November 2002 - Zope-Dev

access of non html documents
by General Info 13 Nov '02

13 Nov '02

i have the following situation. i want the users to be able to download non html documents if that document is refered to from an html document. however, i dont want the users to be able to type the url and document name on the url box of their browers and be able to download it. for example: the documents exist in http://www.wwwdotcom.com/nonhtmldocs/doc1.pdf however, i dont want the users to type that url on their browser and access doc1.pdf i only want them to access it if that particular document is linked from an html document. i have seen some websites that do that w/ images. how can i do that on zope? is it possible? i would appreciate any comments/suggesstions. -roberto

3 2

ZODB 3.2 release plan posted
by Jeremy Hylton 12 Nov '02

12 Nov '02

I have posted a tenative release plan for ZODB 3.2 in the ZODB Wiki at http://www.zope.org/Wikis/ZODB/ZODB%203.2%20Release There are a small set of proposed features centering around better configuration and management of ZEO and ZODB. Feedback is welcome. Jeremy

6 7

Proposed Additional reStructuredText Deliverables
by Jeffrey P Shell 12 Nov '02

12 Nov '02

With Andreas plugging away at reStructuredText Integration into Zope, I'm thinking of some extra deliverables. I'm not sure how deep we want to put ReST support in at the moment, considering that while the spec is pretty solid the codebase is still a moving target, but I would like to add and help work on the following proposed deliverables to the project: 1. reStructuredText support in the Zope Help System. 2. reStructuredText support for Product README handling. 3. Ensuring that Page Templates and Python Scripts can access the reStructuredText.HTML() function. #1 looks like it would require adding a ReSTHelpTopic class in the HelpSys package which could probably mimic (or even sublass) the HelpSys.HelpTopic.STXTopic class. Then support would have to be added into ``ProductContext.registerHelp()`` to map certain file suffixes to the ReSTHelpTopic ('.rst', etc). #2 could probably be handled the same way (look for a 'README.rst' file), but may be served better if the contents of the README.txt could be introspected enough to detect format. :\ #3 is easy, I just want to make sure it's not forgotten. We just have to decide the right one way to do it: expose it in 'Products.PythonScripts.standard' where all of the other DTML formatters are exposed, or out of its own namespace (ie: tal:content="structure python:modules['reStructuredText'].HTML(foo)"). Or both ways. -- Jeffrey P Shell jeffrey(a)cuemedia.com

2 2

user roles & authentication
by Grant K Rauscher 11 Nov '02

11 Nov '02

recently I noticed that methods for retrieving user roles are affected by the URL from which the user logged in using basic authentication (as opposed to the location of the user account). I don't see any authentication-related cookies at all from ZOPE, session or otherwise, just basic http authorization. the problem is this: if one authenticates at a location deeper than their user account, authorization should apply up to the level of the account. it does - any method requiring authorization is allowed to run between the point of login and the user account - but when I test with *any* of these routines between the point of login and the user account it shows only 'Anonymous' - not the expected roles. user.getRoles() _.SecurityGetUser().getRoles() user.has_role( roleName ) visiting /manage or any other objects which require authorization works between the user account and the point of login - in fact, after rendering an object which would prompt for authorization if the only role were *really* Anonymous the roles for that object and ones it contains are fixed and show the expected results with getRoles() and has_role(). this problem occurred with ZOPE 2.5.0 or 2.5.1, and IE 5.5 or NN 7.0 Grant K Rauscher GeeKieR Enterprises http://www.geekier.com/

3 3

What catalog/index to use ...
by Joachim Werner 10 Nov '02

10 Nov '02

Hi! Currently there are at least three options for doing full text indexing with ZCatalog: - good old TextIndex - ZCTextIndex - TextIndexNG TextIndex basically works fine for me and handles German umlauts well (if you use the right locale settings in the Zope start skript), but ZCTextIndex is generally better, except that it does not handle umlauts correctly as far as I can see. So without a bug fix ZCTextIndex is good for US, but not for us ;-) Then there is Andreas Jung's TextIndexNG, which seems to be really impressive. What are the plans for Zope 2.6.x/2.7? Will ZCTextIndex be replaced by TextIndexNG? Does it make sense to get ZCTextIndex fixed (there seems to be a patch in the collector already) or should I go with TextIndexNG? If yes, is it ready for production environments? Cheers Joachim _________________________ Joachim Werner iuveno AG Wittelsbacherstraße 23b 90475 Nürnberg Tel. +49 (0) 911 / 988398-4 Fax +49 (0) 911 / 988398-5 Mail: joachim.werner(a)iuveno.de WWW: http://www.iuveno.de

6 16

Simplifying the zdaemon package
by Guido van Rossum 09 Nov '02

09 Nov '02

The zdaemon package contains a bunch of dead wood, or "decoys", as Jim would call it, that I'd like to remove. AFAICT, Heartbeat.py is not used anywhere. At least not in the Zope sources -- maybe there are outside users??? And ZDaemonLogging.py is a very thin layer on top of zLOG -- can I get rid of it too? The SignalHandler.py class is not used by zdaemon itself; perhaps it can be moved into the Signals package? --Guido van Rossum (home page: http://www.python.org/~guido/)

2 3

Unit tests for Zope products: how to test HTTP access to objects in ZODB?
by Craeg K Strong 08 Nov '02

08 Nov '02

Hello: I am trying to add some unit tests for my XMLTransform product that test URL to Zope object traversal. For example, I want to ensure that one XSLT (a zope object) can include another using <xsl:include "../foo.xsl"/> Zope should transform the above into a request for a zope object with an ID of "foo.xsl" in the parent folder of the original XSLT. My question: how have you, dear reader, tested Zope's mapping of URLs (relative and/or absolute) to objects in ZODB? I am hoping that it can be done, possibly at the cost of bringing in additional Zope machinery (which means additional unit test startup time)...? Thanks in advance, --Craeg

2 1

ZEO 2.0 testConnection() takes 30 seconds (MountedStorage)
by Brad Clements 08 Nov '02

08 Nov '02

I'm using mounted storage.. Whenever my Zope server restarts, it takes 30 seconds after the first web hit before it's really up and running because testConnection() is called by "somebody". 1. Why does testConnection() take 30 seconds to run, or is it something else? 2. Why is testConnection() being called at all, since there is only one server so there's nothing to fall back to? Anyone have any ideas where to look for more clues? Maybe it's not testConnection.. 2002-11-08T13:57:27 INFO(0) ZODB Opening database for mounting: "{'host':'localhost','port':'4400','storage':'Common',}" ------ 2002-11-08T13:57:27 INFO(0) ZCS:4080 ClientStorage (pid=4111) created RW/normal for storage: 'Common' ------ 2002-11-08T13:57:27 INFO(0) ZEC ClientCache: storage='Common', size=20971520; file[0]='/home/bkc/Zope/Manage/var/cCommon-Common-4400-0.zec' ------ 2002-11-08T13:57:27 INFO(0) ZCS:4080 Testing connection <ManagedConnection ('127.0.0.1', 4400)> ------ 2002-11-08T13:57:57 INFO(0) ZCS:4080 Connected to storage ------ 2002-11-08T13:57:57 INFO(0) ZEC read_index: cache file 0 has 122 records and 386963 bytes ------ 2002-11-08T13:57:57 INFO(0) ZODB Mounted database "{'host':'localhost','port':'4400','storage':'Common',}" at Managers/Common Exception exceptions.AttributeError: "Connection instance has no attribute '_Connection__connection'" in <method Connection.close of Connection instance at 0x8bea73c> ignored Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax AOL-IM: BKClements

1 0

User Module
by Karthikeyan 08 Nov '02

08 Nov '02

Hi All, I am pretty new to zope. I have been asked to implement a project done by me in zope. I had user modules, group modules and some content management in my project(php). Now i need to do all in zope, which i not aware of. Please tell me what to do and where to start. PLease give me code for user module if possible. I should be able to create users and they should login thru the login page to enter the site and view the contents. I am running out of time to give my first module. Please help me out. Thanks S.Karthikeyan

4 4

RE: [Zope-dev] Re: Unsecure design of ExternalFile
by sean.upton＠uniontrib.com 07 Nov '02

07 Nov '02

I'm not familiar with ExternalFile, but likely plan to use it in the future. I think a list of expressly permitted directory locations (including all subdirectories) might be more secure. You can't go wrong with a default directory for files (perhaps $INSTANCE_HOME/var/files or something?), but otherwise an implicit deny all - then leave it up to the user to edit some access list file in the product (for example, call it 'diraccess.txt'). Does this seem reasonable? Sean -----Original Message----- From: Craeg K Strong [mailto:cstrong@arielpartners.com] Sent: Thursday, November 07, 2002 8:25 AM To: Jonagustine Lim Cc: support(a)arielpartners.com; zope-dev(a)zope.org Subject: [Zope-dev] Re: Unsecure design of ExternalFile Yikes! Scary stuff. However, here are some things to consider: a) ExternalFile advertises itself as being a developers/ content authors tool, not really for production. Of course, most folks end up using it for production, anyway... ;-) b) Once created, an ExternalFile cannot be retargetted to point to another file in the file system c) The permission to create an ExternalFile instance is different than the permission to edit one. The permission to create an ExternalFile instance should be assigned judiciously... d) the Zope server should be run as a user that has very limited permissions. e) Even if a user *does* have permission to edit an ExternalFile, they only have whatever permission the user running the Zope server has. If the Zope user (usually "webserver" or something like that) does not have permission to write to /etc/passwd, it doesn't matter if you create an ExternalFile pointing to it, you still can't write to it... However, the points you raise are valid, as they are Zope-specific, and the zope user "webserver" *would* probably have permission to do your (1) and (2) examples. What would you recommend? Perhaps there should be a predefined list of "forbidden" directories for ExternalFiles? The problem is that-- in the development scenario-- the very things you mention below might be what you legitimately *want* to do as a developer. Well, thanks for pointing this out. Let's continue the conversation a bit, perhaps a good solution will reveal itself (even if it is only some kind of warning in the documentation...) Regards, --Craeg PS I am CC-ing the zope-dev mailing list, as I think this warrants a wider audience Jonagustine Lim wrote: > Hi! > > I just noticed that it's possible to create or replace > any files in the filesystem using the ZMI with > ExternalFile installed. > > Possible exploits: > > 1. Use ExternalFile web interface to replace Zope > Data.fs > > 2. Create a .py file in /Zope/Extensions and run it by > creating an Extenal Method. > > Anyway, I hope you can fix this or put a warning up. > > Jon > _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

2 1