May 2003 - Zope-Dev - Zope lists

strange priv leak
by Jamie Heilman 23 May '03

23 May '03

Lately I've been noticing that http://host/zopeobject/manage_options is accessible TTW with no priveleges. Unless I'm on crack, wasn't always like this. I've been trying to figure out what changed and the only thing I can discern is is that may be related to using python 2.2. I've seen it happen with 2.6.1 & python 2.2, and I've seen it happen with HEAD & python 2.2, but never 2.6.1 & python 2.1.3. Can anyone else corroborate this? Even better does anyone else know how to fix it? I'm wondering if there's more hanging out in the open than just some attributes here and there. -- Jamie Heilman http://audible.transient.net/~jamie/ "We must be born with an intuition of mortality. Before we know the words for it, before we know there are words, out we come bloodied and squalling with the knowledge that for all the compasses in the world, there's only one direction, and time is its only measure." -Rosencrantz

6 12

Re: [Zope-dev] testrunner.py with INSTANCE_HOME support for 2.6.2
by Lennart Regebro 23 May '03

23 May '03

Stefan H. Holek wrote at 2003-5-21 11:17 +0200: > I'd be willing to do it if there was genuine interest. ZC? There is genuine interest. :)

2 1

(no subject)
by alan 23 May '03

23 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Enigmail -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2rc1 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE+zYSSCfroLk4EZpkRAr9MAJ0TIDB+xK0x6lz3On4ARMNxeBlyAACgilQH 2lPpaX+CP6C5aTWo43VJwQY= =TqgR -----END PGP SIGNATURE-----

1 0

HEAD/GET
by Magnus Heino 21 May '03

21 May '03

Can anyone explain why this HEAD request fails, when the same GET request succeeds? magnus@daysleeper magnus $ curl -I -s http://www.alvkarlebygk.com/index_html/document_view|head HTTP/1.1 404 Not Found Date: Wed, 21 May 2003 07:42:19 GMT Server: Zope/(Zope 2.6.1 (source release, python 2.1, linux2), python 2.1.3, freebsd4) ZServer/1.1b1 Bobo-Exception-File: /usr/home/alvkar/zope/261/lib/python/ZPublisher/HTTPResponse.py Content-Type: text/html;charset=iso-8859-15 Pragma: no-cache Etag: Last-Modified: Wed, 21 May 2003 07:42:19 +0000 Expires: Sat, 1 Jan 2000 00:00:00 GMT Bobo-Exception-Type: NotFound magnus@daysleeper magnus $ curl -s http://www.alvkarlebygk.com/index_html/document_view|head <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv"> <head> <meta http-equiv="Content-Type" content="text/html;charset=iso-8859-15" /> <title>Välkommen till Älvkarleby Golfklubb - Välkommen!</title> magnus@daysleeper magnus $ -- /Magnus

2 1

testrunner.py with INSTANCE_HOME support for 2.6.2
by Stuart Bishop 21 May '03

21 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Any chance of http://collector.zope.org/Zope/489 going into the 2.6.2 release? The replacement testrunner.py seems to drop in quite happily to 2.6.2b1. - -- Stuart Bishop <zen(a)shangri-la.dropbear.id.au> http://shangri-la.dropbear.id.au/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+w2SZh8iUz1x5geARAsdHAKC74XGJMeVP49QKSLqFQHRrl+fTlQCcD6B7 /YfNG6LEdo+hkP891Kj3oK4= =ZBnm -----END PGP SIGNATURE-----

4 3

how and when to use SecurityManager.addContext
by Jamie Heilman 20 May '03

20 May '03

I'm trying to use the equivalent of a (mini) Script (Python) as an attribute of a Product I'm writing. I'm confused about how SecurityManager.addContext works though, and when I should use it. I'm far enough along in my product code that I'm able to write some code in a textarea, store that, compile it as a restricted python function, and execute it when I need to... but I'm not executing it in any sort of special context. I get the feeling I should be, though I'm not sure why. Is there any documentation on this stuff at all? Tucked away somewhere? The whole security policy stack, default methods, custom methods, its all rather nebulous for me at the moment and I don't particularly want to publish this product until I'm sure I'm doing the right thing. The product is a cache manager, the restricted code represents the the function that aggregates the cache index, thus the function is executed whenever a cache get or set is done. -- Jamie Heilman http://audible.transient.net/~jamie/ "Most people wouldn't know music if it came up and bit them on the ass." -Frank Zappa

3 2

Calling API using python/php
by Shanmugam Srinivasan 20 May '03

20 May '03

Hi Pals, I want to call openflow api s from my 1.python and 2.php code.How can I do it? Please send me some examples in both python and php. Regards Amitava Mitra

1 0

TextIndexNG and ExternalFile
by biddu_d 19 May '03

19 May '03

Hello, I am using TextIndexNG and ExternalFile to index documents. I am able to index all documents that are in the ZODB and also pdf files in a LocalFS directory. However, the indexing fails for pdf documents setup as External Files. Am I missing anything in the setup? Incidentally, it is able to index ExternalFile text documents, only the pdf files have a problem. Any help would be appreciated. Setup is on Linux. Converter is xpdf. Regards/Biddu

1 0

ZopeSandBox and zope-error
by PieterB 19 May '03

19 May '03

Hello, I created a Zope sandbox based on the script of Sidnei http://cvs.zope.org/NZO_SiteLayout/buildout_zope_sandbox?cvsroot=Zope.org I've tested with Python 2.3b1 and Zope 2.7 (using CVS-head). I also created a Makefile which can be easily used for making, cleaning-up and starting/stopping Zope. The scripts are available at http://gewis.nl/~pieterb/zope/zopesandbox (work-in-progress). It would be great to have a (modular) create_sandbox script which would work on all (Unix) platforms and where you can easiliy select which version of the various products you want to use. When starting/stopping Zope I get the following error: bin/zopectl stop /home/pieterb/ZopeSandBox/opt/Zope-head/lib/python/ ZServer/medusa/test/max_sockets.py:53: DeprecationWarning: integer argument expected, got float for i in range(1 + len(sl) * 0.05): which can be easility fixed: for i in range(int((1 + len(sl) * 0.05))): After fixing that I get the following error when I start Zope: /home/pieterb/ZopeSandBox/opt/Zope-head/lib/python/App/Product.py:37: DeprecationWarning: the rotor module uses an insecure algorithm and is deprecated import os, re, zlib, marshal, rotor, cPickle This seems harder to fix. I also tried adding a Plone site, but that gives an "Action cancelled" error in the browser (and I don't see any logging of the problem). I'll also tried with Python 2.2.2, but that also fails... Some questions: - Will Python 2.3 be supported for Zope 2.7/Zope 3? - Should I use the HEAD or the 2.7-dev-branche for Zope 2.7? (please document this in the 2.7 Wiki). - Would others try the scrips on their platform (and possibly improve it) PieterB

4 8

Making index_html a PageTemplate
by Philipp von Weitershausen 18 May '03

18 May '03

Hello everyone, I have been hanging around #zope on IRC a lot recently and noticed that a lot of newbies ask a lot of DTML questions. I tried to answer their questions but I always pointed them to ZPT in the end. I was amazed that the majority had never heard of ZPT or thought that their problem could only be solved with DTML. I've been emailing with Chris McDonough (see out thread on the ZDP mailinglist) and we found that the following two reasons might be responsible to this: a) newbies, esp. scripters, like to play around without reading docs b) the tutorial is grossly out of date a) seems is a common behaviour which we cannot change. We can, however, change what newbies find on their path of trial and error. I think a big false symbol is that index_html is still a DTML Method. Everybody with some knowledge of web suite building knows what a index.html is so they will most likely look at that object named index_html. They see that it is a DTML Method so they'll say "Aha! HTML in Zope is done with DTML Methods". Therefore, I propose to make index_html a PageTemplate for 2.7. Since this change would not affect the framework at all, it should not interfere with the release schedule for 2.7. Please correct me if I'm wrong. Thoughts? Phil

5 4