- Zope-Dev - Zope lists

OT: These PHP guys are so funny
by Florent Guillaume 05 Jul '05

05 Jul '05

They use buggy eval() in their XMLRPC code, which of course causes massive security problems, notably with RSS... http://www.gulftech.org/?node=research&article_id=00088-07022005 http://news.netcraft.com/archives/2005/07/04/ php_blogging_apps_vulnerable_to_xmlrpc_exploits.html Florent -- Florent Guillaume, Nuxeo (Paris, France) CTO, Director of R&D +33 1 40 33 71 59 http://nuxeo.com fg(a)nuxeo.com

2 1

2.9 goals
by Chris McDonough 05 Jul '05

05 Jul '05

I'd like to propose/sponsor/promise-to-finish the following for inclusion in 2.9. If anyone has fears/doubts/problems with specific things, please let me know. I can also start a 2.9 project on the wiki with this info; if other folks have features they want, maybe they can post them here and we can put together a release plan. Definitely: - Chris Theune's blob support for ZODB (currently on the ctheune-blobsupport branch in ZODB's SVN repo) - Speed up large PUTs: http://mail.zope.org/pipermail/zope-dev/2005-April/024617.html - Implement RESPONSE.isClientConnected() to be able to tell if the client that made the request is still connected (allow long-running app code the possibility to abort processing if it notices the client is not connected). Maybe: - Include ClockServer: http://plope.com/software/ClockServer - ZODB "connection policies", which will allow you to associate a thread pool with a particular set of ZServer servers. This will allow sites which are having resource exhaustion problems (e.g. running out of threads, running out of database connections) to continue to be accessible via servers running on "special" ports for debugging and maintenance purposes. It should also allow site admins to associate a particular thread pool with connections from spiders and other cache-busters by associating particular user agents or other request parameters with a thread pool. Work towards this was done on the chrism-zserver-connection-policies-branch branch in CVS a while back. See http://cvs.zope.org/Zope/lib/python/ZServer/?only_with_tag=chrism-zserver-c… - C

6 8

Weird proxy role behaviour
by Andreas Jung 04 Jul '05

04 Jul '05

Hi, I created a PyScript through the ZMI: from AccessControl import getSecurityManager() print getSecurityManager().getUser().getRoles() print getSecurityManager().getUser().getRolesInContext(context) return printed The script has the proxy role 'Manager'. When I call the script as Anyonmous User then the output is always ('Anonymous',) for both calls. This happens with Zope 2.7.0, 2.7.6 and Zope 2.8.0. Shouldn't I see the Manager role in the output or am I just brain-dead today? Andreas

3 2

Extending Zope's ZConfig Schema in a Product?
by Sidnei da Silva 04 Jul '05

04 Jul '05

Hello, I've been hitting my head against the wall for a few hours already, so I thought it would be a good time to ask before the house falls apart *wink*. I'm looking back and forth between the Zope and ZConfig sources and documentation to see if I can figure out how to have a Product (or a python package) to extend Zope's ZConfig schema (a.k.a. Zope/Startup/zopeschema.xml) without having to reach into the guts of ZConfig. It looks like the right way to do this would be to extend Zope's schema and then specify a different 'schemafile' to ZopeOptions, but that's not currently possible as Zope doesn't support the '-S schemafile' switch that ZDCtlOptions does. If what I'm looking for seems just stupid please tell me *wink*. All I want to do is to add a simple config 'key' to zope.conf without having to patch the Zope source. Having no other choices, I would go with having my own schema and configfile, but that would be sub-optimal. Thank you for any help, -- Sidnei da Silva Enfold Systems, LLC.

7 13

Problems with PageTemplates on Zope 2.8
by Morten W. Petersen 01 Jul '05

01 Jul '05

Hi, I have an application called the Issue Dealer which I'm porting to Zope 2.8. However, whenever I try to access a PageTemplate which makes use of a page template macro it just hangs and consumes all available CPU. Any ideas what could be wrong here, or how I could debug it? Thanks, Morten PS: CC me as I'm not on the list

4 5

Re: [Z3lab] Nuxeo supports Zope Corp announces
by Jean-Marc Orliaguet 01 Jul '05

01 Jul '05

Eric Barroca wrote: > Hello, > > > Following the announces from Zope Corporation yesterday about their > willingness to create a Zope Foundation (that would manage > independently Zope 2 and Zope 3 projects) and to participate actively > in the Z3ECM project, I would like to express briefly Nuxeo's > position about all the news. > > First, we would like to thank Zope Corporation for Zope 2 and Zope 3 > as Open Source software, they are amazing products ! > > For us as far as we know, the Zope Foundation is a really great news. > This will probably solve the main issues we heard from people in the > community and from some customers (brand and copyright security). > It's really great news that Zope Corporation is now ready to go > further on the community way and involvement. We are ready to help as > much as needed in establishing the ZF as a vendor-neutral > organisation with the mission to develop and promote a great > technology (like the Apache or Eclipse Foundations). > The Zope Foundation will, IOHO, a big step towards "project 10X" to > establish Zope as a leading development platform for all kinds of web > and internet applications. > > On the Z3ECM project, we are very glad that Zope Corporation wants to > actively join the project ! > We are certain that having ZC resources on this project will clearly > help to build better products and solidify the platform. > > We will also support the move of the Z3ECM project to the ZF when the > issues of copyright ownership will be discussed with the project > stakeholders. It could definitely help unifying CMS zope community > and will give more credibility to the platform from a customer point > of view. > > We will also support the move of the Z3ECM project to the ZF when the > issues of copyright ownership will be discussed with the project > stakeholders > > In short, we are really happy and excited, and will definitely > supports ZC to move forward on these topics with the other members of > the Zope community. > > I'm pretty confident that the whole community will support this as well. > > > Best regards, > > EB. > > -- > Éric Barroca, Tel: +33 6 21 74 77 64 (mobile). > Nuxeo Collaborative Portal Server: http://www.nuxeo.com/cps > Gestion de contenu web / portail collaboratif / groupware / open source! > www.nuxeo.com - www.cps-project.org - www.indesko.com > Hi! This is really great news! I am going to start working at getting Chalmers to be one of the key players in the foundation which would make the foundation even more vendor-neutral. I am confident that this will go through. regards /JM

8 20

Re: [Zope-dev] Re: Windows Builds
by Tim Peters 01 Jul '05

01 Jul '05

[Tim Peters] >> Anyone else run on Windows routinely who's eager for glory? As >> Christian learned the hard way, it doesn't really work if running on >> Windows is an occasional afterthought in your daily life. [Andy McKay] > Mark Hammond and I will take a look at this and see if we can help. Cool! Last I saw, Andreas was planning to release Zope 2.7.7b1 this Sunday (3 July), if you want some practice <wink>. I'm pretty sure Mark already understands the Zope Windows-installer build process about as well as anyone. If not, I'm happy to help. For someone who runs on Windows routinely, the machinery usually works smoothly. It can be a bear when it doesn't. One predictable problem is that Zope's setup.py gets out of date over time, because people run Zope tests from CVS or SVN checkouts "in place", and the repackaging done by setup.py for an installation never gets tested that way. It's broken then for all platforms, but typically whoever builds the WIndows installer is the first to _notice_ it. For a micro release (like 2.7.6 -> 2.7.7) a problem there is unlikely.

1 0

Zope 2.8: ZODB fix breaks undoable_transactions
by yuppie 29 Jun '05

29 Jun '05

Hi! http://svn.zope.org/?view=rev&rev=30334 changed the behavior of undoInfo() in a way that is not backwards compatible. See http://www.zope.org/Collectors/Zope/1822 for details. I can see 3 ways to resolve this: 1.) restoring the old behavior of undoInfo() in ZODB 2.) restoring the old behavior of undoable_transactions() 3.) propagating the change to all the code that depends on undoable_transactions() I don't know all the reasons why undoInfo() was changed, so I don't know if reverting the change is an option. If 1.) is no option, I would prefer solution 2.) over 3.) Any opinions? Cheers, Yuppie

2 5

2.8.1 release schedule
by Andreas Jung 29 Jun '05

29 Jun '05

Please see: http://www.zope.org/Wikis/DevSite/Projects/Zope2.8/MilestonePlan -aj

1 0

SAP SSO for Zope/CookieCrumbler/LDAPUserFolder
by Dirk Datzert 27 Jun '05

27 Jun '05

Hi, this is my solution for SSO for Zope by accepting SAP-SSO-Ticket. SAP-SSO-Tickets are Cookies named MYSAPSSO2. They contain SAP-PortalUserName, SAP-Username, Validate-Time of the ticket and a signed signature by the issueing SAP-System. Since we currently use CookieCrumbler and LDAPUserFolder it was my goal to let the CookieCrumbler take the MYSAPSSO2 Cookie from the Request, let it be validated by an external ticket verification service, store the validated TicketInfo in the SESSION variable and let LDAPUserFolder load the trusted PortalUser with roles from the LDAP-Directory. Any comments or security discussion is welcome. Zope 2.7.6, CookieCrumbler 1.2, LDAPUserFolder 2.5 Regards, Dirk -- Geschenkt: 3 Monate GMX ProMail gratis + 3 Ausgaben stern gratis ++ Jetzt anmelden & testen ++ http://www.gmx.net/de/go/promail ++

2 1