- Zope-Dev - Zope lists

Strange aq_aquire bug
by Florent Guillaume 25 Mar '05

25 Mar '05

Zope bug 1730 led me to the strange following behavior of aq_acquire with a unicode special name: >>> from Acquisition import Implicit, aq_acquire >>> class C(Implicit): ... pass ... >>> ob1 = C() >>> ob2 = C() >>> a = ob1.__of__(ob2) >>> getattr(a, u'aq_parent') <C instance at 40fc1790> >>> aq_acquire(a, u'aq_parent') Traceback (most recent call last): File "<stdin>", line 1, in ? AttributeError: aq_parent Just a note so that you can ensure it's okay in Zope 2.8's Acquisition. Florent -- Florent Guillaume, Nuxeo (Paris, France) CTO, Director of R&D +33 1 40 33 71 59 http://nuxeo.com fg(a)nuxeo.com

1 0

Checkins not appearing
by Florent Guillaume 25 Mar '05

25 Mar '05

I made yesterday some checkins on the Zope-2.7 branch, which didn't appear on the zope-checkins list. FYI they're below. I'm porting them to trunk right now. Florent Index: doc/CHANGES.txt =================================================================== RCS file: /cvs-repository/Zope/doc/Attic/CHANGES.txt,v retrieving revision 1.625.2.309 diff -u -r1.625.2.309 CHANGES.txt --- doc/CHANGES.txt 18 Mar 2005 15:31:01 -0000 1.625.2.309 +++ doc/CHANGES.txt 24 Mar 2005 18:32:34 -0000 @@ -11,6 +11,10 @@ - DateIndex/DateRangeIndexes did not reset their __len__ attribute properly when cleared + - Fixed brain.getObject() to correctly traverse to an object even + if one of its parents is not accessible, to be close to what the + Publisher does. + Zope 2.7.5 final (2005/03/20) Bugs fixed Index: lib/python/Products/ZCatalog/CatalogBrains.py =================================================================== RCS file: /cvs-repository/Products/ZCatalog/Attic/CatalogBrains.py,v retrieving revision 1.8.44.1 diff -u -r1.8.44.1 CatalogBrains.py --- lib/python/Products/ZCatalog/CatalogBrains.py 23 Mar 2004 20:27:23 -0000 1.8.44.1 +++ lib/python/Products/ZCatalog/CatalogBrains.py 24 Mar 2005 18:32:35 -0000 @@ -42,12 +42,24 @@ def getObject(self, REQUEST=None): """Return the object for this record - + Will return None if the object cannot be found via its cataloged path (i.e., it was deleted or moved without recataloging), or if the user is - not authorized to access an object along the path. + not authorized to access the object. + + This method mimicks a subset of what publisher's traversal does, + so it allows access if the final object can be accessed even + if intermediate objects cannot. """ - return self.aq_parent.restrictedTraverse(self.getPath(), None) + path = self.getPath().split('/') + if not path: + return None + parent = self.aq_parent + if len(path) > 1: + parent = parent.unrestrictedTraverse('/'.join(path[:-1]), None) + if parent is None: + return None + return parent.restrictedTraverse(path[-1], None) def getRID(self): """Return the record ID for this object.""" Index: lib/python/Products/ZCatalog/tests/testBrains.py =================================================================== RCS file: /cvs-repository/Products/ZCatalog/tests/Attic/testBrains.py,v retrieving revision 1.1.4.1 diff -u -r1.1.4.1 testBrains.py --- lib/python/Products/ZCatalog/tests/testBrains.py 23 Mar 2004 20:27:23 -0000 1.1.4.1 +++ lib/python/Products/ZCatalog/tests/testBrains.py 24 Mar 2005 18:32:35 -0000 @@ -23,15 +23,17 @@ """Happy content""" def __init__(self, id): self.id = id + def check(self): + pass class Secret(Happy): """Object that raises Unauthorized when accessed""" - def __of__(self, parent): + def check(self): raise Unauthorized class Conflicter(Happy): """Object that raises ConflictError when accessed""" - def __of__(self, parent): + def check(self): raise ConflictError class DummyRequest(Acquisition.Implicit): @@ -50,10 +52,20 @@ '/conflicter':Conflicter('conflicter')} _paths = _objs.keys() + ['/zonked'] _paths.sort() - + + # This is sooooo ugly + + def unrestrictedTraverse(self, path, default=None): + assert path == '' # for these tests... + return self + def restrictedTraverse(self, path, default=_marker): + if not path.startswith('/'): + path = '/'+path try: - return self._objs[path].__of__(self) + ob = self._objs[path].__of__(self) + ob.check() + return ob except (KeyError, Unauthorized): if default is not _marker: return default Index: lib/python/Products/ZCatalog/tests/testCatalog.py =================================================================== RCS file: /cvs-repository/Products/ZCatalog/tests/Attic/testCatalog.py,v retrieving revision 1.22.12.6 diff -u -r1.22.12.6 testCatalog.py --- lib/python/Products/ZCatalog/tests/testCatalog.py 18 May 2004 14:48:49 -0000 1.22.12.6 +++ lib/python/Products/ZCatalog/tests/testCatalog.py 24 Mar 2005 18:32:35 -0000 @@ -26,6 +26,10 @@ from Products.ZCatalog import ZCatalog,Vocabulary from Products.ZCatalog.Catalog import Catalog, CatalogError import ExtensionClass +from OFS.Folder import Folder as OFS_Folder +from AccessControl.SecurityManagement import setSecurityManager +from AccessControl.SecurityManagement import noSecurityManager +from AccessControl import Unauthorized from Products.PluginIndexes.FieldIndex.FieldIndex import FieldIndex from Products.PluginIndexes.TextIndex.TextIndex import TextIndex @@ -60,18 +64,6 @@ # XXX What's this mean? What does this comment apply to? ################################################################################ -# XXX These imports and class don't appear to be needed? -## from AccessControl.SecurityManagement import newSecurityManager -## from AccessControl.SecurityManagement import noSecurityManager - -## class DummyUser: - -## def __init__( self, name ): -## self._name = name - -## def getUserName( self ): -## return self._name - def sort(iterable): L = list(iterable) L.sort() @@ -584,7 +576,82 @@ expected.sort() expected = [rid for sortkey, rid, getitem in expected] self.assertEqual(merged_rids, expected) - + + +class PickySecurityManager: + def __init__(self, badnames=[]): + self.badnames = badnames + def validateValue(self, value): + return 1 + def validate(self, accessed, container, name, value): + if name not in self.badnames: + return 1 + raise Unauthorized(name) + +class Folder(OFS_Folder): + def __init__(self, id): + self._setId(id) + OFS_Folder.__init__(self) + +class TestZCatalogGetObject(unittest.TestCase): + # Test what objects are returned by brain.getObject() + + def setUp(self): + catalog = ZCatalog.ZCatalog('catalog') + catalog.addIndex('id', 'FieldIndex') + root = Folder('') + root.getPhysicalRoot = lambda: root + self.root = root + self.root.catalog = catalog + + def tearDown(self): + noSecurityManager() + + def test_getObject_found(self): + # Check normal traversal + root = self.root + catalog = root.catalog + root.ob = Folder('ob') + catalog.catalog_object(root.ob) + brain = catalog.searchResults()[0] + self.assertEqual(brain.getPath(), '/ob') + self.assertEqual(brain.getObject().getId(), 'ob') + + def test_getObject_missing(self): + # Check that if the object is missing None is returned + root = self.root + catalog = root.catalog + root.ob = Folder('ob') + catalog.catalog_object(root.ob) + brain = catalog.searchResults()[0] + del root.ob + self.assertEqual(brain.getObject(), None) + + def test_getObject_restricted(self): + # Check that if the object's security does not allow traversal, + # None is returned + root = self.root + catalog = root.catalog + root.fold = Folder('fold') + root.fold.ob = Folder('ob') + catalog.catalog_object(root.fold.ob) + brain = catalog.searchResults()[0] + # allow all accesses + pickySecurityManager = PickySecurityManager() + setSecurityManager(pickySecurityManager) + self.assertEqual(brain.getObject().getId(), 'ob') + # disallow just 'ob' access + pickySecurityManager = PickySecurityManager(['ob']) + setSecurityManager(pickySecurityManager) + self.assertEqual(brain.getObject(), None) + # disallow just 'fold' access + pickySecurityManager = PickySecurityManager(['fold']) + setSecurityManager(pickySecurityManager) + ob = brain.getObject() + self.failIf(ob is None) + self.assertEqual(ob.getId(), 'ob') + + def test_suite(): suite = unittest.TestSuite() suite.addTest( unittest.makeSuite( TestAddDelColumn ) ) @@ -593,6 +660,7 @@ suite.addTest( unittest.makeSuite( TestCatalogObject ) ) suite.addTest( unittest.makeSuite( TestRS ) ) suite.addTest( unittest.makeSuite( TestMerge ) ) + suite.addTest( unittest.makeSuite( TestZCatalogGetObject ) ) return suite if __name__ == '__main__': -- Florent Guillaume, Nuxeo (Paris, France) CTO, Director of R&D +33 1 40 33 71 59 http://nuxeo.com fg(a)nuxeo.com

1 0

Patch: Enable Unicode in ParsedXML
by Patrick DECAT 24 Mar '05

24 Mar '05

Hi, this is my first post to this list so I'm not sure this is proper way to submit a patch. If it is not, please direct me to the correct place. This patch enables Unicode characters in qualified names for XML documents stored with the ParsedXML product. Best regards, Patrick. pdecat@localhost /cygdrive/c/Program Files/Zope-2.7.2-0/Zope-Instance/Products/ParsedXML/DOM $ diff -c Core.py.orig Core.py *** Core.py.orig Tue Apr 27 16:06:20 2004 --- Core.py Thu Mar 24 12:14:26 2005 *************** *** 70,76 **** return None return 1 # Indicates "passed". else: ! _ok_qualified_name = sre.compile('[a-zA-Z_:][\w\.\-_:]*\Z').match del sre _TupleType = type(()) --- 70,76 ---- return None return 1 # Indicates "passed". else: ! _ok_qualified_name = sre.compile('[a-zA-Z_:][\w\.\-_:]*\Z',sre.UNICODE).match del sre _TupleType = type(())

2 3

Clarification re: Zope X3.1, 2.8
by Brian Lloyd 23 Mar '05

23 Mar '05

Hi all, There have been a number of threads going on today re: Zope X3.1 feature freeze and the 2.8 effort. I'd like to clarify some decisions re: Zope 2.8 Jim is the product mgr for Zope 3 and I'm it for Zope 2, so hopefully this can be considered authoritative and end part of this thread ;) - Zope 2.8 will include X3.0 (not X3.1) - The Z3 developers will have *no* extra burden or responsibility to support X3.0 beyond what they would normally do in the normal course of maintaining it for Z3-only applications. In other words, it is not the responsibility of Z3 devs to make sure Z2 tests pass, etc. - It *will be* the responsibility of the Zope 2 devs to make sure Z2 works with the version of Z3 bundled at the time. - In the next few days at most, after a few loose ends are wrapped up, we'll ask Andreas to make a 2.8 beta 1 release. While Jim still has a few things to do, people will be able to start using the beta for real work. - Anyone who cant wait for that can use the five-integration branch in SVN - As a community, we will work out how best to adapt the Zope 2 release process and schedule to that of Zope 3 going forward. We don't need to decide this immediately to continue to make progress on 2.8. I suggest an IRC meeting sometime soon to draft a proposal. Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

11 29

[ATT] BTrees conflict resolution leads to index inconsistencies
by Dieter Maurer 23 Mar '05

23 Mar '05

[Crosspost] Please followup to "zodb-dev(a)zope.org". Zope indexes use code like this to remove document ids from document lists: def removeForwardIndexEntry(self, entry, documentId): indexRow = self._index[entry] indexRow.remove(documentId) if not indexRow: del self._index[entry] If a concurrent transaction adds a document id to the same "indexRow", then this document id can be lost because it is inserted into a document list discarded by the other transaction. Under normal conditions, a "ConflictError" would result because two transactions modify the same object (the document list). However, the BTrees conflict resolution prevents the "ConflictError" and allows the loss. The result is an index inconsistency: the forward index ("_index") entry and the backward one ("_unindex") not longer correspond. Further operations lead to "unable to remove documentId from document list" exceptions. I suggest to tighten BTrees conflict resolution not to allow concurrent insertions when a bucket was emptied. -- Dieter

2 1

ZCatalog getObject broken
by Roché Compaan 21 Mar '05

21 Mar '05

Last year in March the following checkin was made that changed ZCatalog's getObject to use restrictedTraverse instead of unrestrictedTraverse. See: http://mail.zope.org/pipermail/zope-checkins/2004-March/026846.html In my opininion this is wrong, and just cost me a good three hours to figure out why big parts of one of our apps broke after an upgrade to Zope 2.7.3. What's worse is that there is nowhere a trace of this change in HISTORY.txt or CHANGES.txt. Anybody with a site structure that has less restrictive access deeper into the site would agree that getObject should do an unrestrictedTraverse. restrictedTraverse returns None as soon as it traverses an object a user does not have access to, regardless if the user has access to the object referred to by the full path. To illustrate imagine the following: You have a site with a folder containg documents at '/documents'. Inside that folder you have a whole bunch of documents where users have a local role of owner to give them permission to access only their own documents. You use a Catalog query to get the list of documents belonging to a particular user and want to use getObject to retrieve the objects found. But, it won't work because restrictedTraverse already fails when traversing the 'documents' folder. I would propose that getObject does an unrestrictedTraverse of the path and then checks if the user has permission to access that the object. -- Roché Compaan Upfront Systems http://www.upfrontsystems.co.za

8 31

Zope on Windows - REQUEST for volunteers
by Andreas Jung 21 Mar '05

21 Mar '05

Hi, there are several open issues in the Zope collector with Zope running on Windows. I can't see anyone worrying about the Windows platform (I also don't care about Windows as UN*X guy). So if you are interested in running Zope on Windows in a reasonable way than *you* should help to fix the outstanding bugs. I heard some remarks (behind my back) that Zope is not a stable solution on Windows...possibly.....but since Zope is a community-driven project people doing such remarks should either shut up or help to improve the situation by volunteering (which is also true for other parts of the Zope development). So if you want to improve running Zope on Windows: go the Zope collector, search for Windows related problems, find a solution, submit a patch and don't expect that everything can be handled by the handful of active Zope 2 core developers...means it's also up to *YOU*. Andreas

6 6

[Zope 2.8] release schedule
by Andreas Jung 20 Mar '05

20 Mar '05

I have updated the Zope 2.8 wiki to reflect the planned schedule for Zope 2.8: http://www.zope.org/Wikis/DevSite/Projects/Zope2.8/MilestonePlan Since we are trying to shift towards a fixed-date schedule every Zope 2 contributor should see this schedule as a chance and commitment to make contributions and fixes within this time frame. This schedule implies that all outstanding issues with Zope 2.8 have to be fixed before the final release. Andreas

1 0

Cookie problem with mySqlUserFolder
by Aruna Kathiria 19 Mar '05

19 Mar '05

Hello everyone: I am facing the problem regarding cookie. One of our website uses mySqlUserFolder. Problem is if user logs on one computer, and if he/she comes again on same computer, computer remembers him/her. That is good as it is what we want. But if he/she goes on another computer and logs on and then if he/she come back to previous one, it looses it's reorganization though cookie is there. I checked what problem would be and found that each time logged in process on different computers generates a random value for cookie on that computer and also store same value in Tokens table on mysqlUserFolder database. So everytime only cookie from one computer matches the value with Tokens tables value. So other computer don't remember the previous login. ( Though I don't know this is the reason of my problem) What would be the solution to keep reorganization on all computers on which once user has been logged in? Any help will be appreciated. Thanks in advance! With Regards, Aruna Kathiriya Sr.Consultant, CIGNEX Technologies, Inc T: 408.327.9900 x 314 F: 408.273.6785 E: aruna(a)cignex.com U: www.cignex.com "Implement IT Right"

2 1

Re: [Zope-Checkins] SVN: Zope/trunk/ - Applied patch for
by faassen＠infrae.com 18 Mar '05

18 Mar '05

On Thu, Mar 17, 2005 at 10:34:10AM -0500, Tim Peters wrote: > [Sidnei da Silva] > .... > > Humm... we are trying to push a Zope 2.8 beta out, do you have or know > > of plans to use ZODB 3.4 with Zope 2.8? > > Yes. Jim needs to fix ZClasses for 2.8 too. ZODB 3.4 requires some > Zope(3) features, like zope.interfaces and zope.testing. Jim is > adding those on his ZClasses branch. When the ZClasses work is merged > (but not before), it becomes possible to move to ZODB 3.4. Zope3 > already uses ZODB trunk (3.4 development). We can't afford to > maintain a separate ZODB just for Zope 2.8, so view moving to ZODB 3.4 > as a requirement for Zope 2.8. Oh, also please note that we're merging zope.interfaces and zope.testing into Zope 2.8 already. So once we merge that branch (today, we expect), ZODB 3.4 could be merged in. But I'm worried that there are other factors involved with ZODB 3.4 that will hold up release even further. For instance, there is no ZODB 3.4 release yet; how much work would that entail? Regards, Martijn

2 1