August 2006 - Zope-Dev

buildbot failure in Zope trunk 2.4 Linux zc-buildbot
by buildbot＠zope.com 27 Aug '06

27 Aug '06

The Buildbot has detected a failed build of Zope trunk 2.4 Linux zc-buildbot. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7285 Blamelist: fdrake,gintautasm,jens,jim,lra,mgedmin,mkerrin,philikon,shh BUILD FAILED: failed test sincerely, -The Buildbot

1 0

buildbot failure in Zope trunk 2.4 Linux zc-buildbot
by buildbot＠zope.com 24 Aug '06

24 Aug '06

The Buildbot has detected a failed build of Zope trunk 2.4 Linux zc-buildbot. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7263 Blamelist: shh,yusei BUILD FAILED: failed test sincerely, -The Buildbot

1 0

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 24 Aug '06

24 Aug '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7261 Blamelist: shh,yusei BUILD FAILED: failed compile sincerely, -The Buildbot

1 0

buildbot failure in Zope trunk 2.4 Linux zc-buildbot
by buildbot＠zope.com 24 Aug '06

24 Aug '06

The Buildbot has detected a failed build of Zope trunk 2.4 Linux zc-buildbot. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7259 Blamelist: alecm,gintautasm,mj,poster,regebro,shh,whitmo BUILD FAILED: failed test sincerely, -The Buildbot

1 0

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 24 Aug '06

24 Aug '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7257 Blamelist: Zen,alecm,ctheune,gintautasm,jim,mj,mkerrin,poster,regebro,rogerineichen,shh,srichter,whitmo BUILD FAILED: failed compile sincerely, -The Buildbot

1 0

Hotfix-20060821 does not apply to zope 2.7.0 to 2.7.2?
by Michael Dunstan 24 Aug '06

24 Aug '06

>From what I can tell the feature that is "Hotfix"ed does not appear until Zope 2.7.3. If the Hotfix is installed in Zope 2.7.0 through to 2.7.2 then it shows up as a broken product. No real harm done. The product import breaks with: Traceback (most recent call last): File "/usr/local/www/Zope/lib/python/OFS/Application.py", line 660, in import_product product=__import__(pname, global_dict, global_dict, silly) File "/usr/local/www/Zope/Atrac/Products/Hotfix_20060821/__init__.py", line 8, in ? from docutils.parsers.rst.directives import tables ImportError: cannot import name tables And we see that ``tables`` not show up till Zope 2.7.3 via: http://cvs.zope.org/Zope/lib/python/docutils/parsers/rst/directives/Attic/t… And a casual glance around docutils before ``tables`` was introducded suggests that feature was not part of another module. Cheers Michael

1 0

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 22 Aug '06

22 Aug '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7215 Blamelist: shh BUILD FAILED: failed compile sincerely, -The Buildbot

2 1

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 22 Aug '06

22 Aug '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7214 Blamelist: fdrake,rocky,shh BUILD FAILED: failed compile sincerely, -The Buildbot

1 0

Traversal issue which affects Five
by Alec Mitchell 21 Aug '06

21 Aug '06

Hi all, It seems that the way OFS.Traversable.restrictedTraverse() handles security checking on objects with __bobo_traverse__ methods is considerably different from the way it normally checks security. The result is that traversal cannot obtain attributes using acquisition from objects that are marked <five:traversable>. In the normal case, security is checked using guarded_getattr, which gets an attribute and checks the permissions on the retrieved object in its original context. For __bobo_traverse__methods which return simple properties (say strings), it is impossible to determine the container from which the returned attribute originates, so unless the attribute was not acquired, an Unauthorized error will always be raised. Objects that are Five Traversable always have __bobo_traverse__ methods which attempt to mimic normal traversal, which effectively means that the security checks end up preventing acquisition of simple properties using traversal from ever working on these objects (say using a TAL path expression 'context/attribute' which you expect to be acquired). Unfortunately, because Five has no control over the security checks done during traversal, this cannot be fixed directly in Five. However, IMHO fixing this makes sense for Zope itself, provided there aren't any undesirable consequences. I propose that if the validation of a __bobo_traverse result raises Unauthorized, that we make one last check to see if the result o 'guarded_getattr(obj, name)' is identical to the result of the __bobo_traverse__ call and allow it if that's the case. Here is my proposed patch against Zope 2.9 trunk: --- Traversable.py (revision 66323) +++ Traversable.py (working copy) @@ -201,9 +201,18 @@ else: # Can't determine container container = _none - if not securityManager.validate( - obj, container, name, next): - raise Unauthorized, name + try: + if not securityManager.validate( + obj, container, name, next): + raise Unauthorized, name + except Unauthorized: + # If next is a simple unwrapped property, it's + # parentage is indeterminate, but it may have been + # acquired safely. In this case validate will raise + # an error, and we can check that our value was + # acquired safely. + if guarded_getattr(obj, name, marker) is not next: + raise Unauthorized, name else: if restricted: next = guarded_getattr(obj, name, marker) At the moment Plone 2.5 is really struggling with this issue, and it would be wonderful if a fix for this could go into Zope 2.8 and 2.9 soon. I'm happy to write tests for this, I just want to make sure that I'm not proposing something really wrong/inappropriate here. Generally, the validate() call should return a True or False value, so this change should have little performance impact except in the case where 'container == _none' and validate would otherwise raise a very unhelpful unauthorized error. Your feedback is much appreciated. Alec Mitchell

6 16

buildbot failure in Zope branches 2.9 2.4 Windows 2000 zc-bbwin2
by buildbot＠zope.com 21 Aug '06

21 Aug '06

The Buildbot has detected a failed build of Zope branches 2.9 2.4 Windows 2000 zc-bbwin2. Buildbot URL: http://buildbot.zope.org/ Build Reason: changes Build Source Stamp: 7209 Blamelist: andreasjung,benji_york,jens,jim,jukart,poster,rogerineichen,shh,sidnei,whitmo BUILD FAILED: failed compile sincerely, -The Buildbot

1 0