/somefolder i wish to return: http://www.mysite.com/onefolder/anotherfolder/somefolder but do this in a transparent form, without redirecting the user. I guess, by calling the "somefolder" in the context of "onefolder/anotherfolder". Maybe by overriding "__bobo_traverse__" Hope you can help me this time, cause the other questions I have asked to this list where not answered by anyone. Thanx in advance. -- Sidnei da Silva X3ng Consultoria e Desenvolvimento Ltda. sidnei(a)x3ng.com.br

2 1

Re: [Zope-dev] Simple question about namespaces
by Sidnei da Silva 21 Sep '01

21 Sep '01

Hello Antonio, Actually, the problem can not be solved by the Virtual Host Product, for what i know. Let me explain the situation: Im trying to create something like a Template Folder, that contains some folders with images, some DTML Methods that create menus and the like, and a Content Folder, that contains the Content itself. I can have Templates that have just specialized parts of the template and look over at the Main Template folder, in case of not found some object at the Specialized Template. Im having trouble at two points: * First, in making the Specialized Template look over at the Main Template under not found some content (like i said, the specialized content may containt one or two images inside a images folder). Ive tried doing this by overriding the __bobo_traverse__ method of the Specialized Template, but it not worked. * Second, when i call the Content Folder, it is needed to apply the template to it. The content has a property that says what is the Specialized Template that has to be applied when calling it, so, when i call: http://www.mysite.com/ContentFolder i need to apply the template to the folder, maybe calling: http://www.mysite.com/MainTemplate/SpecializedTemplate/ContentFolder But i wish to do this by code, instead of redirecting the user to this url. Hope you understand what ive explained here, and if cannot help me, maybe can tell me who can help me. Thanx.... Em Friday 21 September 2001 10:00, you wrote: > This is not an answer. But you can find information, in how to´s, Zope Help, > or Products Help. Look for Virtual Host Product. > > Antonio Carrasco > > ¿The other question? > > ----- Original Message ----- > From: "Sidnei da Silva" <sidnei(a)x3ng.com.br> > To: <zope-dev(a)zope.org> > Sent: Friday, September 21, 2001 2:08 PM > Subject: [Zope-dev] Simple question about namespaces > > > > Hello everyone, > > > > Im trying to do something like this: > > when a user access: > > http://www.mysite.com/somefolder > > i wish to return: > > http://www.mysite.com/onefolder/anotherfolder/somefolder > > but do this in a transparent form, without redirecting the user. I guess, > by > > calling the "somefolder" in the context of "onefolder/anotherfolder". > Maybe > > by overriding "__bobo_traverse__" > > > > Hope you can help me this time, cause the other questions I have asked to > > this list where not answered by anyone. > > > > Thanx in advance. > > > > -- > > Sidnei da Silva > > X3ng Consultoria e Desenvolvimento Ltda. > > sidnei(a)x3ng.com.br > > > > _______________________________________________ > > Zope-Dev maillist - Zope-Dev(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope-dev > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope ) > > > > -- Sidnei da Silva X3ng Consultoria e Desenvolvimento Ltda. sidnei(a)x3ng.com.br

1 0

Structure-text : <html>
by Sin Hang Kin 21 Sep '01

21 Sep '01

When I use <dtml-var StructureTextDoc fmt=structured-text> I got <html> </html> in the result. Are there any reason that it should be there? I wounder how can structured text generate valid html or be used in wap applications. If structured text is hard coded to output unnecessary <html> then I consider it a serious bug. And there should be coding rules that ensure in future no such bugs exist in Zope. Rgs, Kent Sin --------------------------------- kentsin.weblogs.com kentsin.imeme.net

3 2

Re: [Zope-dev] DISCUSS: Community checkins for CVS
by Anthony Baxter 21 Sep '01

21 Sep '01

>>> "Morten W. Petersen" wrote > Will a ZPL-ish license [1] be accepted (declared, ref. paragraph > 4 of the Zope Contributor Agreement) by the Zope Corporation? > [1] http://www.thingamy.org/tpl Um, this license would seem to have the "obnoxious advertising clause" problem - it requires you to put the "This product... blah blah" in. If you end up with 25 different contributors with the same sort of clause, you're going to have a complete shambles. Anthony

1 0

[patch] making 'Find' traverse into ZClass Products
by Anthony Baxter 21 Sep '01

21 Sep '01

I got completely fed up with the Zope 'Find' stuff not being about to traverse through Products/Foo/FooProduct, where FooProduct is a ZClass. The following patch adds this support to the FindSupport.ZopeFind method through the simple fix of saying "if it's a ZClass, keep looking in ob.propertysheets.methods" It seems to Work For Me - I'd post it to the collector, but I can't reach it at the moment... Anthony

1 0

re: Subclassing ZObjectManager in ZClasses
by Daniel Rogahn 20 Sep '01

20 Sep '01

re: http://lists.zope.org/pipermail/zope-dev/2000-March/004034.html This message is about 1.5 years old, but no replies?, & I haven't seen any similar messages or howtos? --Alexandre Ratti Fri, 31 Mar 2000 >Summary: (when creating a folderish ZClass and cascading base classes) if >ZObjectManager isn't subclassed at 1st level, objects can be added to the >folderish ZClass instances but they don't show in the manage_main object list. >Here I first created MyBaseClass, then I subclassed it together with >ZObjectManager when creating MyTestClass ... >when I add objects in an instance of MyTestClass they do not show >in the object list (Content view). I *think* they are actually added >because I cannot add an additional one with the same ID: I get an "ID >already in use" error. >It's not that bad, but I can't create a standard base class, then use it to >create a folderish variant. I have the same symptoms, objects dont display in a folder subclass, but are there. Heres how I fixed it: Your base class must be the last in the class inheritance list. You must add all other base classes first. This will almost always be a problem because most base classes start with ZClass... and will be last alphabetically. (this will be much easier to fix if/when you can change, or at least reorder, the base classes of an object) eg: ZObject, ZObjectManager, CatalogAwareBase, MyBaseClass If you have a complicated object, I think you can export it in XML, reorder the base classes, & reimport. But adding/removing classes this way doesn't update the management interface tabs. Daniel Rogahn drogahn(a)d.umn.edu http://www.d.umn.edu/~drogahn/

2 1

Fwd: Re: [Zope-dev] WebDav Bug?
by Eric Brun 20 Sep '01

20 Sep '01

Hi, I'm working on webdav too. Question : When I access to my folder by webdav protocol (win98 webfolder), I can list the folder content, but when I want to access to a file inside, Zope asked to me another authentification, then I can access to my file (wordd file (.doc)) but only in read only mode. When I see the Z2.log, I see that anonymous user lock my file when I try to access it . Why ? Anybody for my question ? Thanks Eric Le Lundi 17 Septembre 2001 23:40, vous avez ?rit : > This should be fixed in Zope 2.4.X > > Andreas > ----- Original Message ----- > From: "Phil Harris" <phil.harris(a)zope.co.uk> > To: <zope-dev(a)zope.org> > Sent: Monday, September 17, 2001 12:05 > Subject: [Zope-dev] WebDav Bug? > > > All, > > > > I'm in the process of creating a Python based equivalent for Cadaver. > > > > I think there is a minor but very annoying bug in the Zope WebDav server. > > > > I don't think the contents of the properties are being quoted. > > > > For instance: > > > > One object in my ZODB has a title of 'Declare interfaces for MIMEtype <-> > > Type object registry objects.' > > > > The '<->' is what causes the problem when parsed by xml.dom.minidom. > > > > Any ideas whether I'm right, and if so what can be done. > > > > Phil > > phil.harris(a)zope.co.uk > > > > +1 family member. > > > > The nuclear family is now ready. > > > > > > _______________________________________________ > > Zope-Dev maillist - Zope-Dev(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope-dev > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope ) > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) -- Eric Brun Mission TIC Savoie Technolac France E-mail : Eric.Brun(a)univ-savoie.fr ------------------------------------------------------- -- Eric Brun Mission TIC Savoie Technolac France E-mail : Eric.Brun(a)univ-savoie.fr

7 9

Medusa Patch Lost
by Toby Dickenson 20 Sep '01

20 Sep '01

A zope-specific patch to medusa seems to have got accidentally lost between 2.3.x and 2.4. The patch below allows Zope to handle http requests as if it was a proxy, ie: GET http://servername/x/y/z HTTP/1.0 in addition to the more normal mode as if it was an origin server: GET /x/y/z HTTP/1.0 (there is an rfc for this, but I forget the number :-( (With the Collector down, I hope this is the best place for uncontroversial patches. Is anyone from DC looking out for them?) diff -c -r1.1.1.6 -r1.2 *** http_server.py 10 Sep 2001 14:55:08 -0000 1.1.1.6 --- http_server.py 20 Sep 2001 12:43:53 -0000 1.2 *************** *** 713,719 **** return m return '' ! REQUEST = re.compile ('([^ ]+) ([^ ]+)(( HTTP/([0-9.]+))$|$)') def crack_request (r): m = REQUEST.match (r) --- 713,719 ---- return m return '' ! REQUEST = re.compile('([^ ]+) (?:[^ :?#]+://[^ ?#/]*)?([^ ]+)(( HTTP/([0-9.]+))$|$)') def crack_request (r): m = REQUEST.match (r) Toby Dickenson tdickenson(a)geminidataloggers.com

2 1