March 2002 - Zope-Dev

WebDAV quibble -- fix in 2.6?
by Casey Duncan 06 Mar '02

06 Mar '02

This maybe more 2.6 (or even 2.5.1 final) fodder: I notice that in a vanilla Zope install, Anonymous users are allowed access through WebDAV. This is bad for two reasons: 1. From a security perspective this discloses way too much information about your site to the outside world. 2. Due to vagarities of WebDAV authentication, it makes it impossible to edit anything, because I guess the WebDAV implementation is too stupid to force a login when you try to lock something as anonymous (instead is returns a 500 server error). To get around this you have to create or copy an object to force a login. This problem disappears if everyone must login to access WebDAV at all. So the question is: Is there a good reason why WebDAV access is granted to anonymous by default? If not I vote we change it. /---------------------------------------------------\ Casey Duncan, Sr. Web Developer National Legal Aid and Defender Association c.duncan(a)nlada.org \---------------------------------------------------/

3 2

two hard questions
by Tim McLaughlin 06 Mar '02

06 Mar '02

Firstly, I'm trying to return a lazy list to a dtml-in, but it seems that the __getitems__ are all called up front.... This is the class and the print statement shows up in debugging before any debugging output from within the dtml-in: class LazyList: def __init__(self, root, selections): self._root = root self._selections = selections def __getitem__(self, index): s = self._selections[index] print s.getPath() ##### this is executed for all items before anythingwithin the dtml-in o = self._root.restrictedTraverse(s.getPath()) o.setSelection(s) return o def __len__(self): return len(self._selections) Does this mean that dmtl-in touches all of the objects first for some reason? Or am I missing something? Second hard ?..... Is there any way to wrap a Folder subclassed instance within another class so that I can override some methods on an instance by instance basis? I tried doing a .__class__ replacement, but for whatever reason, Zope machinery seems to keep it from taking effect. Any ideas? I've tried about 5 different approaches to no avail :( Sincerely, Tim McLaughlin -- Tim McLaughlin Iteration ZERO, Inc. - www.iterationzero.com 703.481.3983

2 2

Zope 2.5.1b1 and Python 2.1 with LDAP
by Stefano Noferi 06 Mar '02

06 Mar '02

Hi, running Zope 2.5.1b1 and Python 2.1.2 with CMF 1.1, LDAPUserFolder 1.1, CMFLDAP 1.2, CoreSessionTracking 0.9, DCWorkflow 0.4.1, CMFOptions 1.11, PIL 1.1.2, MySQL-python-0.9.0, python-ldap-1.10alpha3 (compiled with libldap 1.0.0 and liblber 1.0.0) on Linux Trustix 1.5 distribution, Zope crash and auto-restart randomly while a cmf member o reviewer use cmf services. ------------ Zope Version (Zope 2.5.1b1 (source release, python 2.1, linux2), python 2.1.2, linux2) Python Version 2.1.2 (#1, Mar 5 2002, 14:39:29) [GCC 2.95.3 20010315 (release)] System Platform linux2 ------------ All packages compiled from sources. Anyone help me? Thanks, Stefano ---------------------------------------------------------- Stefano Noferi n o z e S.r.l. Soluzioni Open-Source Via Caduti del Lavoro, 32 56122 Pisa (PI) - Italy Tel: +39 (0)50 533320 Fax: +39 (0)50 526604 Email: stefano(a)noze.it Web: http://www.noze.it ----------------------------------------------------------

1 0

Re: [Zope-dev] sqlvar and longs
by Andre Schubert 06 Mar '02

06 Mar '02

>Hmmm ... i have been a bit to fast. >I wrapped my had around this, and found that long is >handled through the int, by simply stripping the "L" >of it (pythons string representation of long is 214321L ...) >so it get passed as a valid long string. > >sorry for mixing things up ... Right, but works only if the string-representation is not greater than the max-value of an integer. The following does not work for me. <dtml-let longnumber="2400000000L"> update tbl_test set adresse = <dtml-sqlvar longnumber type="int"> </dtml-let> Greetings -- Andre Schubert EMail: Andre.Schubert(a)km3.de Tel: 03774 6625-78 km3 teledienst GmbH Fax: 03774 6625-79

2 2

Zope process working directory
by Toby Dickenson 06 Mar '02

06 Mar '02

Ive recently noticed that Zope doesnt change its working directory when it starts up. This has been a minor inconvenience for me recently when I wanted to get a core dump from a long-running Zope, but its working directory was set for somewhere that it couldnt write. I know I could fix this in all of my start scripts, but I think it would be much nicer if Zope always changed its working directory to var on startup (except if the debug flag is set I suppose). This would be in keeping with the tradition for Unix daemons and Windows services. Any thoughts? Toby Dickenson tdickenson(a)geminidataloggers.com

1 0

sqlvar and longs
by Andre Schubert 06 Mar '02

06 Mar '02

Hi all, I have a little question on <dtml-sqlvar ...>. My problem is, that i want to insert values into a table and the type of the values are integer8. I tried with <dtml-sqlvar foo type="long"> but it doesnt work. How can i use <dtml-sqlvar> with longs? Will this feature be added in further versions? Is there a product which patches this problem? If not i would write such a thing myself. Regards -- Andre Schubert EMail: Andre.Schubert(a)km3.de Tel: 03774 6625-78 km3 teledienst GmbH Fax: 03774 6625-79

2 2

Re: [Zope-dev] Zope 2.4.4b1 and Python 2.1.2 crash again
by Anthony Baxter 06 Mar '02

06 Mar '02

>>> Nicola Larosa wrote > you should read the Stability Howto: > > http://www.zope.org/Members/matt/StabilityHOWTO This docco doesn't clearly state that you MUST recompile your pythonscripts when upgrading to 2.4.4+ (when do we see a real 2.4.4, anyway?) Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never to late to have a happy childhood.

2 1

Re: [Zope-dev] Zope 2.6 planning - call for contributors!
by Anthony Baxter 05 Mar '02

05 Mar '02

>>> seb bacon wrote > > [CallProfiler] > FWIW, my own opinion is that it should not take the 'MonkeyPatch' > approach. Why? Any other approach means a slowdown in the Zope code regardless of whether profiling is turned on or off... monkeypatching means you end up with zero slowdown when not profiling. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never to late to have a happy childhood.

10 20

Squid Proxy VS LVS+Apache+ZEO
by Eric Roby 05 Mar '02

05 Mar '02

I apologize (in advance) if this is on the wrong list but some of the previous discussions regarding these topics have been done here. I have read much of the documentation on Squid, the zope.org cluster configuration, and many of the excellent How-To's out there. However, my particular case requires ssl for authentication to the ZMI. It appears that ssl is best accomplished with Squid, however we have to be able to provide many of the services that the zope.org cluster leverages with LVS. It appears that the Apache+mod_proxy+ZEO configuration provides much of the functionality that Squid+ZServer would provide, alone. I guess my biggest problem is determining whether it makes sense to use Squid in conjunction with ZEO (which we want to pursue) or re-build Apache with mod_ssl in the LVS+Apache+mod_proxy+ZEO setup?? If any one has been down this road I would greatly appreciate any insight that you might have. Thanks in advance... Eric

1 0

Re: [Zope-dev] MonkeyPatching in the Core (was: Zope 2.6 planning)
by Anthony Baxter 05 Mar '02

05 Mar '02

>>> "Brian Lloyd" wrote > What if, instead of the static list of callable info that the CP > currently uses, Zope objects could register themselves as profilable? > We would then make sure that the object types that CP handles now > register themselves, but other products that we don't know (or > have to know) about could register themselves too if they wanted. This would resolve the problems, yes. It's a nice approach to take, and it also allows the object to register a different method to be patched. > Think of this as "consentual" monkey-patching (hmm... may have to > change this metaphor soon!). Call it "gorilla-patching" - it's like monkey-patching.[1] > The products have to take some explicit > action to be profilable, so it is not invisible in the code of the > product. The hooks will continue to installed as-needed, so there > is no performance issue. This would suggest that the CallProfiler shouldn't be an add-on product, then, but installed in lib/python ? What's the best approach there? Rich didn't get any response on zope-coders about this... Anthony [1] Seagoon: Here! Have a gorilla. Eccles: Oh! Thanks. Grams: [Two gorillas fighting, or if you can't get that, lions.] Eccles: Oww! Oww! Ooh! Oww! Hey! These gorillas are strong. Here! Have one of my monkeys -- they're milder. -- http://www.residents.com/Goons/napoleon.piano.html -- Anthony Baxter <anthony(a)interlink.com.au> It's never to late to have a happy childhood. Seagoon: Here! Have a gorilla. Eccles: Oh! Thanks. Grams: [Two gorillas fighting, or if you can't get that, lions.] Eccles: Oww! Oww! Ooh! Oww! Hey! These gorillas are strong. Here! Have one of my monkeys -- they're milder.

2 1