October 2003 - Zope-Dev

Post-Traversal Hook (+Post-Publication Hook)
by Christian Theune 17 Oct '03

17 Oct '03

Hi, I'm cleaning up the alternative BaseRequest for Zope 2.7 right now which implements a post traversal hook (which will go into 2.8) and discovered a small issue I would like to get some feedback from. Originally the patch called all registered methods after the user has been determined, but before eventually unauthorized is thrown. Therefore the SecurityManager already could deliver the user object, but it is not available within the REQUEST as the well known "AUTHENTICATED_USER". Anyway, does anybody see a special reason to call the hooks a) before unauthorized b) after complete successful authorization I see that there could be two hooks make sense in there, but can't decide for a single one. (My tummy tells me to go for the one after complete authentication, so we have the complete REQUEST environment as in opposition to site access rules.) Also Dario Lopez-Kaesten came up with a request for a hook that is called after the publication. Is there anybody objecting such a "post publication hook"? Otherwise I would go for - implementing post-traversal variant b - implementing a post-publication hook Cheers, Christian PS: Looks a bit like I should write a proposal on this ...? -- Christian Theune, gocept gmbh & co. kg http://www.gocept.com - ct(a)gocept.com fon: 03496 3099112 fax: 03496 3099118 mobile: 0179 7808366

3 4

Zope Financials
by alan 16 Oct '03

16 Oct '03

I know that you are all focused upon content management systems here at Zope/Plone - and with good reason. However, our community has a dearth of commercial products and Java offerings like Compere ERP, and JBOSS are stealing a march in this arena. I've made an initial attempt to redress this by applying the Zope architecture to a general ledger product, BastionLedger, and to an embryonic financials gateway, BastionBanking. I've seen a couple of other Zope products dealing with banking, and would like to somehow coordinate our efforts. This is a very serious initiative, and I've put almost a year's personal work and finance into this product and associated infrastructure. Now, I'd like to see some serious collaboration to get a fantastically fully featured ledger available for Zope clients. What I've delivered so far is quite good in terms of basic functionality and a rich toolkit from which to develop accountancy processes - but payroll systems for example have an abundance of nuances and exceptions and needs much more resource than I have available. In order to overwhelm the world with this stuff, I think we need to start very small. If YOU are a contracter - have your own business, or you've got a Plone site for a club or society, how about getting on board and helping to get the ledger to meet your financial requirements. The general ledger and order management/inventory control already support large-scale use. These products are available for comment and download at http://www.last-bastion.net/BastionLedger and http://www.last-bastion.net/BastionBanking. There is much more information there about exactly what they do and what my current thoughts on this initiative are. Please feel free to discuss them with me on or off this list, or on their own lists. I look forward to some interest. Alan

1 0

Zope, WebDAV, UTF-8 and litmus
by Lennart Regebro 16 Oct '03

16 Oct '03

I've been fiddling around with Zope and WebDAV and have some questions. 1. UTF-8 support. WebDAV requires UTF-8 support. I've been using "Litmus" (http://www.webdav.org/neon/litmus/) to test the Zope access, and by default it doesn't accept UTF-8 names. How does people for example in China and Japan deal with this? I have bypassed this by making a special version of _checkId() that accepts them, but maybe there is another way? If not, I think there should be a way. 2. Other Litmus testing. Of course there are several other failures, besides the UTF-8 support. Has anybody else looked into this, and done anything on it? I could probably spend some bug day time on it, but I don't want to run into the same walls as others already have, if I can avoid it. :)

1 0

WebDAV and UTF-8 filenames
by Lennart Regebro 15 Oct '03

15 Oct '03

Hi guys! I've been hacking around a bit with Zope to try to support some non-ascii characters in the id's. Yes, I know it looks ugly in the URL's but when you go via WebDAV, that is not an issue. :) Anyhow, getting your Zope-object to accept non-ascii characters is not that hard, of course. But the problem comes when you try to use OpenOffice, and do a "Save As...". It seems like OpenOffice sends the new name as UTF-8, translating a nice "filé.doc" to "filÃ©.doc". Of course, OpenOffice will translate it back, so it looks good in OpenOffice, but that the id is different from the webclient and OpenOffice is not a good idea. Could somebody help me shed some light on some issues here: 1. Does this happen because Zope missed out on UTF-8 decoding and encoding somewhere? It seems to me that this should be done in the ZPublisher somewhere, but it isn't, right? 2. I have tried understanding the ZPublisher before, but failed. Can somebody point me to where this decoding encoding should be done, maybe? Or are you of the opinion that it's to complicated a bug to fix? 3. Will Zope 2.7 be Python 2.3 only? Because that would probably make UTF-8 support easier. //Lennart

3 3

Very fast requests beating ZODB commits...
by Richard Jones 15 Oct '03

15 Oct '03

I'm seeing the following behaviour in Zope2.7b2 (python 2.3.2) on a relatively fast computer (Athlon 1.8GHz): 1. request comes in which modifies ZODB 2. code handling request replies with REQUEST.RESPONSE.redirect() 3. redirected page uses data input at step 1 (specifically, it's auth info) but that info hasn't been committed yet, so we get errors So I've modified the method at step #1 to get_transaction().commit() before doing the redirect(), but I'm usually a little concerned when I have to invoke the transaction machinery directly like this... Any thoughts? Is there some way to hold the redirect off until after the transaction is committed normally? Richard

3 3

possible compromise
by Chris Pelton 14 Oct '03

14 Oct '03

>>/ So, would anybody have any ideas how to determine if this might have />>/ been compromised? Or is there a known mail relay exploit through zope />>/ somehow? I've checked system binaries and everything seems fine. None of />>/ the python files seem to have been changed since well before the />>/ relaying started. / >It might help to know the version of zope which you may be able to find >it in the version.txt file distributed with zope releases. That said, >there hasn't been a known relay exploit to the best of my knowledge, >but there are many ways to implement a web application that sends mail >in zope, and it wouldn't be at all surprising if the implementation of >your system was vulnerable. >Do you know enough about Zope to discuss the implementation of your >web application? We can throw out a bazillion ideas but thats a >painfully slow way to determine what really happened. Unfortunately I don't know much about zope. There are several version.txt files in the tree - ./lib/python/version.txt - yields Zope 2.2.5 (source release, python 1.5.2, linux2) but there is also a Zope-2.3.3-src directory, although I don't find any binaries in there that match what look to be the running binaries. The thing is, this machine had sendmail configure for no-relay, but there were several virtual hosts in apache, and the mail was coming from one of those hosts. I'm thinking they could have just taken advantage of some Zope functionality, not necessarily a break-in? Thanks again, Chris

5 6

possible compromise
by Chris Pelton 14 Oct '03

14 Oct '03

Hello, I'm trying to do some forensics on a redhat 6.2 box that was somehow turned into a mail relay and may have been compromised. The mail logs show the mail coming from an apache virtual host address, and this machine was running zope, and the list of hotfix files I see is: 5220 May 25 2001 Hotfix_2000-10-02.tar.gz 2800 May 25 2001 Hotfix_2000-10-11.tgz 3002 May 25 2001 Hotfix_2000-12-08.tgz 2839 May 25 2001 Hotfix_2000-12-15a.tgz 2386 May 25 2001 Hotfix_2000-12-18.tgz 1899 May 25 2001 Hotfix_2001-02-23.tgz 3292 May 25 2001 Hotfix_2001-03-08.tgz 2492 May 25 2001 Hotfix_2001-05-01.tgz 30720 May 25 2001 hotfix.tar So, would anybody have any ideas how to determine if this might have been compromised? Or is there a known mail relay exploit through zope somehow? I've checked system binaries and everything seems fine. None of the python files seem to have been changed since well before the relaying started. Not sure what version of zope this is - it was built locally, not an rpm. Thanks in advance, Chris Pelton

4 3

RE: [Zope-dev] relations in objects
by Bjorn Stabell 10 Oct '03

10 Oct '03

> From: Paul Winkler [mailto:pw_lists@slinkp.com] >> On Thu, Oct 09, 2003 at 08:46:24PM -0700, Jason Corbett wrote: >> How does an object in zope know where it sits in the hirearchy, > > The only unique identifier that zope provides is > the containment path. An object can tell you its containment > path by doing foo.absolute_url(1) or foo.getPhysicalPath() > depending on what form you want the output in. I am often confused by this as well. I think, however, that you can also reach objects by its "object id" oid. If I just use simple assignment of a variable to an object in Zope, I get that object's oid, right?

3 2

Initial ZODB permissions
by Andy McKay 10 Oct '03

10 Oct '03

Where is the initial code for setting permissions in the ZODB? It looks like the "Copy or Move" permission is give to Anonymous by default at ZODB creation in Zope, which is ahem wrong. Cant find the code that sets that up though, can anyone throw me a clue stick that grep can't? Thanks. -- Andy McKay ClearWind Consulting http://www.clearwind.ca

4 5

Creative Commons Support
by Wouter Vanden Hove 09 Oct '03

09 Oct '03

Are there any plans or is there any interest in supporting the Creative Commons Licenses for metadata in Zope-documents? Has there ever been any talk of such a product? Examples of applications with built-in CC support: http://creativecommons.org/technology/ccapps Greets, Wouter Vanden Hove www.open-education.org

1 0