January 2004 - Zope-Dev

DCWorkflow still not Working using 2.6.4c1
by robert rottermann 21 Jan '04

21 Jan '04

Hi there, the new security regime that changed the rules to acces scripts still prevent my workflow to work. Tres suggestion to give the scripts a proxy role of 'Manager' or clearing the parent parameter in the scripts binding did not help. I have the impressen, that DCWorkflow does not take the proxy role into account . the the script is not called at all, since the security machinery never validates the "non Manager" user. thanks for any help on how to make that work again. Robert

2 1

Help with ZClasses
by Fábio Bruno 21 Jan '04

21 Jan '04

Dear Sir or Madame I'm workign with zope ZClasses in zope 2.7.0b.I decided to do the example given to us at this site http://zope.org/Members/dedalu/precosHowto/#top1.I can not do the question 3.1 and 3.2 for the same reason.They tell us to change PrecosFolder_add but when we do that it is displayed the follow error frase Title Parameter List Bound Names context, container, script, traverse_subpath Last Modified 2004-01-20 17:23 Errors invalid syntax (Script (Python), line 1) <html> <head><title>Adicionar PrecosFolder</title></head> <body bgcolor="#FFFFFF" link="#000099" vlink="#555555"> <dtml-with "PrecosFolder.createInObjectManager(REQUEST['id'], REQUEST)"> <dtml-call "propertysheets.PrecosFolder.manage_editProperties(REQUEST)"> </dtml-with> <dtml-if DestinationURL> <dtml-call "RESPONSE.redirect(DestinationURL+'/manage_workspace')"> <dtml-else> <dtml-call "RESPONSE.redirect(URL2+'/manage_workspace')"> </dtml-if> </body> </html> I hope some one can help us. Yours faithfully, Fábio Bruno _________________________________________________________________ MSN Messenger: converse com os seus amigos online. http://messenger.msn.com.br

2 1

CVS Head: "Error Value: iterable argument required" when adding objects
by Jeff Kowalczyk 20 Jan '04

20 Jan '04

Is anyone else seeing this with a fresh checkout of CVS head (linux, py2.3.2, 2004-01-17 16:40 EST)? When adding any object from the ZMI, I get the same error. Nothing shows up in Z2.log. I can only start zope with runzope at the moment, no error message is indicated in that console when adding. Thanks. ----------------------------- Site Error An error was encountered while publishing this resource. Error Type: TypeError Error Value: iterable argument required ----------------------------- (sidebar, the zopectl error is: $ /var/zope/bin/zopectl start Traceback (most recent call last): File "/opt/Zope-2.8/lib/python/Zope/Startup/zopectl.py", line 207, in ? main() File "/opt/Zope-2.8/lib/python/Zope/Startup/zopectl.py", line 190, in main c.onecmd(" ".join(options.args)) File "/usr/lib/python2.3/cmd.py", line 210, in onecmd return func(arg) File "/opt/Zope-2.8/lib/python/Zope/Startup/zopectl.py", line 134, in do_start ZDCmd.do_start(self, arg) File "/opt/Zope-2.8/lib/python/zdaemon/zdctl.py", line 205, in do_start args += self._get_override("-m", "umask") File "/opt/Zope-2.8/lib/python/Zope/Startup/zopectl.py", line 116, in _get_override value = getattr(self.options, name) AttributeError: ZopeCtlOptions instance has no attribute 'umask'

6 12

tcp port not 8080
by ben strawbridge 20 Jan '04

20 Jan '04

Hello, I just installed zope and plone. It works fine and I can access the management console for it. The problem is I am running tomcat on this box as well and it is already using port 8080. I seaerched around the zope and plone sites but can't find anything about where to change this, except for references that it can be done. I also googled some terms to no avail. Any help will be appreciated. thanks! Ben Strawbridge - Senior Interface Engineer ------------------------------------------------- Cenozoa Corporation 1(646) 536-3066 3 East 28th St., 9th Floor New York, NY 10014 http://www.cenozoa.com

3 2

Zope 2.7.0 beta 4 Release and Security Update
by Brian Lloyd 20 Jan '04

20 Jan '04

Zope 2.7.0 beta 4 Release and Security Update Zope 2.7.0 beta 4 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.7.0b4 from Zope.org: http://www.zope.org/Products/Zope/2.7.0b4/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.7.0b4 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.7.0b4 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.7.0b4 in the near future. Also note that there are binary code changes in the 2.7.0b4 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.7.0b4/CHANGES.txt - http://www.zope.org/Products/Zope/2.7.0b4/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

2 3

2.7:contradiction btw port-base and server section in config ??
by robert 19 Jan '04

19 Jan '04

Hi there, I find two sections in 2.7's config file contradicticnorary. I therefore assume I did not grasp them: with the key port-base I can define at what addres the different servers run. The same I can (must ?) do defining the various servers: <http-server> #valid keys are .. adress 8080 </http-server> which one of the rules? I have the impression that for http port-base gains, for ftp the later (since I have not yet ftp working with 2.7) Robert

2 1

Re: [Zope-dev] 2.7 management_page_charset cannot be callable
by Alan Milligan 18 Jan '04

18 Jan '04

In addition to this problem, someone has changed manage_form_title.dtml and caused me grief! The <dtml-var title> tag has been changed to <&dtml-title;> This causes an implicit html-quote to now be performed which means that my <img> tag, inserted to display the product's icon to more strongly associate what is being created, now just writes the html into the title line. Since nothing was broken in the first place, how about backing out this change. Cheers, Alan

3 5

Help with the change of URL and/or port
by Fábio Bruno 17 Jan '04

17 Jan '04

Dear Sir or Madame I'm wrigting because I started to do a plone site in zope.I would lke to know if I can change the url and/or port where the plone site stays.I would like to know how to chenge this path http:\\localhost:8080\Plone. Yours faithfully, Fábio Afonso _________________________________________________________________ MSN Messenger: converse com os seus amigos online. http://messenger.msn.com.br

2 1

Re: CVS: Releases/Zope/lib/python/ZEO - simul.py:1.12.8.2.18.18
by Tres Seaver 17 Jan '04

17 Jan '04

Evan Simpson wrote: > Update of /cvs-repository/Releases/Zope/lib/python/ZEO > In directory cvs.zope.org:/tmp/cvs-serv18593/lib/python/ZEO > > Modified Files: > Tag: Zope-2_6-branch > simul.py > Log Message: > Non-Python 2.1-compatible division operator "//" crept into 2.6 branch. This is a result of some funny repository fiddling, which somehow got both 'ZEO' and 'BDBStorage' onto the 'Zope-2_6-branch'. I would like to remove the branch tag altogether, as neither module is part of the 2.6 release. Here is what I would propose doing:: $ ssh cvs.zope.org $ cd /cvs-repository $ tar czf /tmp/Zope-just_in_case.tar.gz Zope $ ^D $ cvs -d :ext:cvs.zope.org:/cvs-repository \ rtag -dB Zope-2_6-branch Zope/lib/python/ZEO $ cvs -d :ext:cvs.zope.org:/cvs-repository \ rtag -dB Zope-2_6-branch Zope/lib/python/BDBStorage Anybody know a reason why we shouldn't do this? The CVS docs seem to consider deleting branch tags a Bad Thing (TM), but I have never seen any rationale for it. Tres. -- =============================================================== Tres Seaver tseaver(a)zope.com Zope Corporation "Zope Dealers" http://www.zope.com

4 4

Re: Zope 2.8?
by Jim Fulton 17 Jan '04

17 Jan '04

Gfeller Martin wrote: > Dear Jim, > > are there already plans when Zope 2.8 should see the light of the day? Other than soon, no. It depend on resources, including non-ZC contributors, and problems we encounter. I've updated the project area at: http://dev.zope.org/Wikis/DevSite/Projects/Zope2.8 including the milestone plan: http://dev.zope.org/Wikis/DevSite/Projects/Zope2.8/MilestonePlan > We're mostly interested in the ZODB 3.3 features, i.e., getting rid of > Extension Classes. Well, I hope you've been trying out the ZODB 3.3 releases and providing feedback. Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

2 1