July 2006 - Zope-Dev

Traversal issue which affects Five
by Alec Mitchell 21 Aug '06

21 Aug '06

Hi all, It seems that the way OFS.Traversable.restrictedTraverse() handles security checking on objects with __bobo_traverse__ methods is considerably different from the way it normally checks security. The result is that traversal cannot obtain attributes using acquisition from objects that are marked <five:traversable>. In the normal case, security is checked using guarded_getattr, which gets an attribute and checks the permissions on the retrieved object in its original context. For __bobo_traverse__methods which return simple properties (say strings), it is impossible to determine the container from which the returned attribute originates, so unless the attribute was not acquired, an Unauthorized error will always be raised. Objects that are Five Traversable always have __bobo_traverse__ methods which attempt to mimic normal traversal, which effectively means that the security checks end up preventing acquisition of simple properties using traversal from ever working on these objects (say using a TAL path expression 'context/attribute' which you expect to be acquired). Unfortunately, because Five has no control over the security checks done during traversal, this cannot be fixed directly in Five. However, IMHO fixing this makes sense for Zope itself, provided there aren't any undesirable consequences. I propose that if the validation of a __bobo_traverse result raises Unauthorized, that we make one last check to see if the result o 'guarded_getattr(obj, name)' is identical to the result of the __bobo_traverse__ call and allow it if that's the case. Here is my proposed patch against Zope 2.9 trunk: --- Traversable.py (revision 66323) +++ Traversable.py (working copy) @@ -201,9 +201,18 @@ else: # Can't determine container container = _none - if not securityManager.validate( - obj, container, name, next): - raise Unauthorized, name + try: + if not securityManager.validate( + obj, container, name, next): + raise Unauthorized, name + except Unauthorized: + # If next is a simple unwrapped property, it's + # parentage is indeterminate, but it may have been + # acquired safely. In this case validate will raise + # an error, and we can check that our value was + # acquired safely. + if guarded_getattr(obj, name, marker) is not next: + raise Unauthorized, name else: if restricted: next = guarded_getattr(obj, name, marker) At the moment Plone 2.5 is really struggling with this issue, and it would be wonderful if a fix for this could go into Zope 2.8 and 2.9 soon. I'm happy to write tests for this, I just want to make sure that I'm not proposing something really wrong/inappropriate here. Generally, the validate() call should return a True or False value, so this change should have little performance impact except in the case where 'container == _none' and validate would otherwise raise a very unhelpful unauthorized error. Your feedback is much appreciated. Alec Mitchell

6 16

Windows Installers
by Sidnei da Silva 01 Aug '06

01 Aug '06

Hey all, Seems like we are seeing a shortage of volunteers for building the Zope Installers for Windows. I haven't seen Tim Peters around for a while, and Chris Withers seems to have stepped down now. I've chatted with Alan Runyan and he agreed to dedicate a person for doing this in exchange of a little publicity. Quoting him: """ Our build system has become quite extensive over the past two years. I would love to build the Zope installers. I would also appreciate some attribution on the first graphic that is displayed. Basically at the bottom about 20% of the graphic would say: '[LOGO] windows installer courtesy of Enfold System' """ Another alternative would be to add the installer as build to the buildbot @ zope.org, then we would have 'nightly' installer builds and once a release was cut one could just take one of these installers and declare it official. Thoughts? -- Sidnei da Silva Enfold Systems http://enfoldsystems.com Fax +1 832 201 8856 Office +1 713 942 2377 Ext 214

2 4

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 29 Jul '06

29 Jul '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 6781 Blamelist: andreasjung,benji_york,dominikhuber,hdima,poster,tseaver BUILD FAILED: failed compile sincerely, -The Buildbot

1 0

Demostorage w/ ZEO broken again?
by Christian Theune 27 Jul '06

27 Jul '06

Is Demostorage w/ ZEO broken in 2.9 again? I just hit that again ... That's on (Zope 2.9.3-, python 2.4.3, linux2) Error is: File "/usr/local/Zope-2.9.3/lib/python/ZODB/BaseStorage.py", line 108, in __init__ self._oid = base._oid AttributeError: 'ClientStorage' object has no attribute '_oid' I had a somewhat working fix for that on Zope 3.2/3.3 but Jim thought just making it ignore the _oid attribute isn't the right thing to do -- and he might be right, I don't know. @Tres: Didn't you tame that beast already a while ago? :) Cheers, Christian -- gocept gmbh & co. kg - forsterstraße 29 - 06112 halle/saale - germany www.gocept.com - ct(a)gocept.com - phone +49 345 122 9889 7 - fax +49 345 122 9889 1 - zope and plone consulting and development

2 1

buildbot failure in Zope trunk 2.4 Windows 2000 zc-bbwin6
by buildbot＠zope.com 27 Jul '06

27 Jul '06

The Buildbot has detected a failed build of Zope trunk 2.4 Windows 2000 zc-bbwin6. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 6766 Blamelist: adamg,benji,benji_york,dobe,dominikhuber,fdrake,gotcha,jens,regebro,tseaver BUILD FAILED: failed failed slave lost sincerely, -The Buildbot

1 0

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 27 Jul '06

27 Jul '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 6764 Blamelist: adamg,benji,benji_york,dobe,dominikhuber,fdrake,gotcha,jens,regebro,tseaver BUILD FAILED: failed failed slave lost sincerely, -The Buildbot

1 0

buildbot failure in Zope branches 2.10 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 27 Jul '06

27 Jul '06

The Buildbot has detected a failed build of Zope branches 2.10 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 6765 Blamelist: adamg,benji,benji_york,dobe,dominikhuber,fdrake,gotcha,jens,regebro,tseaver BUILD FAILED: failed failed slave lost sincerely, -The Buildbot

1 0

buildbot failure in Zope trunk 2.4 Windows 2000 zc-bbwin6
by buildbot＠zope.com 24 Jul '06

24 Jul '06

The Buildbot has detected a failed build of Zope trunk 2.4 Windows 2000 zc-bbwin6. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 6737 Blamelist: baijum,benji,benji_york,ctheune,dobe,frerich,hdima,rocky,sidnei,tseaver,yuppie BUILD FAILED: failed compile sincerely, -The Buildbot

1 0

Should PageTemplate._text be a unicode or an encoded string in Zope 2.9.3?
by Chris Withers 22 Jul '06

22 Jul '06

The subject line says it all really ;-) I've had problems when it's an encoded string, but that seems to be what is stored when you save a ZPT via the ZMI or WebDAV... Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

5 17

Re: Zope 2.9.4 broken ? (solved)
by dummy＠habmalnefrage.de 20 Jul '06

20 Jul '06

Hi, I found the solution for my problem: There was a build folder under lib/python called build/lib/lib-i686-2.4/... Don't know where it comes from. Maybe a wrong setup before current install process. Removing lib/python/build solved my problem. Regards, Dirk -- "Feel free" – 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

1 0