April 2002 - Zope-Dev

Re: Tyring to FTP to Zope running behind firewall,
by Jason Spisak 24 Apr '02

24 Apr '02

I'll try to get the KDE ftp ioslave to do PASV. We'll see. Otherwise WebDAV seems to be a rather neat way of visually going about things. Thanks for all the help Zopistas! On Wednesday 24 April 2002 7:42 am, you wrote: > Make sure you're using FTP in passive mode .. > > Active FTP vs. Passive FTP, a Definitive Explanation > http://www.slacksite.com/other/ftp.html -- Jason Spisak Marketing Director, Lycoris jspisak(a)lycoris.com, http://www.lycoris.com Desktop/LX: Familiar. Powerful. Open.

1 0

SOAP and Zope
by Tim Hoffman 24 Apr '02

24 Apr '02

Hi All I need to start investigating the use of Zope as a SOAP server. I am not looking for magic as in Zopes current XML-RPC behaviour but more along the lines of a SOAP proxy to a specific piece of code that I would write in the zope environment. I like the approach as outlined in http://www.zope.org/Wikis/DevSite/Proposals/WebServicesForZope, but this doesn't seem to have had any activity since august. My main issue is a clear lack of understanding on my part as to how to integrate one of the SOAP libraries (ie SOAPy) or others into ZServer, and then give it access to various Zope objects. I have check the WebServices in cvs.zope.org, but it appears to me that it is a standalone implementation. Has anyone tackled this yet. Rgds Tim

3 2

Speaking of 2.6...
by Brian Lloyd 24 Apr '02

24 Apr '02

...I sent out a note a while ago now trying to scare up some ideas on how to vet the current list of 2.6 proposals and get to a final "plan". I didn't get much (any?) response :( For a couple of things that were ready to go and fairly non controversial (like Toby's unicode work), I put on the BDFL hat and said "merge it!". But there are still a lot of things on the proposed features that are undone, and some that are controversial enough that we need to get to closure on them. I'll volunteer to convert the current proposed feature list into a draft "plan", where the conversion boils down to adding some columns to the table: Proposal - name and link to the proposal Resources - who is working on it Committed - Y/N whether the volunteers have committed to have the implementation and docs done by the first week in June. I'll fill in what I know has been committed to, people can update this (or let me know and I'll do it), and anything that doesn't get a 'Y' in a reasonably short time will be put in the cooler. Vetted - Y / N whether the community and / or the relevant BDFLs have come to some agreement on whether it *should* be done. The list of items without a 'Y' will be our next order of business. Getting to closure on those either via the list, IRC, or whatever is the main block on the critical path. Status - Complete or incomplete I've taken a first stab at this. I've set the "committed" to 'Y' for those things that I know I've gotten commitments for. For those set to 'N', please let me know if you can commit to the date (or change it yourself in the wiki). The updated plan is at: http://dev.zope.org/Wikis/DevSite/Projects/Zope2.6/ProposedFeatures Once we get the commitments up to date, we can start wrangling with the vetting... Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

21 47

Tyring to FTP to Zope running behind firewall, get login box but no directory listing
by Jason Spisak 24 Apr '02

24 Apr '02

It would appear that their FTP implementation is not working correctly, when connecting to a Zope FTP system behind a firewall. Zope is running on port 8880 and ftp service works fine from inside the firewall on port 8821. From outside the firewall, I get a login prompt, enter my password, but then the directory listing never materializes. Since I get the login prompt, it's not a firewall packet issue. Is this a known issue? If anyone knows of any quick fixes for this, I'm wide open for ideas. -- Jason Spisak Marketing Director, Lycoris jspisak(a)lycoris.com, http://www.lycoris.com Desktop/LX: Familiar. Powerful. Open.

3 3

Re: [Zope-dev] Tyring to FTP to Zope running behind firewall, get login box but no directory listing
by Anthony Baxter 24 Apr '02

24 Apr '02

> > Do not be so quick to conclude that. FTP *has* firewall problems. since > I know nothing of the firewall, I can not help in too much detail. ftp connections, by default, go from the ftp server->client for the data connections. the data is carried by a seperate channel, on a randomly numbered port. I'd say it's almost _certainly_ a firewall issue. -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

Wholesale Online Freight Calculator
by service＠freight-calculator.com 23 Apr '02

23 Apr '02

To better facilitate pricing we have developed online calculators for a variety of services. Freight-Calculator.Com has developed this unique pricing method FREE from SALES COMMISSIONS. 1. Wholesale Door to Door Air at Wholesale RATES http://www.freight-calculator.com/wholeicr.asp 2. Small LCL Ocean Shipments From USA to Worldwide Ports http://www.freight-calculator.com/worldocr.asp 3. Small LCL Ocean Shipment to Hawaii and Asia http://www.freight-calculator.com/dhx/dhxocr_select.asp 4. Small LCL Ocean Shipments From ASIA to USA http://www.freight-calculator.com/ocean-asia/oceanasia.asp 5. Small LCL Ocean Shipments Fom EUROPE to USA http://www.apx-air-cargo.com/netherlands.htm 6. 20 & 40 Foot FCL Ocean Containers From USA http://www.freight-calculator.com/apxocean.asp 7. Air Cargo to Latin America from MIAMI HUB http://www.freight-calculator.com/acrlatacarr.asp 8. Air Cargo From West Coast USA http://www.freight-calculator.com/california-air/ca.asp 9. Air Cargo From London to Worldwide http://www.freight-calculator.com/uk-air/uk_select.asp Our Shipping Documents are located at http://www.apx-air-cargo.com/airwaybill.html The only instant online calculators in the world for air and ocean cargo. Regards, Andres Guerra-Mondragon Marketing Mgr. APX Air Parcel Express APX International NVOCC http://www.apx-air-cargo.com Member of the World Cargo Alliance Member of the Gold Medalion Group Member of Atlas Line NVOCC Member of All World Shipping NVOCC 866-597-0258 TOLL FREE TEL 866-597-0259 TOLL FREE FAX 305-597-0258 TEL USA 305-592-0266 FAX USA

1 0

Re: [Zope-dev] PHP vs Zope cost benefit
by Jason Spisak 23 Apr '02

23 Apr '02

Dirk, One more quick question about application/business logic in one place and layout in another. Looking at ZPT, I still see expressions and condition statements in the Templates themselves. That's not really separation, it's just making it work with HTML editing tools. I'm curious is anyone can explain the true separation of business logic and presentation a bit better that exists with Zope now. I've built quite a few DTML heavy apps, and that separation wasn't there. On Tuesday 23 April 2002 11:24 am, you wrote: > Hi Jason, > > what about a mix content-management-system and > application-server in one server: > -> Zope + EasyPublisher > > you have a special layout. realizing that in php means > editing php with html. > with zope you can make application logic here and layout > (presentation logic) there. > > you have lots of unique structured content: > you can seperate the database logic from html very simple > you have no limitations on the underlaying database engine, > just remove the db-connector and put a new one in. > > we currently plan out new intranet with zope. > had php content-management as an alternative, but we can't > give php to our users. > > question you should answer to your self: which users have to > work with your system in your company ? which user change > things in the system ? > > Jason Spisak schrieb: > > You might remember me, I've been a big Zope fan since > > ZTables, and have recently been asked "Why Zope?". The > > project is commited to PostgreSQL and leaning toward PHP. > > Here's the project requirements for a softwre company: > > > > Hardware Compatability List > > Software Compatability List > > Store/ECommerce > > User tracking and services like > > Pay for downloads > > Upgrades if they have a serial number paid up > > Billing/Invoicing for corporate accounts > > Inventory tracking > > CRM/Sales functions > > > > They don't see that Zope's built in security machinery > > would beat something home brewed for what they expect to > > need it for. Plus the over head of running Zope instances > > is greater than PHP scripts. > > > > What are the arguments for Zope in this context? > > > > All my best, > > > > -- > > Jason Spisak > > Marketing Director, Lycoris > > jspisak(a)lycoris.com, > > http://www.lycoris.com > > Desktop/LX: Familiar. Powerful. Open. > > +1 425 869-2930 voice, +1 425 671-0504 fax > > > > _______________________________________________ > > Zope-Dev maillist - Zope-Dev(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope-dev > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope ) -- Jason Spisak Marketing Director, Lycoris jspisak(a)lycoris.com, http://www.lycoris.com Desktop/LX: Familiar. Powerful. Open. +1 425 869-2930 voice, +1 425 671-0504 fax

1 0

Re: [Zope-dev] PHP vs Zope cost benefit
by Jason Spisak 23 Apr '02

23 Apr '02

Dirk, Thanks for that. By 'separation' I'm assuming you mean ZPT, correct? I'm new to that, but the virtues seem to be simple edit and save for layout folks. With PHP, you can create forms to publish content. You don't have to give content mamagers PHP. Zope's a win for Designers, for sure. Right now the designers are the coders, so that's more like an 'eventual' win. The database logic can be separated with PHP by just creating some php 'backend stuff' and calling those database functions you've created from the 'presentation' scripts. Just like calling a ZSQL method from a DTML method. As long as you kept the exposed calls the same, you could change Databases. It probably wouldn't be as easy to step to Oracle if they wanted to. You are right about that! ;-) On Tuesday 23 April 2002 11:24 am, you wrote: > Hi Jason, > > what about a mix content-management-system and > application-server in one server: > -> Zope + EasyPublisher > > you have a special layout. realizing that in php means > editing php with html. > with zope you can make application logic here and layout > (presentation logic) there. > > you have lots of unique structured content: > you can seperate the database logic from html very simple > you have no limitations on the underlaying database engine, > just remove the db-connector and put a new one in. > > we currently plan out new intranet with zope. > had php content-management as an alternative, but we can't > give php to our users. > > question you should answer to your self: which users have to > work with your system in your company ? which user change > things in the system ? > > Jason Spisak schrieb: > > You might remember me, I've been a big Zope fan since > > ZTables, and have recently been asked "Why Zope?". The > > project is commited to PostgreSQL and leaning toward PHP. > > Here's the project requirements for a softwre company: > > > > Hardware Compatability List > > Software Compatability List > > Store/ECommerce > > User tracking and services like > > Pay for downloads > > Upgrades if they have a serial number paid up > > Billing/Invoicing for corporate accounts > > Inventory tracking > > CRM/Sales functions > > > > They don't see that Zope's built in security machinery > > would beat something home brewed for what they expect to > > need it for. Plus the over head of running Zope instances > > is greater than PHP scripts. > > > > What are the arguments for Zope in this context? > > > > All my best, > > > > -- > > Jason Spisak > > Marketing Director, Lycoris > > jspisak(a)lycoris.com, > > http://www.lycoris.com > > Desktop/LX: Familiar. Powerful. Open. > > +1 425 869-2930 voice, +1 425 671-0504 fax > > > > _______________________________________________ > > Zope-Dev maillist - Zope-Dev(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope-dev > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope ) -- Jason Spisak Marketing Director, Lycoris jspisak(a)lycoris.com, http://www.lycoris.com Desktop/LX: Familiar. Powerful. Open. +1 425 869-2930 voice, +1 425 671-0504 fax

1 0

Is there a Security problem with cookie authentication?
by Richard Barrett 23 Apr '02

23 Apr '02

Someone out there might like to sanity check my thinking on a possible security hole that arises if some form of cookie authentication, the CookieCrumbler for instance, is used with Zope. The scenario of concern is when cookie authentication is being used and Zope is accessed by a browser via a caching HTTP proxy server such as Squid, hardly an uncommon situation these days. I believe that transparent proxy servers are quite extensively used at the internet access points of ISPs. As the Squid FAQ says: <quote> The presence of Cookies headers in requests does not affect whether or not an HTTP reply can be cached. Similarly, the presence of Set-Cookie headers in replies does not affect whether the reply can be cached. </quote> It appears to me that if the Zope server fails to add a Cache-Control header with a value of private, no-cache or no-store to its responses, a caching proxy server is free to cache the response to an HTTP request. Hence the proxy server can again serve the response, purportedly protected by cookie based authentication, to any other requesting client WITHOUT consulting the Zope server. I could not identify any code in the CookieCrumbler to add a Cache-Control header with a value of private, no-cache or no-store to Zope responses. This problem should not occur when Zope uses the regular Basic Authentication scheme as per RFC2616: <quote> Note that section 14.8 normally prevents a shared cache from saving and returning a response to a previous request if that request included an Authorization header. </quote> Unless someone can refute this scenario (please, please do) then it appears to me that Cache-Control headers need to be added to all responses conditional on authentication by Zope using cookie authentication. Maybe Zope should just add a Cache-Control header with a value of private, no-cache or no-store to all responses that its security sub-system determines are to other than the Anonymous user. It would do no harm if Basic Authentication were being used and would plug the security hole I have posited if cookie authentication were in use. I'd propose a patch myself but I am not that confident in hacking around Zope's security management code.

2 1

how bad are per-request-write-transactions
by Ivo van der Wijk 22 Apr '02

22 Apr '02

Hi, How bad are per-request transactions in a non-ZEO environment? I.e. each request on a folder or its subobjects will cause a write transaction (somewhat like a non-fs counter, but worse as it happens for all subobjects) And if this is really bad, are there any workarounds except for writing to the filesystem? Cheers Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam, NL -=- Tel: +31-20-4688336 Linux/Web/Zope/SQL/MMBase Fax: +31-20-4688337 Network Solutions Web: http://www.amaze.nl/ Consultancy Email: ivo(a)amaze.nl -=-

14 30