- Zope-Dev - Zope lists

Re: [Zope-dev] Zope security alert and 2.2 information
by Anthony Baxter 11 May '00

11 May '00

>>> "Morten W. Petersen" wrote > Yes, but are there any browsers out there that don't support cookies? WAP browsers. -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0

syntax error
by josh on 10 May '00

10 May '00

Hello, Thanks for the useful explanations before, I now have another small problem: this produces a syntax error and I am really not sure why: <dtml-call "['parent_id'].manage_change properties ({ 'children' : children })"> The second children variable has been passed to the method by a form. parent_id is a variable that contains the name of an instance. thanks again for any help. PS if it is really bad to post newbie questions like this can you tell me, or point me somewhere more appropriate? josh oN

3 3

printing characters
by josh on 10 May '00

10 May '00

Hi, can someone tell me how I could change this so that it prints out 27 characters? <dtml-in "_.range(28)"> <dtml-var "_.chr(sequence-index)"> </dtml-in> Thanks for your time. josh oN

4 3

Cannot pickle objects
by Andre Schubert 10 May '00

10 May '00

Hi, i'm working with the how-to Serve PHP/Perl within Zope. I have an external python method called mymethod. In a zope-folder called "myfolder" i add the external method mymethod. I set the SiteRootPath to myfolder. I add i SiteAccess Rule to myfolder with the id of mymethod. This means on every REQUEST of myfolder/somewhere/somewhat the mymethod should be called and executed. Right ? Now the mymethod python file is that from the how-to and every time i open myfolder the error below comes up. Who can help me please. mfg as Traceback (innermost last): File /usr/share/zope/Zope-2.1.6-linux2-x86/lib/python/ZPublisher/Publish.py, line 214, in publish_module File /usr/share/zope/Zope-2.1.6-linux2-x86/lib/python/ZPublisher/Publish.py, line 179, in publish File /usr/share/zope/Zope-2.1.6-linux2-x86/lib/python/Zope/__init__.py, line 202, in zpublisher_exception_hook (Object: ElementWithAttributes) File /usr/share/zope/Zope-2.1.6-linux2-x86/lib/python/ZPublisher/Publish.py, line 169, in publish File /usr/share/zope/Zope-2.1.6-linux2-x86/lib/python/ZODB/Transaction.py, line 237, in commit File /usr/share/zope/Zope-2.1.6-linux2-x86/lib/python/ZODB/Connection.py, line 325, in commit (Info: (('OFS.Folder', 'Folder'), '\000\000\000\000\000\000\001~', '')) UnpickleableError: (see above)

2 1

RE: [Zope-dev] Zope security alert and 2.2 information
by Brian Lloyd 10 May '00

10 May '00

> Which does bring be back to the question of what is the relationship > between the 'nobody' user and the 'Anonymous' user. They are different names for the same thing. When you visit a (Zope) site without credentials, you are visiting as the Anonymous/nobody user. 'Anonymous User' is the name that you see in Zope UI (for example in undo logs if the AU ever does something that causes a transaction). Internally in the Zope code, this user is known as 'nobody'. To be exact, the username attribute of the nobody user is 'Anonymous User'. > Currently, if you could re-authenticate as the Annonymous user, all > would be good with the world ;-) > > Unfortunately, I don't think you can... It can be hard (esp. with Basic or Digest authentication). With cookies its not as difficult, but it would be much better if there were a way that worked for all of these. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

4 3

Where has the help tab gone ?
by Hannu Krosing 10 May '00

10 May '00

Hi. Is the help tab that used to be there in v.1.x of zopes gone forever or is it just well-hidden somewhere? I mean the one that used to be leftmost in the management interface and which opens the "Z Online Help" system. Or are all my Zope2 installs broken ? Or am I supposed to keep an 1.10.3 version around to access online help ? ----------------- Hannu

3 3

Re: [Zope-dev] Zope security alert and 2.2 information
by Anthony Baxter 10 May '00

10 May '00

Some notes - On the server side, with all the new stuff about 'Owners', I'd like to suggest that the 'Find' tab better be able to find by owner :) On the changing of ownership - could a container object get a 'recursively take ownership' tab? If you've got a bunch of people working on a site, and one leaves, it would be nice to fix that easily. Particularly since having an owner deleted is bad bad. What happens if an object is cut'n'pasted? Does the ownership change? What about if a folder is cut'n'pasted - does the ownership of everything in the folder change? It looks like trying to move or rename a user database will essentially become impossible (if any users from that user database are owners)... I'm assuming that when you talk about something being accessible to the owner of the resource, this is at run-time, not creation time? So if I change a manager's roles, this will affect their objects? hm, more thoughts to come, no doubt. Anthony >>> Brian Lloyd wrote > Hello all - > > We have recently become aware of two important security issues > that managers of Zope sites need to be aware of. Please see the > overview at: > > http://www.zope.org/Members/jim/ZopeSecurity/TrojanIssueOverview > > for further details. > > > > Brian Lloyd brian(a)digicool.com > Software Engineer 540.371.6909 > Digital Creations http://www.digicool.com > > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) > -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

5 11

Re: Great Bridge PostgreSQL
by Jerry Spicklemire 10 May '00

10 May '00

FYI, Many of you probably have seen the blurbs about Great Bridge, a new company dedicated to promoting and supporting PostgreSQL. This looked like an opportunity to tap into a source of expert support to bring the Python / Zope interfaces for PostgreSQL up to par with the currrent revs. Below is a reply to an E-Mail I sent to Colin Orr, Great Bridge's technical contact. Later, Jerry S. >From: "colin orr" <max_orr(a)hotmail.com> >To: jerry(a)spicklemire.com >Subject: Re: Great Bridge PostgreSQL >Date: Wed, 10 May 2000 08:11:08 GMT > >Jerry, > >Thanks for your enquiry and interest. I am currently looking into the state >of DB-API2 compliance and I will get back to you shortly with an update. > >Regards, > >Colin > > >>Date: Tue, 09 May 2000 11:40:16 -0500 >> >>Hi Colin, >> >>Below are some snippets from the Zope-Development Mailist, mentioning why >>PostgreSQL was not considered as a platform for initial development of >>several critical new modules. The Zope Web Development Environment is >>poised to make an unparalleled impact on Web Development, and all >>PostgreSQL lacks to be a primary partner is a fully functional Python/Zope >>Database Adapter. Hopefully the folks at Great Bridge can look into what it >>might take to quickly eliminate this impediment. snip >>... MySQL and Oracle (and actually >>InterBase as well) are frontrunning candidates for development of >>RelationalStorage because they already have Python DB-API2 compliant >>adapters written for them. Postgres can certainly handle it (AFAICT >>it's ideal), but I don't much feel like writing to a non-DBAPI compliant >>in the first cut as it limits the platform to *only* postgres initially, >>and I don't want to wrap the existing postgres da in a DB-API2 wrapper >>or anything (it's just no fun). Hopefully, once there is some code to >>poke at, people will modify it to make it work against their database of >>choice.

3 2

RE: [Zope-dev] Zope security alert and 2.2 information
by Brian Lloyd 10 May '00

10 May '00

> > It can be hard (esp. with Basic or Digest authentication). With > > cookies its not as difficult, but it would be much better if > > there were a way that worked for all of these. > > > > Yes, but are there any browsers out there that don't support cookies? There are plenty that don't have them turned on :^) Another problem is that javascript has a _lot_ of leeway in screwing around with cookies... Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Re: [Zope-dev] <dtml-boundary> irritation
by Tres Seaver 10 May '00

10 May '00

Chris Withers <chrisw(a)nipltd.com>: > > Hi, > > Does anyone have any idea when bugs [542] and [892] in the > Collector are going to be resolved? > > This is the problem that you can't use python expression of the > attributes of the <dtml-boundary> file. As a result, all file > attachments have to be given a fixed name. Which sux. > > [892] even includes a patch and I've seen several questions about this > in the list archives. We are packaging up an alpha of 2.2 this week to address the "trojan horse" issue Brian posted about yesterday. I will look at the patch this morning, and get it onto a CVS branch if possible; we will then look at integrating it sometime during the "alpha" cycle (i.e., the next few weeks. Tres. -- ========================================================= Tres Seaver tseaver(a)digicool.com tseaver(a)palladion.com Digital Creations "Makers of Zope" http://www.zope.org

2 1