October 2004 - Zope-Dev

Patch for attribute permisions problems in Zope 2.7.3
by Santi Camps 21 Feb '05

21 Feb '05

Hi all again, We have been written last week about some attribute permission problems with Zope 2.7.3 beta due to a patch applied by Tres. First of all, Tres, apologies for my too fast written test case and my too late test of Zope 2.7.3. Now, with some more time, I've tested and debugged on Zope 2.7.3 and found exactly what's happen. Supose we have a structure of objects like this: A.__of__(B) "A" inherits from Acquisition.Implicit, has security assertions, but has not __allow_access_to_unprotected_subojects__ We want to access, from a Zope Page Template, an attribute of "B" that is not present in "A" Accessing B.our_attribute attribute works fine. But accessing A.__of__(B).our_attribute fails, and should work. The problem is the call to "validate" done in "guarded_getattr" method of ImplPython.py. The actual call is "if validate(inst, inst, name, v)", but the validate function says: Arguments: accessed -- the object that was being accessed container -- the object the value was found in name -- The name used to access the value value -- The value retrieved though the access. roles -- The roles of the object if already known. Now, "accessed" and "container" are always the same, and in some cases should be different. I attach a patch to solve this case that works for me. I'm not sure if my code is the best way to solve the problem but, as I said, it seems to work fine. Of course, If the patch is accepted, the same change should be done in the C version. Thanks Santi Camps http://www.earcon.com --- ImplPython.py 2004-08-07 19:15:48.000000000 +0200 +++ /usr/local/zope273/lib/python/AccessControl/ImplPython.py 2004-10-29 10:56:11.000000000 +0200 @@ -534,6 +534,12 @@ # exceptions are caught early. try: v = getattr(inst, name) + container = inst + while hasattr(container,'aq_explicit') and \ + not(hasattr(container.aq_explicit, name)) and \ + hasattr(container, 'aq_parent'): + # Find real container when attribute is acquired + container = container.aq_parent except AttributeError: if default is not _marker: return default @@ -551,6 +557,6 @@ return v validate = SecurityManagement.getSecurityManager().validate - if validate(inst, inst, name, v): + if validate(inst, container, name, v): return v raise Unauthorized, name

2 2

connecting server code to the ZODB
by Tim Hicks 14 Nov '04

14 Nov '04

Hi, I'm trying to figure out how to adjust Nikolay Kim's smtpserver code <http://cvs.sourceforge.net/viewcvs.py/collective/smtpserver/> so that objects within the ZODB can affect the way that messages are received (i.e. veto messages based on certain criteria in the first instance). My problem is that I don't quite know how to get hold of the ZODB objects. As far as I can tell, Nikolay's smtpserver.SMTPServer.SMTPChannel.process_message method uses ZServer.PubCore.handle to make the connection, but I don't really understand how this all works. What I really want to be able to do from the server code is something like:: root = magic_that_gets_me_zodb_root() account_manager = root['Control_Panel']['AccountManager'] account_manager.checkAccepts(msg) I want calls like that to checkAccepts(msg) to be made a several points in the SMTP session - say after each of the SMTP commands RCPT, MAIL, DATA, etc. I only mention that in case there are implications for some transaction jiggery-pokery (although I don't expect any of the checkAccepts() type calls to need to write to the ZODB). Any pointers much appreciated. tim

3 6

Showstopper UnicodeDecodeError on Zope import???
by Nick Bower 05 Nov '04

05 Nov '04

I'm trying to import a zexp export (a Plone site actually) from a windows workstation to a zope server I built on Linux RH9 but it fails with a UnicodeDecodeError: ... Module Products.ZCTextIndex.Lexicon, line 69, in sourceToWordIds Module Products.ZCTextIndex.Lexicon, line 135, in _getWordIdCreate UnicodeDecodeError: 'ascii' codec can't decode byte 0xef in position 5: orginal not in range(128). What is confusing is that the zexp *will* import to another linux zope build I have (on Mdk10) and sys.getdefaultencoding() and locale.getdefaultlocale() on the 2 linux machines are almost the same (the working one reports "en_GB, utf"/ascii and the non-working one reports "en_US, utf"/ascii), so I think this is a red herring. I can't for the life of me work out what is going wrong as I built python myself on both Linux machines exactly the same. Can anyone help me please??? Thanks, Nick

3 10

Announce: FSPerlScript
by Alan Milligan 01 Nov '04

01 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, This patch is against CMF-1.4.7, although one could equally argue it better suited elsewhere - there appear to me to be minor uncomfortable dependencies regardless of where it sits (unless it's made an independent product - which seems a little unwarranted given it's simplicity). This patch includes the following: ~ FSPerlScript.py ~ images/fspl.gif (needs an artiste to draw a padlock!) ~ tests/test_FSPerlScript.py ~ tests/fake_skins/fake_skin/test1.pl ~ tests/fake_skins/fake_skin/test2.pl ~ __init__.py (FSPerlScript registration) Unfortunately, FSPerlScript is not quite as useful as I'd anticipated, given that the 'use' statement is a restricted opcode. I am more than willing to discuss with any interested party(s) how we may implement a security mechanism whereby we can specify 'safe' Perl modules, much as we do with the Python modules_allow stuff. Cheers, Alan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFBhLGxCfroLk4EZpkRAtr6AKDCvDnf1gglfN7xrCW/eEZu0bvOowCfb3Wc BkRbevjQM1X20IbvgC6kCFw= =yHdw -----END PGP SIGNATURE-----

2 1

Access to global methods in product creation forms
by Marco Bizzarri 29 Oct '04

29 Oct '04

Hi all. I would like to use a global method in the add form of a product. I've declared the method in the methods dictionary of the package. However, when I try to add the product, I receive an unauthorized exception. The environment is python2.3.4 and zope 2.7.3, running on Debian GNU/Linux. I've attached a simple test product showing the problem. Thanks you in advance for your support. Regards Marco

1 0

Re: [Zope-dev] Can I configure additional loggers via zope.conf?
by Ames Andreas (MPA/DF) 28 Oct '04

28 Oct '04

Hello, Fred Drake wrote: > Please file a feature request for this so we don't forget it. This > can be assigned to me, though I'm not sure when I'll be able to get > to it. Please look to http://zope.org/Collectors/Zope/1555. Unfortunately I don't know how to assign this to you. Thanks, andreas

1 0

Can I configure additional loggers via zope.conf?
by Ames Andreas (MPA/DF) 28 Oct '04

28 Oct '04

Hello, sorry if this the wrong list, I just wasn't sure. I'd like to use a python lib which creates and uses its own logger objects/hierarchy. This hierarchy is not a subtree of the 'event'-hierarchy or the other default Zope-logger hierarchies. Unfortunately I wasn't able to define a <logger> section in my zope.conf (without changing the Zope/Startup/zopeschema.xml). Given that the number of python libs using 'logging' seems to keep growing my question is: Is this my fault, a Zope bug, a wishlist item or a feature (I'm using 2.7.2 if that matters)? TIA, andreas

2 1

ZopeInterface
by Radoslaw Stachowiak 28 Oct '04

28 Oct '04

Hello, Could anyone please provide me information when ZopeInterface product is going to be updated ? And how is it related to zopex3 releases ? I'm gentoo linux (www.gentoo.org) developer maintaing all zope related packages, and we are considering inclusion of ZopeInterface as separate package (we already have zopex3_rc3). Thank You in advance. -- radek(a)gentoo.org

2 1

Guidelines for using Speedpack with Zope products
by cp.hennessy＠openapp.biz 28 Oct '04

28 Oct '04

Hi, I'm trying to improve the speed of a plone based site and have installed SpeedPack. However my understanding is that SpeedPack currently takes a conservative approach to a limited set of products. I would like to understand what limitations SpeedPack has and how I can extend it to be able to improve the speed of various products and methods which profilers seem to indicate are taking more time than I think they should. If anyone has experience of using SpeedPack I'd also appreciate any comments you may have. Also if this is the wrong list for this topic please tell me which is the correct list. Thanks CPH

2 1

RFC: Proposed backward-compatibility policy
by Jim Fulton 27 Oct '04

27 Oct '04

Below is a proposed policy on backward compatibility for Zope. Zope Policy on Backward Compatibility ===================================== Backward compatibility needs to be a very high priority. Clean software also needs to be a high priority. Unfortunately, these goals are often at odds. Providing backward compatibility support makes code more complex and, thus, less maintainable. Going forward, we will address these conflicting goals in the following ways; 1. During development, alpha testing, and beta testing of new releases, any backward-incompatible change will be considered a bug. That is, we will make all effort to make sure that each release of Zope is backward compatible with the previous two feature releases. 2. Backward compatibility support will be limited. When we make a change that would require a change in software or data, we'll add code to support the old software or data, but we will also add code to generate deprecation warnings when that support code is used. The deprecation warnings will say specifically when the backward-compatibility support will go away. This time will usually be expressed as a release number at least two feature releases past the next feature release. (For example, if the next feature release is release 3.1, then the backward compatibility support would not be removed any sooner than release 3.3.) In other words, we will limit the time extent of backward compatibility support, but we will give plenty of warning. When data changes are involved, we'll provide data conversion tools that will be available before we begin the deprecation process. An additional issue is that it is often difficult to figure out if subtle features are being used. (For example, a change in an exception base class might affect some client that expected to catch the exception based on it's base exception.) It is very hard for a developer to assess whether any applications are relying on a particular feature and thus whether backward-compatibility support needs to be provided. Often developers will make judgment calls. If they judge wrong, we need to catch this with testing. This leads to a 3rd point: 3. It is very important to catch backward compatibility problems during development of new releases. In particular, it is important to test new Zope releases before they are released in final form. If a backward-compatibility problem is found before the final release, it will be considered a bug and will be fixed (by adding backward compatibility support) if at all possible before the final release. After the final release, we may choose not to bother to fix backward-compatibility problems. Consumers of Zope have a right to backward compatibility, but they also have a responsibility to test Zope against their applications during the beta release cycle (or sooner) to make sure their applications work. Questions? Thoughts? Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

5 8