March 2005 - Zope-Dev

More robust cookie handling
by S.Aeschbacher 30 Mar '05

30 Mar '05

Hi during some testing I did I stumbled over this problem. When a client which is accessing a page on a Zope server sends a _ZopeId with other spelling (e.g. _ZOPEID). Zope does not accept the cookie and (obviously) sends a new value in the answer. According to RFC 2965 and RFC 2109 (defines the Set-Cookie header but is obsolete by RFC 2965) the NAME part of a name-value pair is treated case-insensitive. I'm not sure if this is a issue worth bothering as all user-agents seem to leave the NAME part intact (except my self-written test-suite ;). Changing the behaviour to ignore the case of the name would make it somewhat more robust. If you think it is worth bothering I will open an Issue in the Collector. regards Stefan

2 2

Problems with zope 2.7.0 and ZODB (suse 9.1)
by Antonio Beamud Montero 30 Mar '05

30 Mar '05

Hi all: I get the next errors, when I try to add some of my Product Instances... (In zope 2.5.0 works well...) 2005-03-29T18:52:47 INFO(0) ZODB Opening database for mounting: '1110315472_1112115167.490661' ------ 2005-03-29T18:52:47 PROBLEM(100) ZODB Failed to mount database. exceptions.AttributeError ('NoneType' object has no attribute 'getVersion') Traceback (most recent call last): File "/opt/zope/lib/python/ZODB/Mount.py", line 168, in _getOrOpenObject conn, newMount, mcc = self._openMountableConnection(parent) File "/opt/zope/lib/python/ZODB/Mount.py", line 142, in _openMountableConnection conn = db.open(version=jar.getVersion()) AttributeError: 'NoneType' object has no attribute 'getVersion' ------ 2005-03-29T18:52:47 PROBLEM(100) ZODB Failed to mount database. exceptions.AttributeError ('NoneType' object has no attribute 'getVersion') Traceback (most recent call last): File "/opt/zope/lib/python/ZODB/Mount.py", line 168, in _getOrOpenObject conn, newMount, mcc = self._openMountableConnection(parent) File "/opt/zope/lib/python/ZODB/Mount.py", line 142, in _openMountableConnection conn = db.open(version=jar.getVersion()) AttributeError: 'NoneType' object has no attribute 'getVersion' ------ 2005-03-29T18:52:47 PROBLEM(100) ZODB Failed to mount database. exceptions.AttributeError ('NoneType' object has no attribute 'getVersion') Traceback (most recent call last): File "/opt/zope/lib/python/ZODB/Mount.py", line 168, in _getOrOpenObject conn, newMount, mcc = self._openMountableConnection(parent) File "/opt/zope/lib/python/ZODB/Mount.py", line 142, in _openMountableConnection conn = db.open(version=jar.getVersion()) AttributeError: 'NoneType' object has no attribute 'getVersion' What I'm doing wrong? Thanks...

2 1

heads-up: trunk(2.8) and five-integration branch merge
by Brian Lloyd 30 Mar '05

30 Mar '05

hiya - Just a head's up that I going to try to merge the five-integration branch to the trunk in a bit so Tim can get unblocked on stitching in the newest ZODB. Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

1 0

Re: [Zope-Coders] Re: Question about procedures
by martin f krafft 30 Mar '05

30 Mar '05

[moved from -coders to -dev] First off: I will go with Lennart's suggestion of branches; I fundamentally agree; I have just never worked on a project where branches for such petty things aren't overkill. I guess Zope is a number of magnitudes larger. :) Now sorry for the noise on zope-coders when this should have been on zope-dev in the first place. Now for some of the things that Florent pointed out: also sprach Florent Guillaume <fg(a)nuxeo.com> [2005.03.24.1814 +0100]: > > - if RESPONSE is not None: > > + if RESPONSE is not None and ob: > > You should check 'and ob is not None' too. ... but ob is false when it is None, no? > But why could it be None ? What's the point (sorry I don't have > context). Well, I was trying to guard against errors made in other parts of the code. I know I should not do this. It made things a lot easier while I was preparing some other patches. Anyway, good thing I haven't committed. :) > > + if not hasattr(ob, 'absolute_url'): > > Do not use hasattr for persistent objects. Use > if getattr(ob, 'absolute_url', None) is None: Can I read up on the rationale somewhere? > > + raise TypeError('constructInstance did not return a CMF object.') > > Also, check your indentation (should be 4 chars). Woops. > > - return ob.getId() > > + return getattr(ob, 'id', None) > > Please don't do that, getId() is the proper API to call. Another instance of "what to do when ob does not have an getId method".. you are right, this is wrong. also sprach Andreas Jung <lists(a)andreas-jung.com> [2005.03.25.0945 +0100]: > For changes which are limited to a file or a subtree I do always > prefer a patch instead of a branch. I can create a branch and submit patches to you (this is when I wish zope.org would be using GNU arch). Anyway, since it's probably best for me not to make changes in the code at present time (being young in the project and without an assigned field of responsibility), where do I send potential patches? This list? -- martin; (greetings from the heart of the sun.) \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck invalid/expired pgp subkeys? use subkeys.pgp.net as keyserver! spamtraps: madduck.bogus(a)madduck.net "next the statesmen will invent cheap lies, putting the blame upon the nation that is attacked, and every man will be glad of those conscience-soothing falsities, and will diligently study them, and refuse to examine any refutations of them; and thus he will by and by convince himself that the war is just, and will thank god for the better sleep he enjoys after this process of grotesque self-deception." -- mark twain

4 4

Strange aq_aquire bug
by Florent Guillaume 25 Mar '05

25 Mar '05

Zope bug 1730 led me to the strange following behavior of aq_acquire with a unicode special name: >>> from Acquisition import Implicit, aq_acquire >>> class C(Implicit): ... pass ... >>> ob1 = C() >>> ob2 = C() >>> a = ob1.__of__(ob2) >>> getattr(a, u'aq_parent') <C instance at 40fc1790> >>> aq_acquire(a, u'aq_parent') Traceback (most recent call last): File "<stdin>", line 1, in ? AttributeError: aq_parent Just a note so that you can ensure it's okay in Zope 2.8's Acquisition. Florent -- Florent Guillaume, Nuxeo (Paris, France) CTO, Director of R&D +33 1 40 33 71 59 http://nuxeo.com fg(a)nuxeo.com

1 0

Checkins not appearing
by Florent Guillaume 25 Mar '05

25 Mar '05

I made yesterday some checkins on the Zope-2.7 branch, which didn't appear on the zope-checkins list. FYI they're below. I'm porting them to trunk right now. Florent Index: doc/CHANGES.txt =================================================================== RCS file: /cvs-repository/Zope/doc/Attic/CHANGES.txt,v retrieving revision 1.625.2.309 diff -u -r1.625.2.309 CHANGES.txt --- doc/CHANGES.txt 18 Mar 2005 15:31:01 -0000 1.625.2.309 +++ doc/CHANGES.txt 24 Mar 2005 18:32:34 -0000 @@ -11,6 +11,10 @@ - DateIndex/DateRangeIndexes did not reset their __len__ attribute properly when cleared + - Fixed brain.getObject() to correctly traverse to an object even + if one of its parents is not accessible, to be close to what the + Publisher does. + Zope 2.7.5 final (2005/03/20) Bugs fixed Index: lib/python/Products/ZCatalog/CatalogBrains.py =================================================================== RCS file: /cvs-repository/Products/ZCatalog/Attic/CatalogBrains.py,v retrieving revision 1.8.44.1 diff -u -r1.8.44.1 CatalogBrains.py --- lib/python/Products/ZCatalog/CatalogBrains.py 23 Mar 2004 20:27:23 -0000 1.8.44.1 +++ lib/python/Products/ZCatalog/CatalogBrains.py 24 Mar 2005 18:32:35 -0000 @@ -42,12 +42,24 @@ def getObject(self, REQUEST=None): """Return the object for this record - + Will return None if the object cannot be found via its cataloged path (i.e., it was deleted or moved without recataloging), or if the user is - not authorized to access an object along the path. + not authorized to access the object. + + This method mimicks a subset of what publisher's traversal does, + so it allows access if the final object can be accessed even + if intermediate objects cannot. """ - return self.aq_parent.restrictedTraverse(self.getPath(), None) + path = self.getPath().split('/') + if not path: + return None + parent = self.aq_parent + if len(path) > 1: + parent = parent.unrestrictedTraverse('/'.join(path[:-1]), None) + if parent is None: + return None + return parent.restrictedTraverse(path[-1], None) def getRID(self): """Return the record ID for this object.""" Index: lib/python/Products/ZCatalog/tests/testBrains.py =================================================================== RCS file: /cvs-repository/Products/ZCatalog/tests/Attic/testBrains.py,v retrieving revision 1.1.4.1 diff -u -r1.1.4.1 testBrains.py --- lib/python/Products/ZCatalog/tests/testBrains.py 23 Mar 2004 20:27:23 -0000 1.1.4.1 +++ lib/python/Products/ZCatalog/tests/testBrains.py 24 Mar 2005 18:32:35 -0000 @@ -23,15 +23,17 @@ """Happy content""" def __init__(self, id): self.id = id + def check(self): + pass class Secret(Happy): """Object that raises Unauthorized when accessed""" - def __of__(self, parent): + def check(self): raise Unauthorized class Conflicter(Happy): """Object that raises ConflictError when accessed""" - def __of__(self, parent): + def check(self): raise ConflictError class DummyRequest(Acquisition.Implicit): @@ -50,10 +52,20 @@ '/conflicter':Conflicter('conflicter')} _paths = _objs.keys() + ['/zonked'] _paths.sort() - + + # This is sooooo ugly + + def unrestrictedTraverse(self, path, default=None): + assert path == '' # for these tests... + return self + def restrictedTraverse(self, path, default=_marker): + if not path.startswith('/'): + path = '/'+path try: - return self._objs[path].__of__(self) + ob = self._objs[path].__of__(self) + ob.check() + return ob except (KeyError, Unauthorized): if default is not _marker: return default Index: lib/python/Products/ZCatalog/tests/testCatalog.py =================================================================== RCS file: /cvs-repository/Products/ZCatalog/tests/Attic/testCatalog.py,v retrieving revision 1.22.12.6 diff -u -r1.22.12.6 testCatalog.py --- lib/python/Products/ZCatalog/tests/testCatalog.py 18 May 2004 14:48:49 -0000 1.22.12.6 +++ lib/python/Products/ZCatalog/tests/testCatalog.py 24 Mar 2005 18:32:35 -0000 @@ -26,6 +26,10 @@ from Products.ZCatalog import ZCatalog,Vocabulary from Products.ZCatalog.Catalog import Catalog, CatalogError import ExtensionClass +from OFS.Folder import Folder as OFS_Folder +from AccessControl.SecurityManagement import setSecurityManager +from AccessControl.SecurityManagement import noSecurityManager +from AccessControl import Unauthorized from Products.PluginIndexes.FieldIndex.FieldIndex import FieldIndex from Products.PluginIndexes.TextIndex.TextIndex import TextIndex @@ -60,18 +64,6 @@ # XXX What's this mean? What does this comment apply to? ################################################################################ -# XXX These imports and class don't appear to be needed? -## from AccessControl.SecurityManagement import newSecurityManager -## from AccessControl.SecurityManagement import noSecurityManager - -## class DummyUser: - -## def __init__( self, name ): -## self._name = name - -## def getUserName( self ): -## return self._name - def sort(iterable): L = list(iterable) L.sort() @@ -584,7 +576,82 @@ expected.sort() expected = [rid for sortkey, rid, getitem in expected] self.assertEqual(merged_rids, expected) - + + +class PickySecurityManager: + def __init__(self, badnames=[]): + self.badnames = badnames + def validateValue(self, value): + return 1 + def validate(self, accessed, container, name, value): + if name not in self.badnames: + return 1 + raise Unauthorized(name) + +class Folder(OFS_Folder): + def __init__(self, id): + self._setId(id) + OFS_Folder.__init__(self) + +class TestZCatalogGetObject(unittest.TestCase): + # Test what objects are returned by brain.getObject() + + def setUp(self): + catalog = ZCatalog.ZCatalog('catalog') + catalog.addIndex('id', 'FieldIndex') + root = Folder('') + root.getPhysicalRoot = lambda: root + self.root = root + self.root.catalog = catalog + + def tearDown(self): + noSecurityManager() + + def test_getObject_found(self): + # Check normal traversal + root = self.root + catalog = root.catalog + root.ob = Folder('ob') + catalog.catalog_object(root.ob) + brain = catalog.searchResults()[0] + self.assertEqual(brain.getPath(), '/ob') + self.assertEqual(brain.getObject().getId(), 'ob') + + def test_getObject_missing(self): + # Check that if the object is missing None is returned + root = self.root + catalog = root.catalog + root.ob = Folder('ob') + catalog.catalog_object(root.ob) + brain = catalog.searchResults()[0] + del root.ob + self.assertEqual(brain.getObject(), None) + + def test_getObject_restricted(self): + # Check that if the object's security does not allow traversal, + # None is returned + root = self.root + catalog = root.catalog + root.fold = Folder('fold') + root.fold.ob = Folder('ob') + catalog.catalog_object(root.fold.ob) + brain = catalog.searchResults()[0] + # allow all accesses + pickySecurityManager = PickySecurityManager() + setSecurityManager(pickySecurityManager) + self.assertEqual(brain.getObject().getId(), 'ob') + # disallow just 'ob' access + pickySecurityManager = PickySecurityManager(['ob']) + setSecurityManager(pickySecurityManager) + self.assertEqual(brain.getObject(), None) + # disallow just 'fold' access + pickySecurityManager = PickySecurityManager(['fold']) + setSecurityManager(pickySecurityManager) + ob = brain.getObject() + self.failIf(ob is None) + self.assertEqual(ob.getId(), 'ob') + + def test_suite(): suite = unittest.TestSuite() suite.addTest( unittest.makeSuite( TestAddDelColumn ) ) @@ -593,6 +660,7 @@ suite.addTest( unittest.makeSuite( TestCatalogObject ) ) suite.addTest( unittest.makeSuite( TestRS ) ) suite.addTest( unittest.makeSuite( TestMerge ) ) + suite.addTest( unittest.makeSuite( TestZCatalogGetObject ) ) return suite if __name__ == '__main__': -- Florent Guillaume, Nuxeo (Paris, France) CTO, Director of R&D +33 1 40 33 71 59 http://nuxeo.com fg(a)nuxeo.com

1 0

Patch: Enable Unicode in ParsedXML
by Patrick DECAT 24 Mar '05

24 Mar '05

Hi, this is my first post to this list so I'm not sure this is proper way to submit a patch. If it is not, please direct me to the correct place. This patch enables Unicode characters in qualified names for XML documents stored with the ParsedXML product. Best regards, Patrick. pdecat@localhost /cygdrive/c/Program Files/Zope-2.7.2-0/Zope-Instance/Products/ParsedXML/DOM $ diff -c Core.py.orig Core.py *** Core.py.orig Tue Apr 27 16:06:20 2004 --- Core.py Thu Mar 24 12:14:26 2005 *************** *** 70,76 **** return None return 1 # Indicates "passed". else: ! _ok_qualified_name = sre.compile('[a-zA-Z_:][\w\.\-_:]*\Z').match del sre _TupleType = type(()) --- 70,76 ---- return None return 1 # Indicates "passed". else: ! _ok_qualified_name = sre.compile('[a-zA-Z_:][\w\.\-_:]*\Z',sre.UNICODE).match del sre _TupleType = type(())

2 3

Clarification re: Zope X3.1, 2.8
by Brian Lloyd 23 Mar '05

23 Mar '05

Hi all, There have been a number of threads going on today re: Zope X3.1 feature freeze and the 2.8 effort. I'd like to clarify some decisions re: Zope 2.8 Jim is the product mgr for Zope 3 and I'm it for Zope 2, so hopefully this can be considered authoritative and end part of this thread ;) - Zope 2.8 will include X3.0 (not X3.1) - The Z3 developers will have *no* extra burden or responsibility to support X3.0 beyond what they would normally do in the normal course of maintaining it for Z3-only applications. In other words, it is not the responsibility of Z3 devs to make sure Z2 tests pass, etc. - It *will be* the responsibility of the Zope 2 devs to make sure Z2 works with the version of Z3 bundled at the time. - In the next few days at most, after a few loose ends are wrapped up, we'll ask Andreas to make a 2.8 beta 1 release. While Jim still has a few things to do, people will be able to start using the beta for real work. - Anyone who cant wait for that can use the five-integration branch in SVN - As a community, we will work out how best to adapt the Zope 2 release process and schedule to that of Zope 3 going forward. We don't need to decide this immediately to continue to make progress on 2.8. I suggest an IRC meeting sometime soon to draft a proposal. Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

11 29

[ATT] BTrees conflict resolution leads to index inconsistencies
by Dieter Maurer 23 Mar '05

23 Mar '05

[Crosspost] Please followup to "zodb-dev(a)zope.org". Zope indexes use code like this to remove document ids from document lists: def removeForwardIndexEntry(self, entry, documentId): indexRow = self._index[entry] indexRow.remove(documentId) if not indexRow: del self._index[entry] If a concurrent transaction adds a document id to the same "indexRow", then this document id can be lost because it is inserted into a document list discarded by the other transaction. Under normal conditions, a "ConflictError" would result because two transactions modify the same object (the document list). However, the BTrees conflict resolution prevents the "ConflictError" and allows the loss. The result is an index inconsistency: the forward index ("_index") entry and the backward one ("_unindex") not longer correspond. Further operations lead to "unable to remove documentId from document list" exceptions. I suggest to tighten BTrees conflict resolution not to allow concurrent insertions when a bucket was emptied. -- Dieter

2 1

ZCatalog getObject broken
by Roché Compaan 21 Mar '05

21 Mar '05

Last year in March the following checkin was made that changed ZCatalog's getObject to use restrictedTraverse instead of unrestrictedTraverse. See: http://mail.zope.org/pipermail/zope-checkins/2004-March/026846.html In my opininion this is wrong, and just cost me a good three hours to figure out why big parts of one of our apps broke after an upgrade to Zope 2.7.3. What's worse is that there is nowhere a trace of this change in HISTORY.txt or CHANGES.txt. Anybody with a site structure that has less restrictive access deeper into the site would agree that getObject should do an unrestrictedTraverse. restrictedTraverse returns None as soon as it traverses an object a user does not have access to, regardless if the user has access to the object referred to by the full path. To illustrate imagine the following: You have a site with a folder containg documents at '/documents'. Inside that folder you have a whole bunch of documents where users have a local role of owner to give them permission to access only their own documents. You use a Catalog query to get the list of documents belonging to a particular user and want to use getObject to retrieve the objects found. But, it won't work because restrictedTraverse already fails when traversing the 'documents' folder. I would propose that getObject does an unrestrictedTraverse of the path and then checks if the user has permission to access that the object. -- Roché Compaan Upfront Systems http://www.upfrontsystems.co.za

8 31