- Zope-Dev - Zope lists

Bug in careful_getattr()?
by Jeff Hoffman 22 Aug '00

22 Aug '00

Hello, I have been fighting a problem with PythonMethods/ZClasses. I have a ZClass, MyTestClass, which has four methods: method1 (DTML Method) method2 (DTML Method) showMethods (DTML Method) showMethods2 (PythonMethod) showMethods is defined as: <dtml-var standard_html_header> method1 = <dtml-var "_.hasattr(this(), 'method1')"> method2 = <dtml-var "_.hasattr(this(), 'method2')"> nullmethod = <dtml-var "_.hasattr(this(), 'nullmethod')"> <dtml-var standard_html_footer> and showMethods2 is defined: print getattr(self, 'method1') print getattr(self, 'method2') print getattr(self, 'nullmethod') return printed showMethods, when invoked on an instance of my ZClass, returns: method1 = 1 method2 = 1 nullmethod = 0 Bingo. showMethods2, the PythonMethod, results in an AttributeError in DT_Util.py:135. Digging into the Zope source, I see: validate=md.validate # line 135 if validate is None: return v By inserting some print statements, I notice that md is an empty dictionary ([]) when careful_getattr() is called. Therefore, the validate=md.validate line throws an AttributeError. I fixed the "problem", and my code as a result, by changing this to read: try: validate=md.validate except: validate=None if validate is None: return v I have a really strong feeling, though, that I just opened a whole can of worms. Does my change break an intended behavior of Zope? Is it supposed to throw an AttributeError when md does not have a 'validate'? If so, is there a bug in PythonMethods that is causing md to not be initialized properly before the call to careful_getattr()? I am pressed for time on this project, and could really use some insight, here. I am fresh out of ideas, and have hit the limits of my knowledge. Thanks, --Jeff --- Jeff K. Hoffman 704.849.0731 x108 Chief Technology Officer mailto:jeff.hoffman@goingv.com Going Virtual, L.L.C. http://www.goingv.com/

1 0

Extended expression syntax for 'sort' attribute of dtml-in tag (sort-python="...").
by Adam Karpierz 22 Aug '00

22 Aug '00

Very please for discussion and acceptance: http://classic.zope.org:8080/Collector/1542/view Regards -- Adam Karpierz karpierz(a)alpha.pl

1 0

Patch for extended expression syntax of dtml-tag attributes.
by Adam Karpierz 22 Aug '00

22 Aug '00

Very please for discussion and acceptance: http://classic.zope.org:8080/Collector/1541/view Regards -- Adam Karpierz karpierz(a)alpha.pl

1 0

Bugs in new Security Stuff :P (part 3)
by Chris Withers 22 Aug '00

22 Aug '00

Finally... I'm not convinced the new security stuff deals properly with attributes other than simple methods. here's the evidence, again from Squishdot (guess what I've been doing ;-) You remember the Posting class? Well, Posting's objects have a text attribute called 'subject' Unless you have __allow_access_to_unprotected_subobjects__=1, you get the following error after you hit cancel on the authentication dialog box that pops up: (well, I was getting an unauthorized error on subject, now I just get no response from the server, not even an password dialog box :( That's really bad...) Anyway, on to the next example... If you modify Squishfile by adding and: __ac_permissions__=( ('View', ['file_name', 'file_type', 'content_type', 'file_bytes', 'file_kbytes', 'date_created', 'date_modified','icon','index_html'], ('Anonymous', 'Manager')), ) and a: Globals.default__class_init__(Squishfile) at the end, things should work fine, of course they don't. Right now, I'm just getting no response from the server, what I was getting (which was better ;-) is an unauthorized error on 'icon'. icon is defined in Squishfile as follows: icon='misc_/Squishdot/squishfile_img' ...and is protected by the 'View' permission as you can see above. What is going on ?! Chris PS: When do you and do you not mix in RoleManager? What does it do and when is it needed? PPS: If anyone wants to test this for themselves, let me know and I'll check my code into the Squishdot public CVS (on a branch! ;-)

1 1

aq_inContextOf/can anyone explain this zmonitor log?
by Bob Pepin 22 Aug '00

22 Aug '00

Hi, I just experienced some very weird behaviour from aq_inContextOf while I was trying to get Cut and Paste to work (I had to trace to the whole security stuff to do this, and read the C source for the acquisition stuff the figure out what aq_inContextOf does of course... thanks for having such a great, consistent, mature and well-documented design Zope-guys...) oh, btw, Copy & Paste seems to work only for objects that have their User Source at the / level because of the behaviour of inContextOf. well, here's the log: Python 1.5.2 (#5, Aug 10 2000, 15:45:20) [GCC 2.95.2 19991024 (release)] Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam Welcome to <secure_monitor_channel connected 127.0.0.1:2625 at 859f680> >>> import Zope import Zope >>> app=Zope.app() app=Zope.app() >>> iee=app.iee iee=app.iee >>> doc1=app.iee.doc1 doc1=app.iee.doc1 >>> doc1.aq_inContextOf(iee) doc1.aq_inContextOf(iee) 0 >>> doc1.aq_inContextOf(app) doc1.aq_inContextOf(app) 1 >>> doc1.aq_inContextOf(app.iee) doc1.aq_inContextOf(app.iee) 0 >>> iee.doc1.aq_inContextOf(app.iee) iee.doc1.aq_inContextOf(app.iee) 0 >>> iee.doc1.aq_inContextOf(iee) iee.doc1.aq_inContextOf(iee) 1 >>> app.iee.doc1.aq_inContextOf(iee) app.iee.doc1.aq_inContextOf(iee) 0 >>> app.iee.doc1.aq_inContextOf(app.iee) app.iee.doc1.aq_inContextOf(app.iee) 0 >>> doc1.aq_inContextOf(iee) doc1.aq_inContextOf(iee) 0 >>> doc1=iee.doc1 doc1=iee.doc1 >>> doc1.aq_inContextOf(iee) doc1.aq_inContextOf(iee) 1 >>> doc1.aq_inContextOf(app.iee) doc1.aq_inContextOf(app.iee) 0 >>> doc1=app.iee.doc1 doc1=app.iee.doc1 >>> doc1.aq_inContextOf(app.iee) doc1.aq_inContextOf(app.iee)

2 2

Bugs in new Security Stuff :P (part 2)
by Chris Withers 22 Aug '00

22 Aug '00

Okay, next up, if it's a security error, it should throw a security error! :( Squishdot Posting's can have file attachments. class Posting(Persistent, Implicit,RoleManager): ... # protected by 'View' permission def attachment(self): file=self.file return file and (file,) or None ... These are stored as attributes in a totally un-security aware class: class Squishfile(Acquirer,Persistent): def file_name(self): return self._name ... posting_html is a DTML method and, in 2.2, fails is this bit (which used to work! ;-): <dtml-if attachment> <dtml-in attachment> <A HREF="./<dtml-var file_name url_quote>"> <IMG SRC="<dtml-var SCRIPT_NAME >/<dtml-var icon>" HEIGHT="16 WIDTH="16" BORDER="0" ALT="Click to download attachment"></A> <A HREF="./<dtml-var file_name url_quote>"><dtml-var file_name></A> <dtml-var file_kbytes>KB (<dtml-var file_bytes> bytes) </dtml-in attachment> </dtml-if attachment> However, the error is rather strange: Error Type: KeyError Error Value: file_name (traceback in PS) This, believe it or not, is actually a security error, since I can make it go away by mixing RoleManager into Squishfile and adding __allow_access_to_unprotected_subobjects__=1 to the class. Why do I get this, which I presume is due to file_name not being available in the stacked namespaces, rather than a security dialog box? confusedly, Chris PS: The above code works fine in the management interface, without any changes to Squishfile, which was the subejct fo my previous post.

1 1

ZServer logging bug (was: Fighting with ZServer)
by Dieter Maurer 21 Aug '00

21 Aug '00

Dieter Maurer writes: > Since this afternoon, I am fighting with ZServer. > .... > > At home: Zope 2.1.6, Intel Linux 2, Linux Netscape 4.5 > > All images are always shown correctly. > However, there is no log entry in "var/Z2.log" for > about 50 % of the requests that are answered by > a 304 response. It is non-deterministic whether > a log entry is written or not. This is partially analysed: ZServer looses log entries, when its client closes the connection too fast. On my linux machine, ZServer looses all log entries, when it answers requests with code 304 to a local httplib client that immediately deletes the reply after "getreply". ZServer uses a "producers.hooked_producer" for logging. Such a producer calls its hook function when the primary producer runs out of data. The hook function performs the logging. When the client closes its socket immediately, then, probably, not all data of the producer is consumed and the hook function is not called --> no log entry. The problem occurs in Zope 2.1.6 and Zope 2.2.1b1 (CVS 2000-8-19). Apparently, the problem is not restricted to code 304. Requests answered with code 404 (not found) seem to be affected, too. Dieter

1 0

Fighting with ZServer
by Dieter Maurer 21 Aug '00

21 Aug '00

Since this afternoon, I am fighting with ZServer. Currently, it seems Zserver is winning .... I do not understand, what I see... At work: Zope 2.1.6, Sparc Solaris 2.7, Linux Netscape 4.51 Sometimes, images are not shown by Netscape (broken image). No "simple" reload is able to change this, however a "forced" reload lets Netscape show the image correctly. From then on, the image is always shown correctly: by "simple" reload, "forced" reload or directly (served from cache). The strange thing, inside "Image.index_html" the failing "simple" reload and the succeeding "forced" reload look completely identical. At home: Zope 2.1.6, Intel Linux 2, Linux Netscape 4.5 All images are always shown correctly. However, there is no log entry in "var/Z2.log" for about 50 % of the requests that are answered by a 304 response. It is non-deterministic whether a log entry is written or not. Did you ever see something like this? Dieter

1 0

RE: [Zope-dev] Re: __ac_permissions__ question
by Brian Lloyd 21 Aug '00

21 Aug '00

> > Assertions made on a method in a subclass override the > assertions made > > in the base class. > > Okay, Posting has the following list of methods for the 'view' > permission: > ['date_posted','body_len','date_created','time_created','attac > hment','thread_path','index_html','showBody', > > 'desc_items','dupString','striptags','tpId','tpURL','this','ha > s_items','thread','title','author','body', > 'email','subject'] > > Now, what I want to do is add the following methods to this > list for the > Article class which subclasses Posting: > ['prev_item','next_item','showSummary','desc_items'] > > How do I do that? class Article(Posting): __ac_permissions__ = ( ('View', ('prev_item','next_item','showSummary','desc_items'), ('Anonymous', 'Manager')), ) It may be helpful to think of it this way: - the class that defines an attribute/method is responsible for protecting it (declaring it in a permission or with other security assertions) - a class doesn't have to worry about assertions made by its base classes (the base classes will have worried about the attrs they defined) - any class that defines security info must be initialized with default__class_init__ for the right thing to happen. Note that the only time you really have to care about what your base classes did is if you need to redefine the permission used cover an inherited attribute. For ex: class Posting: # doAction_A is under view permission __ac_permissions__ = ( ('View', ('doAction_A',), ('Anonymous', 'Manager')), ) def doAction_A(self): ... class Article(Posting): # For Articles, I want doAction_A to be under the 'Spam' # permission. __ac_permissions__ = ( ('View', ('doAction_B',), ('Anonymous', 'Manager')), ('Spam', ('doAction_A',), ('Anonymous', 'Manager')), ) Hope this helps! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

__ac_permissions__ question
by Chris Withers 21 Aug '00

21 Aug '00

If I define the following in an Article class (which subclasses Posting): __ac_permissions__ = Posting.__ac_permissions__ + ( ('View', ['prev_item','next_item','showSummary','desc_items'], ('Anonymous', 'Manager')), ) and Posting.__ac_permissions__ also defines a 'View' permission, which methods are covered? (the ones from Posting, the ones from Article or (hopefully) the union of the two sets of methods) cheers, Chris PS: If it's nto the union, how can I achieve this effect?

2 5