January 2004 - Zope-Dev

2.7 assertion with CVS of this morning
by robert 14 Jan '04

14 Jan '04

I refreshed my 2.7 from CVS this morning (7.30 MEZ) and get the following traceback: Robert Site Error An error was encountered while publishing this resource. TypeError Sorry, a site error occurred. Traceback (innermost last): * Module ZPublisher.Publish, line 163, in publish_module_standard * Module Products.PlacelessTranslationService.PatchStringIO, line 45, in new_publish * Module ZPublisher.Publish, line 127, in publish * Module Zope.App.startup, line 203, in zpublisher_exception_hook * Module ZPublisher.Publish, line 100, in publish * Module ZPublisher.mapply, line 88, in mapply * Module ZPublisher.Publish, line 40, in call_object * Module Shared.DC.Scripts.Bindings, line 261, in __call__ * Module Shared.DC.Scripts.Bindings, line 292, in _bindAndExec * Module App.special_dtml, line 175, in _exec * Module DocumentTemplate.DT_Let, line 75, in render * Module DocumentTemplate.DT_Util, line 201, in eval __traceback_info__: _ * Module <string>, line 0, in ? TypeError: guarded_hasattr() takes exactly 2 arguments (3 given) (Also, an error occurred while attempting to render the standard error message.)

3 7

_.min and _.max still used by ZMI
by Travis Miller 14 Jan '04

14 Jan '04

hi Dirk, i just (configure/make/make install)ed Zope-2.7.0-b4 and i immediately ran into the .min/.max/... security changes when i tried to rename an object through the ZMI. i tried your patch but after the change, zopectl errors when run: zope@travis-desktop:~> ./InstanceHome27b4/bin/zopectl start Error: The object named by "DBTab.ClassFactories.autoClassFactory" could not be imported (line 822 in file:///opt/Zope/InstanceHome27b4-2/etc/zope.conf) For help, use /opt/Zope/SoftwareHome27b4/lib/python/Zope/Startup/zopectl.py -h when i rollback the patch zopectl runs again, but ofcourse the max call still fails. any ideas? thanks, travis

2 1

Security audit introduced problem in PageTemplates/Expression.py
by Stuart Bishop 13 Jan '04

13 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The 'security audit work for the 2.7 branch' commit on 8th Jan made the following change in PageTemplates/Expression.py: *************** *** 312,318 **** # Skip directly to item access o = object[name] # Check access to the item. ! if not validate(object, object, name, o): raise Unauthorized, name object = o continue - --- 307,313 ---- # Skip directly to item access o = object[name] # Check access to the item. ! if not validate(object, object, None, o): raise Unauthorized, name object = o continue *************** *** 367,373 **** raise else: # Check access to the item. ! if not validate(object, object, name, o): raise Unauthorized, name object = o - --- 362,368 ---- raise else: # Check access to the item. ! if not validate(object, object, None, o): raise Unauthorized, name object = o This has the side effect of not passing the name attribute to my security assertion methods registered via ClassSecurityInfo.setDefaultAccess: class Foo(blah, blah, blah): security = ClassSecurityInfo() def _checkAccess(self, name, value): if name.startswith('CG'): return 1 return 0 security.setDefaultAccess(_checkAccess) def __getitem__(self, key): ''' Access via dictionary interface, with security provided via _checkAccess ''' return 'example' Reversing the changes to Expression.py seems to break lots of things (including SiteErrorLog), so I'm sure this is much more involved. Can anyone shed light onto what is going on? - -- Stuart Bishop <stuart(a)stuartbishop.net> http://www.stuartbishop.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin) iD8DBQFAA4AFAfqZj7rGN0oRArWMAJ96sb9wKkx9qqstiB+78cZ1LrtW8ACggNX8 +uCQkzQGvbgIzW8Sb4C9kAE= =7xyW -----END PGP SIGNATURE-----

1 0

RE: [Zope-dev] ESI support
by Bjorn Stabell 13 Jan '04

13 Jan '04

Jens: > > Zope does not need "ESI support" - You can write ESI statements in > > your templates without specific support from Zope. Yes, but I think they were planning to make it easier from DTML/ZPT, a la JSP's ESI library.

3 2

Problem in tar.py
by Jonas Thor 12 Jan '04

12 Jan '04

There seems to be a problem in the functin oct12() in file Packages/App/tar.py. The problem appears if you tries to add a file to a tar archive which mtime is newer than Sat Jan 10 14:37:04 2004. Current version of oct12() in tar.py: <-- snip --> def oct12(i): i=oct(i) return '0'*(11-len(i))+i+' ' <-- snip --> Suggested changes: <-- snip --> def oct12(i): i=oct(i) if len(i) < 12: return '0'*(11-len(i))+i+' ' else: return i[1:12]+' ' <-- snip --> I've posted a issue to Zope Collector, 1177. Cheers, /jonas

1 0

ESI support
by Bjorn Stabell 12 Jan '04

12 Jan '04

Any news on Zope support for ESI? http://mail.zope.org/pipermail/zope-dev/2003-January/018619.html http://www1.cn.squid-cache.org/mail-archive/squid-dev/200208/0047.html >From what little I can gather from the Squid mailing lists, it looks like ESI support is materializing in Squid. Bye, -- Bjorn

3 3

xmlrpclib.py
by Chris McDonough 11 Jan '04

11 Jan '04

There is an xmlrpclib.py included with Zope. It's a bit different than the one in Python 2.3. Is there any reason we shouldn't just delete it (aside from fear and the lack of unit tests? ;-) - C

2 1

Re: [Zope-dev] _.min and _.max still used by ZMI
by Dirk 11 Jan '04

11 Jan '04

Hi Johan, maybe the patch can fix your problem. Regards, Dirk

2 1

_.min and _.max still used by ZMI
by Johan Carlsson 10 Jan '04

10 Jan '04

Since the new security release for Zope 2.6.3 (and 2.7) the _.min and _.max doesn't work any more. But they are still used by the ZMI in the following places: OFS\dtml\properties.dtml(140): size="<dtml-var "_.min(7, _.len(getProperty(select_variable)))">"> OFS\dtml\properties.dtml(152): size="<dtml-var "_.min(7, _.len(_[select_variable]))">"> OFS\dtml\propertyType.dtml(93): size="<dtml-var "_.min(7, _.len(_[select_variable]))">"> OFS\dtml\renameForm.dtml(27): "_.max(40,_.len(getId())+4)">" value="&dtml-id;" /> This breaks at least "multiple selection" properties. Are there a work around for DTML files using these features? Best Regards, Johan Carlsson -- Johan Carlsson Tel: + 46 8 31 24 94 Colliberty Mob: + 46 70 558 25 24 Torsgatan 72 Email: johanc(a)easypublisher.com SE-113 37 STOCKHOLM Skype: colliberty

1 0

Where to put Zope 3 in Zope 2
by Jim Fulton 10 Jan '04

10 Jan '04

I want to make the zope.interface (Zope 3 Interfaces) package available on the Zope 2 head (aka Zope 2.8). I propose to add lib/python/zope3 as a container for zope 3 packages. This new directory will be added to the path used by Zope 2. A separate directory is needed because there are packages in Zope 2 and Zope 3, most notably zope and Zope, with names differing only in case. I will also replace the existing Interfaces package with a facade package that uses zope.interfaces. Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

2 1