March 2004 - Zope-Dev

Pointless exception re-raising in DA.py
by Chris Withers 30 Mar '04

30 Mar '04

Hi All, In Shared/DC/ZRDB/DA.py, Line 399 of Zope 2.6.1 and line 419 in 2.7.0, there's this rather pointless lump of code: try: DB__=dbc() except: raise DatabaseError, ( '%s is not connected to a database' % self.id) ...which only serves to mask the real cause of the problem when trying to obtain a connection. Would anyone have any objections if I changed this to simply: DB__ = dbc() ? (if no responses, I'll assume that means you agree with my proposed change ;-) Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

5 15

InvalidObjectReference: Attempt to store an object from a foreign database connection
by Christian Heimes 29 Mar '04

29 Mar '04

There is a problem regarding plone, cmf and the quickinstaller tool. I'm getting an InvalidObjectReference error after reinstalling a product with the quickinstaller a second time or several times. It looks like the error happens only after I visited the plone ui at least once but that could be concurrence. Only restarting zope stops the error until the next occurance. Version: Python 2.3.3 (Debian testing) Zope 2.7 (CVS branch) CMF 1.4 (CVS) Plone 2.0 Traceback (innermost last): Module ZPublisher.Publish, line 104, in publish Module Zope.App.startup, line 224, in commit Module ZODB.Transaction, line 233, in commit Module ZODB.Transaction, line 348, in _commit_objects Module ZODB.Connection, line 419, in commit - __traceback_info__: (('Products.CMFCore.ActionInformation', 'ActionInformation'), '\x00\x00\x00\x00\x00\x00\x9e\xe3', '') InvalidObjectReference: Attempt to store an object from a foreign database connection I tried to get the object by starting zope with zopectl debug and using app._p_jar['\x00\x00\x00\x00\x00\x00\x9e\xe3'] but the object wasn't available so it seems to be a new object that is saved the first time. After changing the pickler from cPickle to pickle: Traceback (innermost last): Module ZPublisher.Publish, line 104, in publish Module Zope.App.startup, line 224, in commit Module ZODB.Transaction, line 233, in commit Module ZODB.Transaction, line 348, in _commit_objects Module ZODB.Connection, line 419, in commit - __traceback_info__: (('Products.CMFCore.ActionInformation', 'ActionInformation'), '\x00\x00\x00\x00\x00\x00\xa2G', '') Module pickle, line 231, in dump Module pickle, line 293, in save Module pickle, line 663, in save_dict Module pickle, line 695, in _batch_setitems Module pickle, line 278, in save InvalidObjectReference: Attempt to store an object from a foreign database connection pickle.save():278 is calling self.persistent_id(obj) which is patched to call coptimizations.new_persistent (pickler.persistent_id=new_persistent_id(self, stack)) in ZODB.Connection.commit(). The exception itself is raised by persistent_id_call() because of (jar != Py_None && jar != self->jar) is true. Debugging so deep into the zodb is a bit over my knowledge so I would be glad if someone could dig in, too. :) Christian PS: CC to plone-devel and cmf

3 3

Use Z SQL methon in projects
by R33t 29 Mar '04

29 Mar '04

Dear list, I'm quite new to zope and I have to develop a Newsletter system as a project for my university. All works pretty good so far, I'm using ZPT with embedded Z SQL methods to create my page dynamically....the code looks like this: ... <b>Newsletters</b><br> <table cellpadding="5" cellspacing="0" border="1" width="250"> <tr tal:repeat="newsletters here/getNewsletters"> <td align="left"><font size="2"> <input type="checkbox" name="newsletter" tal:attributes="value newsletters/id"> <p tal:replace="newsletters/newsletter_name">NewsletterName</p> </td> </tr> </table> ... I did all the things so far inside the Zope ZMI to see how things work together, but now I'd like to create a "real" project and I already got most of the things working, like calling the page templates from within python. The problem I have now is that I don't know how to manage to export my Z SQL method getNewsletters to my product folder and register it to Zope from within python when my product gets installed, so that the template can call this method like before...I don't want the users of my product to manually create this Z SQL method when they install the newsletter system. Is it possible at all or do I have to start all over again? any help would be appreciated thanks a lot reet

4 3

Zope 2.7 memory behaviour
by Arndt Droullier 29 Mar '04

29 Mar '04

Hello, I´m trying to find a memory leak in a zope appliction and started to test how zope memory consume behaves basically under load. The current result is: Zope constantly consumes more memory. The testcase is: 12 http clients request constantly request the same page template (it does not contain any tal statements and only 10 lines of HTML) in a simple folder. The increase is about 50 - 100 kb / minute. I´m using Windows 2000 as server platform. The database cache and debug information on the control panel seem allright. Now I wonder if there´s basically a problem with Zope 2.7? Has anyone made the same experience? Or an explanation why this happens? Thanks, Arndt.

3 9

university research survey on Zope community organization
by Nicolas Jullien 29 Mar '04

29 Mar '04

Hello, We (some French researchers in economics and sociology from ENST Bretagne graduate school and CNRS), are working on free-open source software production and diffusion. To do so we have chosen to focus on some projects, an Zope is one of them. We have already met some Zope contributors, such as Paul Everitt, and today we survey (http://www-eco.enst-bretagne.fr/Etudes_projets/cgi/questionnaire_Zope.cgi) Zope developers. Your answer is very, very important for us, and for statistical reason we ask to everybody on the list to answer. The survey is online and takes 5 to 10 min to fill in (http://www-eco.enst-bretagne.fr/Etudes_projets/cgi/questionnaire_Zope.cgi) Your answers will remain anonymous and will not be disclosed or used for other purpose than statistic work within that project. Feedback on the survey results will be published as soon as they will be produced. Thank you very much by advance for your help ! Nicolas Jullien, Didier Demazière, François Horn PS: in a second time, we will make a survey on the 'whole' Zope community, on Zope-announce. Of course, you won't need to fill in tis questionnary. -- Coordinateur des programmes de recherche Marsouin. (PhD) Research projects coordinator for Marsouin. Les articles du séminaire Marsouin des 4 & 5 décembre : http://www.marsouin.org/ Tel/fax +33 (0) 229 001 245 / +33 (0) 229 001 173 GET-ENST Bretagne, Technopôle Brest Iroise CS 83818 29238 BREST CEDEX 3

3 2

test.py + INSTANCE_HOME (proposed solution)
by Stefan H. Holek 29 Mar '04

29 Mar '04

I have made some small modifications to test.py to allow testing in INSTANCE_HOMEs. Please see: <http://zope.org/Collectors/Zope/1279> An already patched version of test.py is available from here: <http://zope.org/Members/shh/TestRunner/test.py> Stefan -- The time has come to start talking about whether the emperor is as well dressed as we are supposed to think he is. /Pete McBreen/

1 0

Zope2.7.0rc2 AttributeError: 'NoneType' object has noattribute 'setHeader'
by Christophe Tronche 27 Mar '04

27 Mar '04

Hello all. Has this problem been solved ? I'm stuck in the very same problem after having switched from python 2.6.2 to 2.6.4, both using the same python2.2.3. Pure Zope, no Product other than my own (where not a single line of code has been modified) and no funny name like Tony's SYS or whatever. The problem occurs when trying to interpret App/dtml/manage_page_header.dtml and /OFS/dtml/main.dtml in a management tab. Any idea someone ? Regards, Ch. Tronche Thanks again for the reply Dieter, On 6 Feb 2004, at 21:14, Dieter Maurer wrote: > "REQUEST.RESPONSE" is set up in > "ZServer.HTTPServer.zhttp_handler.continue_request". > It should be impossible that is is "None". > > Agreed. > Maybe, we have a memory corruption. > I have seen objects magically becoming "None" in > Python versions with memory corruption problems (Python 2.1.1). > > -- > Dieter Could be memory perhaps, but this is python2.3.3. > Christian Heimes wrote: > [...] > > And the next one: > > Python2.3.3/Zope2.70rc2/Plone2rc5. > > Exception Type > AttributeError > Exception Value > 'str' object has no attribute 'RESPONSE' > > [...] > Module Products.CMFPhoto.Photo, line 510, in clearCache > AttributeError: 'str' object has no attribute 'RESPONSE' > > The relevant code line is self.REQUEST.RESPONSE.setHeader(). The error > occured at object creation. > > Something really bad is going on! > > Christian > > The problem I'm having is that these are all stock Zope products from a Zope2.7.0rc2 release. The traceback is coming from the Zope core. Traceback (innermost last): ... Module Shared.DC.Scripts.Bindings, line 320, in __render_with_namespace__ Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec Module App.special_dtml, line 175, in _exec Module DocumentTemplate.DT_Util, line 201, in eval - __traceback_info__: RESPONSE Module <string>, line 0, in ? AttributeError: 'NoneType' object has no attribute 'setHeader' This also seems different from what Christian is reporting; > Christian Heimes wrote at 2004-2-6 23:01 +0100: > And the next one: > > Python2.3.3/Zope2.70rc2/Plone2rc5. > > > Exception Type > AttributeError > Exception Value > 'str' object has no attribute 'RESPONSE' > > [...] > Module Products.CMFPhoto.Photo, line 510, in clearCache > AttributeError: 'str' object has no attribute 'RESPONSE' > > The relevant code line is self.REQUEST.RESPONSE.setHeader(). The error > occured at object creation. > > Something really bad is going on! So, I'm still baffled by this. Many thanks to all those providing more data points. I *think* this is a 'Zope' thing and not a 'Tone' thing, but I've been wrong in that area before ;) cheers tone. -- Dr Tony McDonald, Asst Director, FMSC. 0191 245 4223 Project Manager, FDTL-4 ePortfolios http://www.eportfolios.ac.uk/

2 2

PageTemplateFile vs. Bindings vs. Security
by Jamie Heilman 25 Mar '04

25 Mar '04

So... remember way back when Brian warned about the binding breakage due to the improved security checks? It just bit me in a way I didn't forsee. I forgot that PageTemplates use bindings too, which means those changes affect more than just PythonScripts they affect Products that use PageTemplateFile methods. My product had declared its object instances to be private, and in doing so it totally breaks the ability to use PageTemplateFile methods. This sucks. Using DTML for product methods goes against the fiber of my being, I just can't bring myself to do it; the namespace pollution as programing paradigm is so frustrating it just makes me want to throw things. But DTMLFile has a huge advantage ... it does the Right Thing with respect to Zope security. It ignores it completely. Paradoxically, by ignoring Zope's security framework in the context of on-disk methods this actually improves Zope's overall security. It allows you to fully take advantage of the API seperation available to Products. To briefly enumerate, you've got 3 basic types of methods: def _python_only_methods(): """docstring doesn't "matter" as this can't be published or accessed TTW, security declarations are superfluous, can't be accessed by RestrictedPython either""" def python_or_RestrictedPython_methods(): # no docstring ensures its not publishable, security declarations # are necessary to dictate RestrictedPython's privileges pass def publishable_python_or_RestrictedPython_methods(): """docstring dictates publishablility, security declarations are necessary and dictate both RestrictedPython's privileges and TTW privileges""" Now DTMLFile does its work with the privileges of "python" code, which is great because it means you can define methods which generate content fragments without any restrictions on what APIs it can and can't use. This is useful--more on why in a sec. Conversely the PageTemplateFile does it work with the privileges of "RestrictedPython" code, which might seem great at first, ("More security? What can possibly be bad about that?!") but rapidly wears thin when you try to use PageTemplateFiles in API code, and screws Product authors who were trying to write secure code. To illustrate the first point where PageTemplateFile forces a weakened API, consider the case of Tabs.manage_tabs() ... this method must be declared *public* so that Products using PageTemplateFile can access it. The caller's security context is taken into account with PageTemplateFiles and as 2 different products using PageTemplateFile methods might require completely different permissions to access the method which in turn relies upon Tabs.manage_tabs() the only way to satisfy all possible permission combinations is to just give up and declare the method public so it always succeeds. Products using DTMLFile OTOH don't care, it could be totally private, as it *should* be, and DTMLFile methods would still be able to call it and use the results to display content without regards to callers security context, this makes DTMLFiles useful because you can maintain the integrity of your API and not expose stuff to RestrictedPython that true RestrictedPython has no business calling. If only DTML wasn't such a horrible, syntactically braindamaged, stack-bound HELL to work with! But DTML is hell, and thats not going to change, its better to focus energies on the future which is ZPT, and I assert that PageTemplateFile behavior needs to change. Back to the second point, that the current behavior screws Product authors trying to write secure code. My product called security.declareObjectPrivate() because this is the only way I know of to ensure a product and its attributes are safe from tampering, and until the Binding changes, I thought this was a great deal. Now that the hole in bindings have been fixed though it turns out that because my product uses PageTemplateFile methods which in turn pay attention to bindings, and, unfortunately, pay attention to the callers security context as well, none of those methods work anymore, they raise Unauthorized: Not authorized to access binding: container I can fix this by changing my object security declaration to be public or restricted to a permission, but that has side effects that I don't want, namely opening my object instances up to tampering from within RestrictedPython given the appropriate security context. Given that my need to have the object instance completely private and my desire to avoid DTML are now in direct conflict I'm basically forced to choose between a range of compromises and I don't like any of them. So here's the questions I have for you all... is there a way to declare appropriate security on the bindings that are screwing me right now from within my product code so that I can selectively poke holes to allow container access where needed, or am I to be forcibly coerced into exposing my object to restricted code? And two, assuming I haven't overlooked some detail about why forcing PageTemplateFile to work within the calling security context is a good thing... Shouldn't we fix PageTemplateFile to work like DTMLFile wrt security? How hard is it going to be to do that? -- Jamie Heilman http://audible.transient.net/~jamie/ "...thats the metaphorical equivalent of flopping your wedding tackle into a lion's mouth and flicking his lovespuds with a wet towel, pure insanity..." -Rimmer

6 12

manage_access patch
by Johan Carlsson 25 Mar '04

25 Mar '04

Hi, I've made a patch to manage_access (and AccessControl.Role.permission_settings) that displays the current effective security setting (something that have been bugging me for ages). It also uses a small javascript and disabled property of the checkboxes (with potential problems with old browsers that don't support the disabled property). So where should I send the patch, I'm not currently active as a Zope contributor. Regards, Johan Carlsson -- Johan Carlsson Tel: + 46 8 31 24 94 Colliberty Mob: + 46 70 558 25 24 Torsgatan 72 Email: johanc(a)easypublisher.com SE-113 37 STOCKHOLM Skype: colliberty

2 1

APE and SQL Storages in Zope 2.7
by santi＠zetadb.com 24 Mar '04

24 Mar '04

Hi all, I'm trying to use APE (yesterday CVS version) on Zope 2.7.0 and Postgresql, but I'm not able to make it work. With some minor changes in datatypes.py (change loadConf for load_conf), it works fine using FSConnection, but DBAPIConnection seems not to be ready to work together with ZConfig machinery. Is there any way to have a working config for postgresql and zope 2.7 ? Or everybody is working with FileSystem storages and SQL storages are just working with zope 2.6 ? Thanks in advance Santi Camps http://zetadb.sourceforge.net

4 4