- Zope-Dev - Zope lists

replicating storages
by Toby Dickenson 18 Jun '01

18 Jun '01

We are considering storing some mission-critical data inside a ZODB, but are worried about data loss if the ZEO server should be destroyed. Has anyone looked at solving this problem? Replicated-ZEO looks like it will eventually be ideal solution; the use case is documented at <http://www.zope.org/Wikis/DevSite/Projects/ZEOReplicatedStorage/SurviveTota…> Until then, http://www.it.uc3m.es/~ptb/nbd/ looks promising. Has anyone tried FileStorage over a network block device? Toby Dickenson tdickenson(a)geminidataloggers.com

1 0

Zope/z2 security issues
by Ivo van der Wijk 18 Jun '01

18 Jun '01

Hi All, We're currently working on some security issues when running zope in a INSTANCE_HOME (multiple instances running as different users) setup. The first issue is tightening of the current security. We introduced the ability to set the groupid under which the server runs, so you can put zope users in a zope group, not give non-group members read/execute permission (o-rwx) to the instance homes, zope directories, product directories, etc. These patches (along with a zopectl patch) can be found on: http://www.zope.org/Members/maurice The second issue, if z2.py is started as root, it will either setuid() to nobody, or to the username supplied with -u. However, z2.py initializes logging while still runing as root by importing/ using ZLogger. This means that the logfiles will be owned (if they did not yet exist) by root in INSTANCE_HOME/var, while you would want these to be owned by nobody or the user the instance should be running as. z2.py setuid()'s to the non-root user after (optionally) opening privileged ports. If you symlink the logfiles in INSTANCE_HOME/var to /etc (or worse, /etc/passwd or /etc/shadow), you might even be able to destroy these files or insert data into them. The correct solution would probably be something like: - run as root - seteuid(non-root-user) - intialize logging -\ - seteuid(root) } optional (only if privileged ports are required) - open priviliged ports -/ - setuid(non-root-user) (note both the setEuid and setuid calls) However, python 1.5.2 does not have seteuid() so this can/will only work with 2.0/2.1 or zope 2.4 (which requires 2.1) We don't want to run our production zope servers with python > 1.5.2, so our current patch consists of a setuid() at the top of z2.py, we don't run zope on privileged ports anyway. If anyone wants a patch for this, please mail me. Cheers, Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam -=- Tel: +31-20-4688336 Linux/Web/Zope/SQL Fax: +31-20-4688337 Network Solutions Web: http://www.amaze.nl/ Consultancy Email: ivo(a)amaze.nl -=-

1 0

what transaction does get_transaction().commit() really commit?
by Jephte Clain 18 Jun '01

18 Jun '01

hello, I have a method that reads: ------------8<---------------- def do_something(self): from Zope import DB conn = db.open() conn.root()['name'] = 'value' get_transaction().commit() conn.close() ------------8<---------------- the method can be called from everywhere, and that's the reason why I have to open a connection, in case one is not available. the question is: what transaction is commited with get_transaction().commit() ? It is only the one associated with the connection, or also the transaction in which is the caller? I mean, if my method is called from within Zope, is the transaction of the caller commited? thanks for any response regards, jephte.clain(a)univ-reunion.fr ______________________________________________________ Boîte aux lettres - Caramail - http://www.caramail.com

2 1

SI prefixes and Zope
by Petr Knapek 18 Jun '01

18 Jun '01

Hi, I suggest to make Zope prefixes of object sizes be consistent with SI binary prefixes - see http://physics.nist.gov/cuu/Units/binary.html Using SI binary prefixes for object size will avoid any misunderstanding of real object size. Petr -- Petr Knápek Network Development NEXTRA Czech Republic s.r.o. http://www.nextra.cz/ V Celnici 10 / CZ - 117 21 Praha 1 / Czech Republic Tel: +420/2/96 355 111 / Mobile: +420/604-202 611 E-Mail: petr.knapek(a)nextra.com Contact address: Hlinky 114 / CZ - 603 00 Brno / Czech Republic Tel: +420/5/43 554 150 / FAX: +420/5/43 554 214 see Disclaimer http://www.nextra.cz/disclaimer/

1 0

Re: [Zope-dev] DCOracle2 Beta 3
by Andreas Repp 18 Jun '01

18 Jun '01

Sorry, but there were some mistakes in my last posting... >... To solve the performance problem I´d suggest to cache the user > connections for a certain period of time. ... Of course I haven't meant to 'cache' the connections but to keep em alive while the respective user is active and shut it down after a timeout period has passed. >enhanced ZSQL-example: >##(new)connection_id=<dtml-var "'username+','+password' or default_connection_id">, >##arguments=ID,NAME I also know that this will hardly ever work ;-) Maybe this shot would do a better job: ##default_connection_id=(changed via ZSQL manage_main Interface) ##connection_type=[ standard | custom | optional ] ##connection_options=(individual Oracle Connection String) sql yada yada 'standard' = obvious 'custum' = forced custom connection - will raise error if connection_options dont' have a valid connection string 'optional' = try 'custom' and fallback to 'standard' if it fails btw: would be nice to have a drop box in the manage_main screen for this stuff in a _far future_ release of ZSQL-Methods ;-) I noticed that a SQL 'COMMIT' is hardcoded into (old) ZOracle/DCOracle1 code - this would'nt have any more sense if all mentioned is possible but surely you know this. Andy ---------------------------------------------------------------------- Andreas Repp andreas.repp(a)lrz-muenchen.de Leibniz Rechenzentrum Muenchen www.lrz.de ----------------------------------------------------------------------

2 1

html_quote in CVS
by kent sin 18 Jun '01

18 Jun '01

Formulator is broken by the Zope cvs version. It can not import html_quote from DocumentTemplate.DT_Util I found html_quote being moved to DT_Var.py, but after change the Widget.py from DocumentTemplate.DT_Var import html_quote it still report can not import. What should I make this? Does the new 2.4 break many products similarly? Rgs, Kent Sin __________________________________________________ Do You Yahoo!? Spot the hottest trends in music, movies, and more. http://buzz.yahoo.com/

3 2

How to aquire from Context?
by Matt Hamilton 17 Jun '01

17 Jun '01

Dear All, I have been trying to work out how to acquire a DTML method first by context rather than by containment. According to the ZDG (Great read, thanks guys!): -- snip -- Containment Before Context If in the example above suppose both a and b have an color attribute: a=C("a") a.color="green" a.b=C("b") a.b.color="red" a.x=C("x") print a.b.x.color # prints green Why does a.b.x.color acquire color from a and not from b? The answer is that acquisition acquires from the containment before context. -- snip -- Now that makes perfect sense to me and I can see why it happens as such. However what if I want print a.b.x.color to return red? The scenario is this: I have a directory structure: / standard_html_header side_bar folderA foo bar side_bar index_html index_html calls standard_html_header which in turn calls side_bar. If I access this via /folderA/index_html I still get the side_bar in the root not the one in folderA. This makes sense in respect to the above ZDG stuff. But how can I get it to work the way I want (/folderA/index_html uses folderA/side_bar)? I've searched zope.org and found plenty of explainaintions why this is so, but no good examples or workarounds as how to get around it :( Any ideas? -Matt -- Matt Hamilton matth(a)netsight.co.uk Netsight Internet Solutions, Ltd. Business Vision on the Internet http://www.netsight.co.uk +44 (0)117 9090901 Web Hosting | Web Design | Domain Names | Co-location | DB Integration

3 2

RE: PossitionIndex (was: Re: [Zope-dev] ZCatalog phrase indexingr evisited)
by sean.upton＠uniontrib.com 17 Jun '01

17 Jun '01

A lot of folks who do "power searches," say, librarians or other trained researchers, familiar with the bells and whistles of more powerful search engines, will want a simple operator for proximity, with the ability to specify proximity depth: For example: Lexis-Nexis: Sean w/2 Upton (where w/2 is within 2 words) Also, lexis doesn't count stop-words in proximity indexes. Folio/Nextpage: "Sean Upton"@2 IMHO, the syntax is clean and very brief in the Lexis-Nexis case and should suppliment a more generic Sean ... Upton style search. Sean -----Original Message----- From: Chris McDonough [mailto:chrism@digicool.com] Sent: Saturday, June 16, 2001 2:59 AM To: Erik Enge Cc: zope-dev(a)zope.org Subject: Re: PossitionIndex (was: Re: [Zope-dev] ZCatalog phrase indexingrevisited) Erik Enge wrote: > > On Fri, 15 Jun 2001, Chris McDonough wrote: > > > Once you're satisfied with the implementation, would you be willing > > submit the module to the collector? > > Will do. Have you thought about how users actually are to use > exact-phrase? What I'm thinking I will do here (currently I've only been > testing explicitly with "adjoinedby" in the query) is to insert > "adjoinedby" in phrased searches: > > "erik enge" -> erik adjoinedby enge > erik ... enge -> erik near enge > > What do you think? These both look like good spellings, and I think "erik near enge" would be a good alias for "erik ... enge" as well.. - C _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

3 2

security question
by Tim McLaughlin 16 Jun '01

16 Jun '01

It seems to me that a User should not get to keep their roles in the acquired objects which are above the User Folder in which the user is defined... However, that does not seem to be true according my testing. This is what happens. Imagine a tree like this root-folder1-acl_users \folder2-object1 root has a role called 'User' with 'View' permissions (anonymous is disabled) and acl_users has a user called joe. joe can access objects in folder2 according to the permissions set on the root by using acquisition like this: http://server/folder1/folder2/object1 joe cannot however, access them directly: http://server/folder2/object1 Does this seem strange to anybody else, or have I just been working too long? _____________________________________________________ Tim McLaughlin iterationZERO - www.iterationzero.com 703-481-2233

2 1

Re: [Zope-dev] DCOracle2 Beta 3
by Andreas Repp 16 Jun '01

16 Jun '01

> On the far-out front, a few people have asked how you might do > user-specific connections to the database (ie instead of pooling by a > common connection, you individually authenticate to Oracle with your > own password). Clearly, cloning the base Connection object would be > fairly straighforward, but authenticating it to Oracle would not be, > as the user password wouldn't be available. If anyone feels strongly > about that (ie you have a notion on how you would make it work and/or > you need it),feel free to write me. From a performance standpoint it > would be terrible, but security auditors would love it. Hello Matthew, I think this feature would be most useful ! Since I am no (not yet ;-) zope-product developer I can't help you integrating this kind of stuff but I think I can give you some thoughts about it: Of course it would be a great advantage from a security point of view but it would also make it possible to use Oracle's transaction machinery. This would make it much easier for users of OR-mapping products (ie ZPatterns) to wrap insert, update, delete SQL methods into an user Oracle transaction. (I don't know witch impact it would have on products like OracleStorage ...) That way several of above mentioned SQL methods can be aborted in the end without interfering with other users´ actions. Without user based connections this would only be possible, if at all, with a high coding effort. To solve the performance problem I´d suggest to cache new user connections for a certain period of time. To be at all able to transfer the DB-user connection string I´d propose to use a structure similar to Pythonscript for the ZSQL methods. enhanced ZSQL-example: ##(new)connection_id=<dtml-var "username+','+password' or default_connection_id"> ##arguments=ID,NAME insert into SAMPLE (ID,NAME) values ( <dtml-sqlvar ID type="int">, <dtml-sqlvar NAME type="string"> ) (I know that dtml inside the pythonscipt-header is not evaluated but the product developer should be able to make it work that way ...) I assume that this might be a backward compatible approach to solve the issue until some greater spirit has thought about it. A session based connection would be useful as well, but I guess that are dreams of the future ;-) as allways: any comment is very appreciated Andy ---------------------------------------------------------------------- Andreas Repp andreas.repp(a)lrz-muenchen.de Leibniz Rechenzentrum Muenchen www.lrz.de ----------------------------------------------------------------------

1 0