November 2002 - Zope-Dev

Security problems importing from python package.
by Chris Withers 21 Nov '02

21 Nov '02

Hi, I'm trying to get stripogram working from Script(Pythons). I thought I had it, but it appears I don't. I added the following in the __init__.py of the stripogram package: try: from AccessControl import ModuleSecurityInfo,allow_module except ImportError: # no Zope around raise else: allow_module('stripogram') ModuleSecurityInfo('stripogram').declareObjectPublic() ModuleSecurityInfo('stripogram').declarePublic('html2text', 'html2safehtml') I don't think either the allow_module or the declareObjectPublic() should be necessary. However, the declareObjectPublic at least made this test pass: from Products.PythonScripts.PythonScript import PythonScript theScript = PythonScript('test') theScript.ZBindings_edit({}) theScript.write("from stripogram import html2text\nreturn html2text('<i>hello</i>')") theScript._makeFunction() self.assertEqual(theScript(),'hello') But even adding the 'allow_module' won't let the following Script (Python) created through the ZMI work: from stripogram import html2text The error I get is: Error Type: ImportError Error Value: import of "stripogram" is unauthorized File \lib\python\Products\PythonScripts\PythonScript.py, line 302, in _exec (Object: tester) (Info: ({'script': <PythonScript instance at 012CB4D8>, 'context': <Application instance at 012B92D8>, 'container': <Application instance at 012B92D8>, 'traverse_subpath': []}, (), {}, None)) File Script (Python), line 1, in tester File \lib\python\AccessControl\ZopeGuards.py, line 153, in guarded_import ImportError: (see above) What am I doing wrong? Why doesn't this code behave as advertised in Products/PythonScripts/module_access_examples.py? cheers, Chris

1 0

Yenilenen noseks iuijf
by Ceren Webs 21 Nov '02

21 Nov '02

FULL 2002 YAPIMI PORNO VIDEOLAR Sitemize yeni filmler eklendi. Tam metraj, full kalite Yenilenen Kategoriler: AMATEUR ANAL ASIAN LESBIAN Ýyi eðlenceler, http://www.noseks.com id: zope-dev - kinygaqhvkxbyfmvnxbekjaovpekaphnxuofwf-

1 0

RDB connections and cursors
by Leonardo Rochael Almeida 20 Nov '02

20 Nov '02

I've been having problems with RDB DAs performance and stability lately (stability mostly) and I was thinking of ways in which the use of connectors and cursors could be streamlined in Zope. I'm thinking about DB-API 2-like based DAs here. >From what I understand of the way Zope handles requests and models concurrency and consistency, isn't it true that, for each DA connector in the OFS, I would need only one low level connector and one low level cursor per worker thread? AFAIK, when a worker thread is calling objects in the course of handling a request, any sql methods that are called will have all its result rows converted to brains before returning, so a low level cursor involved in this query would be ready for another query, no need to get another cursor from the connector, isn't it right? Assuming my reasoning above is correct we should be able to create a single connection and a single cursor on __setstate__ of the DA connector instance of the ZODB. The transaction boundaries would be handled normally, but since a worker thread only handles one request at a time, there's no need to close the cursor nor the connection at the transaction end. What do you think? Cheers, Leo

2 3

Problem with Zope 2.6.0 and ZShell
by Jerome Alet 19 Nov '02

19 Nov '02

Hi, Someone has reported to me a problem when running ZShell's latest version (1.5) under Zope 2.6 CVS and Python 2.2.2 Here's the traceback : ***** Traceback (innermost last): Module ZPublisher.Publish, line 98, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 39, in call_object Module Products.ExternalMethod.ExternalMethod, line 224, in __call__ - __traceback_info__: ((<Application instance at b796560>, ['man ls', 'ls'], None), {}, (None, None)) Module /home/zope/Zope/ZInstanceHome/Extensions/zshell.py, line 3501, in zshell Module /home/zope/Zope/ZInstanceHome/Extensions/zshell.py, line 701, in __init__ Module /home/zope/Zope/ZInstanceHome/Extensions/zshell.py, line 1014, in execCommands Module /home/zope/Zope/ZInstanceHome/Extensions/zshell.py, line 1081, in execCommand Module /home/zope/Zope/ZInstanceHome/Extensions/zshell.py, line 891, in ShellExpand Module rexec, line 429, in s_exec Module rexec, line 412, in s_apply Module rexec, line 308, in r_exec Module __main__, line 1, in ? Module rexec, line 339, in r_import Module ihooks, line 397, in import_module Module ihooks, line 433, in find_head_package Module ihooks, line 486, in import_it Module ihooks, line 325, in load_module Module glob, line 4, in ? Module rexec, line 339, in r_import Module ihooks, line 397, in import_module Module ihooks, line 433, in find_head_package Module ihooks, line 486, in import_it Module ihooks, line 325, in load_module Module fnmatch, line 13, in ? Module rexec, line 339, in r_import Module ihooks, line 397, in import_module Module ihooks, line 433, in find_head_package Module ihooks, line 486, in import_it Module ihooks, line 325, in load_module Module re, line 27, in ? Module rexec, line 339, in r_import Module ihooks, line 397, in import_module Module ihooks, line 433, in find_head_package Module ihooks, line 486, in import_it Module ihooks, line 325, in load_module Module sre, line 168, in ? AttributeError: 'module' object has no attribute 'hexversion' ***** This seems to be deep in Python standard library. Since I don't actually use Zope 2.6, does anyone have an idea on where the problem may come from ? Does any of you use ZShell with Zope 2.6 ? It works fine in 2.5.1 with Python 2.1.3, so something has changed somewhere which breaks it. ZShell's latest version is available from : http://www.librelogiciel.com/software Thanks in advance for any pointer. Jerome Alet

2 3

CMF, CMFCore/utils.py, Tuple/List incompatibility
by Christian Theune 19 Nov '02

19 Nov '02

Hi. I get smacked by this: [...long traceback...] * Module Products.CMFCore.CatalogTool, line 58, in allowedRolesAndUsers * Module Products.CMFCore.utils, line 200, in _mergedLocalRoles Exception Value can only concatenate tuple (not "list") to tuple The file tells me nothing special. I once fixed it by using merged[k] = tuple(merged[k]) + tuple(v) instead of merged[k] = merged[k] + v I don't know if i triggered something bad before, but this code seems to be somewhat ... instable ... so maybe forcing it into a tuple maybe a good thing. Cheers Christian -- Christian Theune - ct(a)gocept.com gocept gmbh & co.kg - schalaunische strasse 6 - 06366 koethen/anhalt tel.+49 3641 511586 - fax.+49 3496 3099118 - mob. +49 179 7808366 reduce(lambda x,y:x+y,[chr(ord(x)^42) for x in 'zS^BED\nX_FOY\x0b'])

2 1

Fwd: RE: [Zope] import error - No module named iclass
by Júlio Silva 19 Nov '02

19 Nov '02

>> > >I'm upgrading to zope 2.6.0. >> > >When I try to import a ZClass based Product from zope 2.5.1 >> > i get the >> > >following error. >> > > >> > >Error Type: ImportError >> > >Error Value: No module named iclass >> >> > Yup. This was discussed about a week ago. Search the mailing >> > list archives; but as I remember, only the ZClasses descended >> > from ObjectManager have the problem, and then only if there >> > is a non-empty list on the SubObjects tab. To export from >> > 2.5.x, remove all from that list; then it will import fine >> > into 2.6. Then, I presume that you can recreate the list of >> > allowed subobjects, though I have not tried this. >> >>This worked fine. >>Thanks. > > >Hi, > >I'm having the same problem migrating a zclass from 2.5.1 to 2.6. >I've tryed the collector fix of ZClasses/ObjectManager.py and the >subobjects tab thing, but >that didnt solved my problem. > >My zclass has ZFolder as base class instead of ObjectManager: > >Base Classes: ZObject, ZFolder, CatalogAwareBase > >I'm looking at the ObjectManager.py to see if I can put it to work for my >zclass, but >I think in my case that doesnt make sense because my class dont have a >subobject tab... > >I'm looking into the zen of iclass... > >Any ideias? thanks. > >Regards, >Julio Silva I'm forwarding this mail to zope-dev because since this is related with 2.6.0 development changes against 2.5.1 maybe someone has other solutions, because the that is out there for ObjectManager doesnt solve my problem. Best Regards, Julio Silva --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.416 / Virus Database: 232 - Release Date: 11/6/2002

1 0

Securing login with SSL via RESPONSE?
by Serguei Chabanov 18 Nov '02

18 Nov '02

Hi, I have read all the various documents and howtos regarding setting zope with apache and SSL, and I set it up. I have two virtual servers, http and https, serving the same hierarchy of zope objects. I would llike to secure passwords by using SSL. It is suggested everywhere I read that the protection should be done with RewriteRule or similar, by filtering urls. For example, I use RewriteRule match like ^manage(.*) and another to see if the protocol is insecure to redirect such requests to the same URL, but over https. Else, I can use solutions like SSLAbsoluteURL to adjust behavior of absolute_url() This, however, seems unsatisfactory. RewriteRules or url base manipulation cannot guarantee that the site visitor would not run into a protected object. In this case, the server returns "Unauthorized" response, the browser pops up the basic http authorisation dialog and login/password travel in the open. Looking at the CookieCrumbler product, I realise that before anything gets published it "highjacks" the RESPONSE object and manipulates it, including removing "Unauthorized" and redirecting to a login form. I hope somebody has time to answer two questions: How legitimate would it be to do the same, but to make external redirect via https? I understand that this might mean a lot of nasty things, including being locked out of Zope, but this can be dealt with, for example, _emergency_user. Assume I make a hypothetical SSLRedirect product, modelled on CookieCrumbler. There is no reasonable way to keep them in the same folder and make sure that SSLRedirect gets to the REQUEST/RESPONSE before CookieCrumbler, correct? I.e. such SSLRedirect product would have to be in a subfolder relative to CookieCrumbler so that it gets traversed first. Thanks in advance, Regards, Serguei

2 1

Production System Specs
by Brian R Brinegar 18 Nov '02

18 Nov '02

Hello, Can anyone point me at some recommended setups for a ZEO cluster. I would like some or all of the following information: * Hardware Specs * Load Balancing * Caching Information (Apache / Squid Caches) Any information would be very helpful. Thanks, -Brian Brinegar

2 1

Re: [Zope-CMF] Creator info not properly cataloged
by Ivo van der Wijk 18 Nov '02

18 Nov '02

On Sat, Nov 16, 2002 at 11:52:12PM +0100, Ivo van der Wijk wrote: > On Sat, Nov 16, 2002 at 11:04:22PM +0100, Ivo van der Wijk wrote: > > On Sat, Nov 16, 2002 at 08:42:44PM +0100, Dieter Maurer wrote: > > > Ivo van der Wijk writes: > > > > After putting my locally developed CMF site online, I noticed that > > > > references to here/Creator were replaced with 'Anonymous User', while > > > > the object definately had a proper owner (and still has). > > > "Creator" is defined by means of "getOwner". > > > > > > The Owner of your documents is apparently wrong. > > > Check, what "owner_info" tells you for your objects. > > > > > > > It returns 'Anonymous user'. It does this, because Owned.getOwner() > > attempts to find the userfolder the user is defined in, but fails, > > because the location (relative to the physicalRoot) changed. > > > > this part of getOwner to be more specific: > > > > root=self.getPhysicalRoot() > > udb=root.unrestrictedTraverse(udb, None) > > if udb is None: > > user = SpecialUsers.nobody > > else: > > user = udb.getUserById(oid, None) > > > > > I boiled the issue down to a bug in Zope itself. Here's what happens: - Create a folder 'a' with acl_users, with user 'john' - have user john create an object 'b' in 'a' (/a/b), owned by him. - object b will have the following properties: owner_info(): 'userCanChangeOwnershipType': 1, 'id': 'john', 'explicit': 1, 'path': 'a/acl_users'} getOwner(): 'john' Note the path in owner_info: a/acl_users - this is the path of the userfolder the owner is defined in. - Now create a folder /elsewhere, *cut* (not copy) /a and paste it into /elsewhere. This will result in /elsewhere/a/b etc. - object b, now in /elsewhere/a/b will have the following properties: owner_info(): 'userCanChangeOwnershipType': 1, 'id': 'john', 'explicit': 1, 'path': 'a/acl_users'} getOwner(): 'Anonymous User' getOwner() will result the wrong Owner, unless semi-loss of ownership is expected behaviour in such cases. This is because 'path' hasn't been adjusted to the new location of the acl_users, it's no longer in /a/acl_users (that's why you had to 'cut'), but now in '/elsewhere/a'. And getOwner() (in Owned.py) explicitly resolves the userobject using this path. Does this qualify as a bug? Does anyone know a clean fix? (I've written some hacky code to fix the problem afterwards, but it would be way better to have this info updated directly after the move). Note that this problem especially occurs when exporting/importing a site with local users (such as a CMF site) from one server to another, and the relative location changes (which can be quite common when moving from a development machine to a virtual hosting environment) Cheers Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam, NL -=- T +31-20-4688336 F +31-20-4688337 Linux/Web/Zope/SQL/MMBase W http://www.amaze.nl E info(a)amaze.nl Network Solutions W http://vanderwijk.info E ivo(a)amaze.nl Consultancy PGP http://vanderwijk.info/pgp -=-

1 0

Suggestion - ZSQL methods should include name in error messages
by Skip Montanaro 16 Nov '02

16 Nov '02

I'm using Zope 2.5.1 (and can't upgrade for the time being). If this has been fixed in a later version, my apologies for the needless request. When a ZSQL method is called without a required input parameter, it generates an error like Missing input variable, group_id Since such methods might be called indirectly, it's not always obvious which ZSQL method was called or who called it. I would find it helpful if the error message included at least the name of the called method. Ideally, traceback information should be available as well. This particular message seems to be generated by something other than the usual error machinery. -- Skip Montanaro - skip(a)pobox.com http://www.mojam.com/ http://www.musi-cal.com/

1 0