December 2002 - Zope-Dev

Permissions Mapping Screen
by Brian R Brinegar 03 Dec '02

03 Dec '02

Is there any reason that the acquired permission mapping cannot be displayed next to the check boxes on the Permission mapping screen? For example if I have "Access User Information" checked in the root of a site for Anonymous and I view the Security tab for a folder one level down I would like to see a check symbol to the right of the Anonymous/Access User Information check box. This seems like it would be very very useful. -Brian

1 0

information disclosure vulnerability
by Jerome Alet 03 Dec '02

03 Dec '02

Hi, probably the HelpSys object shouldn't be available by default to non-authenticated users, because it gives too much information on the currently installed products. access any Zope site this way : http://your.zope.site/HelpSys and you'll learn what products are available on the server. This can't lead to a direct compromise, but this gives way too much information to anonymous users IMHO. Tested today on several low and very high profile sites. bye, Jerome Alet

3 2

Bugfix release?
by seb bacon 02 Dec '02

02 Dec '02

The DateTime bug in 2.6.0 breaks all of my sites. This must be true for very many other people. If we collectively want use of Zope to multiply 10x, I don't think it's a great idea to let a major bug like that stay in the latest-and-greatest release. Can we have a bugfix release? seb ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

16 25

Re: wrapping unexistent objects
by Maurizio Boriani 02 Dec '02

02 Dec '02

>>>>> "Casey" == Casey <zope-dev(a)zope.org> writes: Casey> If you want an object to be able to handle calls to undefined methods, Casey> you'll=20 probably need to use a __getattr__ hook. They can be a Casey> little tricky to get20 right (you want to filter out names that start Casey> with "_" or "aq" or else=20 you'll be in trouble), and they don't have Casey> access to acquisition, but they=20 Casey> will allow you to intercept calls to arbitrary names on an object. Casey> __bobo_traverse__ and __before_publishing_traverse__ are hooks for Casey> URL traversal inside ZPublisher. They won't work for calls made Casey> inside DTML. Thanks very much! Have you also some docs to point me to? Or a dummy example? Thanks anymore, baux

1 0

What do I get from 'cvs co Zope'?
by Stefan H. Holek 02 Dec '02

02 Dec '02

It appears that when I currently do 'cvs co Zope' I get a version that already requires Python 2.2.2. GvR's zdctl.py stuff uses lambdas in a way that Python 2.1 does not grok. How can I get at a Python 2.1.3 post 2.6.0 checkout? Thanks, Stefan -- Those who write software only for pay should go hurt some other field. /Erik Naggum/

3 2

ZSyncher and xml-rpc via firewalls
by Dylan Jay 02 Dec '02

02 Dec '02

I was needing to use ZSyncher via a proxy server in our firewall. I wrote a new transport to do this that you might want to incorporate into ZSyncher. Nice product btw. Very helpful for my setup. Any chance of getting it to synch bidirectionally? import urllib class AuthProxyTransport(xmlrpclib.Transport): '''Handles an HTTP transaction to an XML-RPC server via a http proxy and using basic authentication djay(a)slarken.org.au ''' def __init__(self, username=None, password=None): self.username = username self.password = password self.verbose = None self.has_ssl = 0 self.proxies = urllib.getproxies() def request(self, host, handler, request_body, verbose=0): # issue XML-RPC request import httplib # Override to use proxies realhost = None if self.proxies.has_key("http"): realhost = host proxy = self.proxies["http"] urltype, proxyhost = urllib.splittype(proxy) host, selector = urllib.splithost(proxyhost) h = httplib.HTTP(host) if realhost: h.putrequest("POST", "http://" + realhost + handler) else: h.putrequest("POST", handler) # required by HTTP/1.1 if realhost: h.putheader("Host", realhost) else: h.putheader("Host", host) # required by XML-RPC h.putheader("User-Agent", self.user_agent) h.putheader("Content-Type", "text/xml") h.putheader("Content-Length", str(len(request_body))) #Override to do authentication (should really use username and password encoded in url like urllib) if self.username is not None and self.password is not None: h.putheader("AUTHORIZATION", "Basic %s" % string.replace( encodestring("%s:%s" % (self.username, self.password)), "\012", "")) h.endheaders() if request_body: h.send(request_body) errcode, errmsg, headers = h.getreply() if errcode != 200: raise xmlrpclib.ProtocolError( host + handler, errcode, errmsg, headers ) return self.parse_response(h.getfile())

1 0