July 2007 - Zope-Dev

Zope Tests: 5 OK
by Zope Tests Summarizer 12 Jul '07

12 Jul '07

Summary of messages to the zope-tests list. Period Wed Jul 11 12:00:00 2007 UTC to Thu Jul 12 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Wed Jul 11 20:56:14 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008017.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Wed Jul 11 20:57:45 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008018.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Wed Jul 11 20:59:15 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008019.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Wed Jul 11 21:00:47 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008020.html Subject: OK : Zope-trunk Python-2.4.4 : Linux From: Zope Unit Tests Date: Wed Jul 11 21:02:18 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008021.html

1 0

vulnerability in zope 2.10.4
by Andreas Zeidler 12 Jul '07

12 Jul '07

hi, imho i've found a vulnerability in zope 2.10.4 or rather in the newer version of five (1.5.5) used by it. in `Five/browser/ pagetemplatefile.py` in line 27 `createTrustedZopeEngine` is used the instantiate the page template engine used by five templates, or at least this is what i think it does. the problem with this is that `trustedBoboAwareZopeTraverse` (in `PageTemplates/Expressions.py`) gets used to traverse path-expressions using `unrestrictedTraverse` (line 100), which means that i can access say the title of an otherwise private object with a simple "obj/Title". i ran into this when one of my doctests[1] failed after upgrading from zope 2.10.3 to 2.10.4, because it could now access the title, even though permissions are explicitly set up beforehand to prevent this. using `createZopeEngine` instead of `createTrustedZopeEngine` didn't help with the test, unfortunately, since this would then raise an `Unauthorized` right away when rendering the `folder_contents` view. however, if i defer resetting the roles of the test user to just before the "click" on 'Delete' (line 35 in the test), the test works again... i've also just verified this ttw by creating a simple five view and a "file" object. i can successfully access the "title" attribute using the view, even though "view" and "access contents information" permissions are set up so only the "manager" role can access the object. dropping in zope 2.10.3 things work as expected, that is an `Unauthorized` exception is raised. so, unless i'm completely wrong here, i'd say this is a pretty serious security whole, no? cheers, andi [1] http://dev.plone.org/plone/browser/plone.app.linkintegrity/trunk/ plone/app/linkintegrity/docs/testReferalToPrivateFiles.txt?rev=16003 -- zeidler it consulting - http://zitc.de/ - info(a)zitc.de friedelstraße 31 - 12047 berlin - telefon +49 30 25563779 pgp key at http://zitc.de/pgp - http://wwwkeys.de.pgp.net/ sprint with us! - http://plone.org/events/sprints/potsdam-sprint-2007

3 4

Zope Tests: 5 OK
by Zope Tests Summarizer 11 Jul '07

11 Jul '07

Summary of messages to the zope-tests list. Period Tue Jul 10 12:00:00 2007 UTC to Wed Jul 11 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Tue Jul 10 20:53:20 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008012.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Tue Jul 10 20:54:51 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008013.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Tue Jul 10 20:56:23 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008014.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Tue Jul 10 20:57:54 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008015.html Subject: OK : Zope-trunk Python-2.4.4 : Linux From: Zope Unit Tests Date: Tue Jul 10 20:59:28 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008016.html

1 0

Zope Tests: 5 OK
by Zope Tests Summarizer 10 Jul '07

10 Jul '07

Summary of messages to the zope-tests list. Period Mon Jul 9 12:00:00 2007 UTC to Tue Jul 10 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Mon Jul 9 21:23:24 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008007.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Mon Jul 9 21:24:55 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008008.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Mon Jul 9 21:26:26 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008009.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Mon Jul 9 21:27:59 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008010.html Subject: OK : Zope-trunk Python-2.4.4 : Linux From: Zope Unit Tests Date: Mon Jul 9 21:29:30 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008011.html

1 0

Zope Tests: 4 OK
by Zope Tests Summarizer 09 Jul '07

09 Jul '07

Summary of messages to the zope-tests list. Period Sun Jul 8 12:00:00 2007 UTC to Mon Jul 9 12:00:00 2007 UTC. There were 4 messages: 4 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Sun Jul 8 20:48:02 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008003.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Sun Jul 8 20:49:33 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008004.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Sun Jul 8 20:51:07 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008005.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Sun Jul 8 20:52:39 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008006.html

1 0

Zope Tests: 5 OK
by Zope Tests Summarizer 08 Jul '07

08 Jul '07

Summary of messages to the zope-tests list. Period Sat Jul 7 12:00:00 2007 UTC to Sun Jul 8 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Sat Jul 7 20:53:18 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007998.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Sat Jul 7 20:54:49 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007999.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Sat Jul 7 20:56:21 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008000.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Sat Jul 7 20:57:52 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008001.html Subject: OK : Zope-trunk Python-2.4.4 : Linux From: Zope Unit Tests Date: Sat Jul 7 20:59:25 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/008002.html

1 0

Zope Tests: 5 OK
by Zope Tests Summarizer 07 Jul '07

07 Jul '07

Summary of messages to the zope-tests list. Period Fri Jul 6 12:00:00 2007 UTC to Sat Jul 7 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Fri Jul 6 20:54:21 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007993.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Fri Jul 6 20:55:55 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007994.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Fri Jul 6 20:57:26 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007995.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Fri Jul 6 20:58:57 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007996.html Subject: OK : Zope-trunk Python-2.4.4 : Linux From: Zope Unit Tests Date: Fri Jul 6 21:00:29 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007997.html

1 0

Zope 2.11.0b1 plans
by Andreas Jung 06 Jul '07

06 Jul '07

Hi, now that Zope 3.4.0b1 has been tagged, I plan to release Zope 2.11.0b1 by mid-July. Objections? Andreas -- ZOPYX Ltd. & Co. KG - Charlottenstr. 37/1 - 72070 Tübingen - Germany Web: www.zopyx.com - Email: info(a)zopyx.com - Phone +49 - 7071 - 793376 Registergericht: Amtsgericht Stuttgart, Handelsregister A 381535 Geschäftsführer/Gesellschafter: ZOPYX Limited, Birmingham, UK ------------------------------------------------------------------------ E-Publishing, Python, Zope & Plone development, Consulting

3 7

Zope Tests: 5 OK
by Zope Tests Summarizer 06 Jul '07

06 Jul '07

Summary of messages to the zope-tests list. Period Thu Jul 5 12:00:00 2007 UTC to Fri Jul 6 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --------------- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Thu Jul 5 20:57:18 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007988.html Subject: OK : Zope-2.8 Python-2.3.6 : Linux From: Zope Unit Tests Date: Thu Jul 5 20:58:49 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007989.html Subject: OK : Zope-2.9 Python-2.4.4 : Linux From: Zope Unit Tests Date: Thu Jul 5 21:00:32 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007990.html Subject: OK : Zope-2.10 Python-2.4.4 : Linux From: Zope Unit Tests Date: Thu Jul 5 21:02:09 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007991.html Subject: OK : Zope-trunk Python-2.4.4 : Linux From: Zope Unit Tests Date: Thu Jul 5 21:03:46 EDT 2007 URL: http://mail.zope.org/pipermail/zope-tests/2007-July/007992.html

1 0

Fix for "request must be post" at "Take Ownership"
by Jonas Meurer 05 Jul '07

05 Jul '07

Hello, When do you plan to add the fix for "request must be post" at "Take Ownership" to a stable zope 2.10 release? It seems like this bug has been introduced with zope 2.10.2 or 2.10.3. An example of the bug can be found at http://zope.pastey.net/56726 It seems like you already submitted a fix to the svn trunk, see http://mail.zope.org/pipermail/zope-checkins/2007-March/032104.html But unfortunately this didn't went into a stable release yet. So my question is, do you plan to add this fix to the next zope2.10 stable release? greetings, jonas -- "In post-historical society, the rulers have ceased to rule, but the slaves remain slaves." - Perry Anderson

4 4