- Zope-Dev - Zope lists

Re: Zope 2.1.5/6/7 upgrading issues
by Brian Lloyd 16 Jun '00

16 Jun '00

Hi guys, First of all, I'd like to apologize for the pain factor here - there has been some CM process changes around here and the 2.1.x branch is suffering as a result :( I have a proposal, however, that I hope will make this much easier. How about if we: o release a "Product" today that, if you install it and restart your Zope (no matter what version), patches the hole at runtime (in memory change only). o retract the 2.1.7 release in favor of getting 2.2 beta 2 out on Monday, which doesn't have the cruft problem of the 2.1.x branch and contains all fixes to date (and which will fix SQLMethod problems and support the SiteAccess release that Evan is making today). I can have the new "hotfix" product ready by 12:00pm EST today. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 2

Re: [Zope-dev] Re: [Zope] Re: Zope 2.1.5/6/7 upgrading issues
by Adam Karpierz 16 Jun '00

16 Jun '00

>Hi! > > My vote is here: > >On Fri, 16 Jun 2000, Brian Lloyd wrote: >> o retract the 2.1.7 release in favor of getting 2.2 beta 2 >> out on Monday, which doesn't have the cruft problem of >> the 2.1.x branch and contains all fixes to date (and >> which will fix SQLMethod problems and support the SiteAccess >> release that Evan is making today). > > I am not running any production servers (yet), so I better will start to >experiment with new Zope, rather than patching old one. > Other people esp. those who run prod. servers free to have different >opinions :) For me it's not big problem too (yet:) and better way to trying to use new beta rather fighting with old patches and hacks. But.. maybe will be a general problem for contributed products wchich uses MailHost (such as EMarket, ETailer, maybe WordlPilot etc) bacause MailHost API (especially MailHost.add) method was changed in 2.2 branch (in current 2.1.7 too), due to use of standard smtplib module. And there is a big and serious problem (I think not only for me:). On my Win box Zope2.2b1 craches (GFP), dont allow add objects (eg. Folder), dont allow enter Control Panel if product incorect installed, etc.. 2.2b1 is very , very unstable for now. Of course I understand the reasons (a lot of very important changes). If I would help to avoid some problems I can test v2.2b2 extensively, especially on Win32 box (Win98, Win2000) and a little (for comparison of behaviour) on RH Linux. PS: appologize for my 'english' Adam Karpierz karpierz(a)itl.pl

1 0

Updated security alert
by Brian Lloyd 16 Jun '00

16 Jun '00

Hi all - I've updated the security alert (below). Short story: a new "hotfix product" is available on zope.org that will work for all 2.0+ Zopes and has no side effects or upgrade implications for Zope installations. This feels like a much better model for things like this, especially for production sites. ---------------------------------------------------------------- We have recently become aware of an important security issue that affects all released Zope versions including the recent 2.2 beta 1 release. The issue involves an inadequately protected method in one of the base classes in the DocumentTemplate package that could allow the contents of DTMLDocuments or DTMLMethods to be changed remotely or through DTML code without forcing proper user authorization. A hotfix for this issue in the form of an add-on Zope product has been made available on zope.org. To install the hotfix, simply download and install the package as you would any other Zope add-on product (extract it in the root of your Zope installation). Remember to restart your Zope installation for the hotfix to take effect. http://www.zope.org/Products/Zope/Hotfix_06_16_2000/Hotfix_06_16_2000.tg z The hotfix will work for all versions of Zope 2.0 and higher, including the recent 2.2 alpha and beta releases. The forthcoming Zope 2.2 beta 2 release will contain a fix for this issue, and you be able to uninstall the hot fix after upgrading to 2.2. (though nothing bad will happen if you don't uninstall it). Note that the 2.1.7 release that was initially made to address this issue has been pulled in favor of this hotfix product, which will allow managers of Zope sites to address this issue without worrying about other implications of upgrading their installations. While we know of no instances of this issue being used to exploit a site, we *highly* recommend that any Zope site that is accessible by untrusted clients install the 06/16/2000 hotfix product immediately. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Re: [Zope-dev] Getting SessionUID from FSSession
by Hung Jung Lu 16 Jun '00

16 Jun '00

--- In zope(a)egroups.com, "Jeff Nielsen" <Jeff@U...> wrote: >How can I gather the current SessionUID from FSSession? From the docs, I >gather that > ><dtml-var "FSSession['SessionUID']"> > >should return the SessionUID, but it always returns "None". Can anyone clue >me in? Try: <dtml-var "FSSession.getName()"> regards, Hung Jung ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

2 1

Getting SessionUID from FSSession
by Jeff Nielsen 16 Jun '00

16 Jun '00

How can I gather the current SessionUID from FSSession? From the docs, I gather that <dtml-var "FSSession['SessionUID']"> should return the SessionUID, but it always returns "None". Can anyone clue me in? ----------------------- Jeff Nielsen http://www.UgoFast.com/ "Where U Go Fast"

1 0

Re: [Zope-dev] Zope ...2.1.7 update - patch for FTPServer
by Adam Karpierz 16 Jun '00

16 Jun '00

Patch for ZServer/FTPServer.py for Zope2.1.7 (it was included in CVS Zope2.2 but not for Zope 2.1.7). Without this patch the FTPServer hungs up for large (~>64KB) files. begin 666 FTPServer.py.patch M*BHJ($944%-E<G9E<BYP>2YO<FEG"51U92!/8W0@,3(@,3,Z-#@Z,C4@,3DY M.0HM+2T@1E104V5R=F5R+G!Y"49R:2!&96(@,#0@,#0Z,S(Z,S4@,C P, HJ M*BHJ*BHJ*BHJ*BHJ*BH**BHJ(#,T-RPS-3(@*BHJ*@HM+2T@,S0W+#,U,R M M+2TM"B @(" @(" @(" @(" @<V5L9BYC;VUM86YD7VYO=%]U;F1E<G-T;V]D M("AS=')I;F<N:F]I;B H;&EN92DI"B @(" @(" @(" @(" @<F5T=7)N"B @ M(" @(" @("!R97-P;VYS93UM86ME7W)E<W!O;G-E*'-E;&8L('-E;&8N<F5T M<E]C;VUP;&5T:6]N+"!L:6YE6S%=*0HK(" @(" @(" @<V5L9BY?<F5S<&]N M<V5?<')O9'5C97)S(#T@<F5S<&]N<V4N<W1D;W5T+E]P<F]D=6-E<G,*(" @ M(" @(" @(')E<75E<W0]1E104F5Q=65S="AL:6YE6S%=+"=21512)RQS96QF M+')E<W!O;G-E*0H@(" @(" @(" @:&%N9&QE*'-E;&8N;6]D=6QE+')E<75E M<W0L<F5S<&]N<V4I( H@( HJ*BHJ*BHJ*BHJ*BHJ*BH**BHJ(#,U-RPS-C4@ M*BHJ*@H@(" @(" @(" @(" @(&EF(&YO="!R97-P;VYS92Y?=W)O=&4Z"B @ M(" @(" @(" @(" @(" @('-E;&8N8VQI96YT7V1C+G!U<V@H<F5S<&]N<V4N M8F]D>2D*(" @(" @(" @(" @("!E;'-E.@HA(" @(" @(" @(" @(" @("!F M;W(@<')O9'5C97(@:6X@<F5S<&]N<V4N<W1D;W5T+E]P<F]D=6-E<G,Z"B @ M(" @(" @(" @(" @(" @(" @("!S96QF+F-L:65N=%]D8RYP=7-H7W=I=&A? M<')O9'5C97(H<')O9'5C97(I"B @(" @(" @(" @(" @<V5L9BYC;&EE;G1? M9&,N8VQO<V5?=VAE;E]D;VYE*"D*(" @(" @(" @(" @("!S96QF+G)E<W!O M;F0H"B @(" @(" @(" @(" @(" @(" @(" B,34P($]P96YI;F<@)7,@;6]D M92!D871A(&-O;FYE8W1I;VX@9F]R(&9I;&4@)R5S)R(@)2 H"B @(" @(" @ M(" @(" @(" @(" @(" @(" @<V5L9BYT>7!E7VUA<%MS96QF+F-U<G)E;G1? M;6]D95TL"BTM+2 S-3@L,S8W("TM+2T*(" @(" @(" @(" @("!I9B!N;W0@ M<F5S<&]N<V4N7W=R;W1E.@H@(" @(" @(" @(" @(" @("!S96QF+F-L:65N M=%]D8RYP=7-H*')E<W!O;G-E+F)O9'DI"B @(" @(" @(" @(" @96QS93H* M(2 @(" @(" @(" @(" @(" @9F]R('!R;V1U8V5R(&EN('-E;&8N7W)E<W!O M;G-E7W!R;V1U8V5R<SH*(" @(" @(" @(" @(" @(" @(" @('-E;&8N8VQI M96YT7V1C+G!U<VA?=VET:%]P<F]D=6-E<BAP<F]D=6-E<BD**R @(" @(" @ M(" @("!S96QF+E]R97-P;VYS95]P<F]D=6-E<G,(a)/2!.;VYE"B @(" @(" @ M(" @(" @<V5L9BYC;&EE;G1?9&,N8VQO<V5?=VAE;E]D;VYE*"D*(" @(" @ M(" @(" @("!S96QF+G)E<W!O;F0H"B @(" @(" @(" @(" @(" @(" @(" B M,34P($]P96YI;F<@)7,@;6]D92!D871A(&-O;FYE8W1I;VX@9F]R(&9I;&4@ M)R5S)R(@)2 H"B @(" @(" @(" @(" @(" @(" @(" @(" @<V5L9BYT>7!E 97VUA<%MS96QF+F-U<G)E;G1?;6]D95TL"@`` ` end

1 0

Re: [Zope-dev] Zope ...2.1.7 update - patches for MailHost
by Adam Karpierz 16 Jun '00

16 Jun '00

Patches for MailHost product for Zope 2.1.7 begin 666 __init__.py.patch M*BHJ(%]?:6YI=%]?+G!Y+F]R9PE&<FD(a)07!R(#(Q(#$P.C$Q.C$Q(#(P,# * M+2TM(%]?:6YI=%]?+G!Y"49R:2!*=6X@,38@,#,Z-#DZ,#4@,C P, HJ*BHJ M*BHJ*BHJ*BHJ*BH**BHJ(#$P,2PQ,#4@*BHJ*@H@(" @(" @(" @*0H@(" @ M(" I"B @"BT@(" @(&-O;G1E>'0N<F5G:7-T97)(96QP*"D*+2 @(" @"BTM /+2 Q,#$L,3 S("TM+2T* ` end begin 666 addMailHost_form.dtml.patch M*BHJ(&%D9$UA:6Q(;W-T7V9O<FTN9'1M;"YO<F<)1G)I($%P<B R,2 Q,#HQ M,3HQ,2 R,# P"BTM+2!A9&1-86EL2&]S=%]F;W)M+F1T;6P)1G)I($IU;B Q M-B P-3HP,SHP-2 R,# P"BHJ*BHJ*BHJ*BHJ*BHJ*@HJ*BH@-RPR-B J*BHJ M"B @/$)/1%D@0D=#3TQ/4CTB(T9&1D9&1B(^"B @/$@R/D%D9"!-86EL2&]S M=#PO2#(^"B @"BT@/&1T;6PM=F%R(")(96QP4WES+DAE;'!"=71T;VXH)TUA M:6PM2&]S=%]!9&0N9'1M;"<L("=-86EL2&]S="<I(CX*+2 *(" \4#X*("!! M($UA:6P@2&]S="!A;&QO=W,@6F]P92!T;R!S96YD(&5M86EL+@H@(#PO4#X* M(" *(" \4#X*("!5<V4@=&AE(&9O<FT@8F5L;W<@=&\@<W!E8VEF>2!T:&4@ M;W!T:6]N<R!F;W(@>6]U<B!-86EL($AO<W0N"BT@/$5-/DQO8V%L($AO<W0\ M+T5-/B!I<R!T:&4@;F%M92!O9B!T:&4@;6%C:&EN92!:;W!E(&ES(')U;FYI M;F<@;VXN"B @/$5-/E--5% @2&]S=#PO14T^(&ES('1H92!N86UE(&]F('1H M92!M86EL('-E<G9E<B!M86-H:6YE+@H@(#Q%33Y33510(%!O<G0\+T5-/B!I M<R!T:&4@<&]R="!O;B!W:&EC:"!T:&4@;6%I;"!S97)V97(@:7,@<G5N;FEN M9PH@('1H92!33510('-E<G9I8V4N"BT@/$5-/DUA>"X@5&EM96]U=#PO14T^ M(&ES(&AO=R!L;VYG(%IO<&4@<VAO=6QD('=A:70@8F5F;W)E(&=I=FEN9R!U M< HM('=H96X@=')Y:6YG('1O('-E;F0@;6%I;"X*(" \+U ^"B @"B @/$9/ M4DT(a)04-424]./2)M86YA9V5?861D36%I;$AO<W0B($U%5$A/1#TB4$]35"(^ /"BTM+2 W+#(Q("TM+2T* ` end begin 666 SendMailTag.py.patch M*BHJ(%-E;F1-86EL5&%G+G!Y+F]R9PE7960@3F]V(# S(#$P.C Y.C$S(#$Y M.3D*+2TM(%-E;F1-86EL5&%G+G!Y"49R:2!*=6X@,38@,#0Z-3,Z,C4@,C P M, HJ*BHJ*BHJ*BHJ*BHJ*BH**BHJ(#$X,BPQ.#D@*BHJ*@H@(" @(" @(" @ M(" @(&UH;W-T/6UD6W-E;&8N;6%I;&AO<W1="B @(" @(" @("!E;&EF('-E M;&8N<VUT<&AO<W0Z"B @(" @(" @(" @(" @;6AO<W0]36%I;$)A<V4H*0HA M(" @(" @(" @(" @(&UH;W-T+E]I;FET*&QO8V%L2&]S=#UG971H;W-T;F%M M92@I+"!S;71P2&]S=#US96QF+G-M='!H;W-T+ HA(" @(" @(" @(" @(" @ M(" @(" @(" @('-M='!0;W)T/7-E;&8N<&]R="D*(" *(" @(" @(" @(&UH M;W-T+G-E;F0H<V5L9BYS96-T:6]N*&UD+G1H:7,L(&UD*2P@<V5L9BYM86EL M=&\L('-E;&8N;6%I;&9R;VTL"B @(" @(" @(" @(" @(" @(" @('-E;&8N M<W5B:F5C="P@<V5L9BYE;F-O9&4I"BTM+2 Q.#(L,3@X("TM+2T*(" @(" @ M(" @(" @("!M:&]S=#UM9%MS96QF+FUA:6QH;W-T70H@(" @(" @(" @96QI M9B!S96QF+G-M='!H;W-T.@H@(" @(" @(" @(" @(&UH;W-T/4UA:6Q"87-E M*"D*(2 @(" @(" @(" @("!M:&]S="Y?:6YI="AS;71P2&]S=#US96QF+G-M M='!H;W-T+"!S;71P4&]R=#US96QF+G!O<G0I"B @"B @(" @(" @("!M:&]S M="YS96YD*'-E;&8N<V5C=&EO;BAM9"YT:&ES+"!M9"DL('-E;&8N;6%I;'1O M+"!S96QF+FUA:6QF<F]M+ H@(" @(" @(" @(" @(" @(" @("!S96QF+G-U 48FIE8W0L('-E;&8N96YC;V1E*0H` ` end

1 0

Zope vs. .... & missing features
by Thomas Weholt 15 Jun '00

15 Jun '00

Hi, Have anybody compared Zope to Roxen? Midgard? Or similar products? I saw Roxen had document revision system, a thing I "reported missing" earlier in this list. It also had full support for XML 1.0 and XSLT 1.0 or at least that`s what they claimed. These two features should be stuffed into Zope too somehow. Or should they ?? Any changes in these areas in the new 2.2 release of Zope? Thomas

2 1

Zope security alert and 2.1.7 update [*important*]
by Brian Lloyd 15 Jun '00

15 Jun '00

Hello all, We have recently become aware of an important security issue that affects all released Zope versions including the recent 2.2 beta 1 release. The issue involves an inadequately protected method in one of the base classes in the DocumentTemplate package that could allow the contents of DTMLDocuments or DTMLMethods to be changed remotely or through DTML code without forcing proper user authorization. A Zope 2.1.7 release has been made that resolves this issue for Zope 2.1.x users. This release is available from Zope.org: http://www.zope.org/Products/Zope/2.1.7/ A patch is also available if it is not feasible to update your Zope installation at this time (the patch is based on 2.1.6): http://www.zope.org/Products/Zope/2.1.7/DT_String.diff If you are evaluating any of the recent 2.2 alpha or beta releases, you should apply the patch noted above if your site is accessible by untrusted clients. A forthcoming 2.2 beta 2 release will contain the fix for this issue. While we know of no instances of this issue being used to exploit a site, we *highly* recommend that any Zope site that is accessible by untrusted clients take the appropriate mitigation steps immediately. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Re: [Zope-dev] Logging for ZScheduler?
by Phillip J. Eby 15 Jun '00

15 Jun '00

At 01:58 PM 6/15/00 +1000, Stuart 'Zen' Bishop wrote: > >Its not a problem with ZScheduler, it a problem that no one has written >a plug-in logging system that is good enough for what you are trying to >do. The existing zLOG API is fine (well - it could be better), but just >needs someone to write the relevant modules. Hmm... I think I'll >add a section to the Interfaces Wiki... Hm... this could work well with Observer->Observable, too. Imagine firing ObservableEvents, and subscribing a "Log" object to them...

4 5