- Zope-Dev - Zope lists

2.7.3 beta attribute permission problems
by Santi Camps 20 Oct '04

20 Oct '04

Hi all, I've instal·led Zope 2.7.3b2 (python 2.3.4, gnu/linux box) to test my products and at the first moment I've found a terrible problem for me. My applications began to raise "Unauthorized: The container has no security assertions" errors everywhere. I've been looking for in google and found this thread: http://www.mail-archive.com/zope-dev%40zope.org/msg17218.html Really the problem seems to be exactly the same. A simple example: I have a persistent object A and a non persistent object B. B has implicit acquisition. From trusted code I return B.__of__(A). Trying to access B.meta_type from untrusted code (a ZPT) raises the error. B has no attribute meta_type, so it should be returned from A using implicit acquisition. A has all necessary security assertions. All this has been working fine from Zope 2.7.0 to 2.7.2. The problem appears the first time in Zope 2.7.3 beta. As Richard Jones says, the problem seems to be a little change in AccessControl/ImplPython.py: 554,557d553 < # Filter out the objects we can't access. < if hasattr(inst, 'aq_acquire'): < return inst.aq_acquire(name, aq_validate, validate) < # Or just try to get the attribute directly. and I think also in cAccessControl.c: 2112,2123d2113 < # Filter out the objects we can't access. < if hasattr(inst, 'aq_acquire'): < return inst.aq_acquire(name, aq_validate, validate) < */ < if (aq_isWrapper(inst)) < { < Py_DECREF(v); < return aq_Acquire(inst, name, aq_validate, validate, 1, NULL, 0); < } < < /* < # Or just try to get the attribute directly. Thanks in advance Santi Camps http://www.earcon.com

4 10

R: [Zope-dev] Referencing a python method from a product page template
by Coletti Massimo 20 Oct '04

20 Oct '04

Solved ! There are some wrong info in Zope Developers Book. The solution is here: http://mail.zope.org/pipermail/zope/2004-May/thread.html#149569 Massimo -----Messaggio originale----- Da: zope-dev-bounces(a)zope.org [mailto:zope-dev-bounces@zope.org] Per conto di Coletti Massimo Inviato: mercoledì 20 ottobre 2004 10.40 A: zope-dev(a)zope.org Oggetto: R: [Zope-dev] Referencing a python method from a product page template Pardon, the traceback of option b was not correct, here is the right one -----Messaggio originale----- Da: zope-dev-bounces(a)zope.org [mailto:zope-dev-bounces@zope.org] Per conto di Coletti Massimo Inviato: mercoledì 20 ottobre 2004 10.31 A: zope-dev(a)zope.org Oggetto: [Zope-dev] Referencing a python method from a product page template Hi, I am defining a Zope product to create a new portlet, the portlet will display some contents retrieved from a python module. Under the product dir I have a file queryBFE.py, with a method returnQuery(); the method returns a dictionary. In the __init__.py at product level, there is an: allow_module('Products.CorpQuotes.queryBFE') The portlet page template is stored under a skin directory, properly registered in CFM. In the portlet text, I tried two syntaxes to call the method: a) b) The first one returns: Exception Type AttributeError Exception Value queryBFE The second one returns: Exception Type Unauthorized Exception Value You are not allowed to access 'queryBFE' in this context Module Products.PageTemplates.TALES, line 220, in evaluate - URL: /Plone/FinnatHome_view - Line 14, Column 10 - Expression: standard:'modules/Products/CorpQuotes/queryBFE/returnQuery' - Names: {'container': <PloneSite instance at 0170EF50>, 'context': <Document at /Plone/index.html>, 'default': <Products.PageTemplates.TALES.Default instance at 0x010BF5F8>, 'here': <Document at /Plone/index.html>, 'loop': <SafeMapping instance at 025DEC30>, 'modules': <Products.PageTemplates.ZRPythonExpr._SecureModuleImporter instance at 0x010AED00>, 'nothing': None, 'options': {'args': ()}, 'repeat': <SafeMapping instance at 025DEC30>, 'request': <HTTPRequest, URL=http://localhost:8082/index.html/FinnatHome_view>, 'root': <Application instance at 017C29E0>, 'template': <ZopePageTemplate at /Plone/FinnatHome_view used for /Plone/index.html>, 'traverse_subpath': [], 'user': coletti} Module Products.PageTemplates.Expressions, line 201, in __call__ Module Products.PageTemplates.Expressions, line 189, in _eval Module Products.PageTemplates.Expressions, line 145, in _eval - __traceback_info__: modules Module Products.PageTemplates.Expressions, line 340, in restrictedTraverse - __traceback_info__: {'path': ['Products', 'CorpQuotes', 'queryBFE', 'returnQuery'], 'TraversalRequestNameStack': ['returnQuery']} Unauthorized: You are not allowed to access 'queryBFE' in this context This e-mail and any attachments may contain confidential and privileged information. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this e-mail and destroy any copies. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal. _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope ) This e-mail and any attachments may contain confidential and privileged information. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this e-mail and destroy any copies. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal.

2 1

R: [Zope-dev] Referencing a python method from a product page template
by Coletti Massimo 20 Oct '04

20 Oct '04

Pardon, the traceback of option b was not correct, here is the right one -----Messaggio originale----- Da: zope-dev-bounces(a)zope.org [mailto:zope-dev-bounces@zope.org] Per conto di Coletti Massimo Inviato: mercoledì 20 ottobre 2004 10.31 A: zope-dev(a)zope.org Oggetto: [Zope-dev] Referencing a python method from a product page template Hi, I am defining a Zope product to create a new portlet, the portlet will display some contents retrieved from a python module. Under the product dir I have a file queryBFE.py, with a method returnQuery(); the method returns a dictionary. In the __init__.py at product level, there is an: allow_module('Products.CorpQuotes.queryBFE') The portlet page template is stored under a skin directory, properly registered in CFM. In the portlet text, I tried two syntaxes to call the method: a) b) The first one returns: Exception Type AttributeError Exception Value queryBFE The second one returns: Exception Type Unauthorized Exception Value You are not allowed to access 'queryBFE' in this context Module Products.PageTemplates.TALES, line 220, in evaluate - URL: /Plone/FinnatHome_view - Line 14, Column 10 - Expression: standard:'modules/Products/CorpQuotes/queryBFE/returnQuery' - Names: {'container': <PloneSite instance at 0170EF50>, 'context': <Document at /Plone/index.html>, 'default': <Products.PageTemplates.TALES.Default instance at 0x010BF5F8>, 'here': <Document at /Plone/index.html>, 'loop': <SafeMapping instance at 025DEC30>, 'modules': <Products.PageTemplates.ZRPythonExpr._SecureModuleImporter instance at 0x010AED00>, 'nothing': None, 'options': {'args': ()}, 'repeat': <SafeMapping instance at 025DEC30>, 'request': <HTTPRequest, URL=http://localhost:8082/index.html/FinnatHome_view>, 'root': <Application instance at 017C29E0>, 'template': <ZopePageTemplate at /Plone/FinnatHome_view used for /Plone/index.html>, 'traverse_subpath': [], 'user': coletti} Module Products.PageTemplates.Expressions, line 201, in __call__ Module Products.PageTemplates.Expressions, line 189, in _eval Module Products.PageTemplates.Expressions, line 145, in _eval - __traceback_info__: modules Module Products.PageTemplates.Expressions, line 340, in restrictedTraverse - __traceback_info__: {'path': ['Products', 'CorpQuotes', 'queryBFE', 'returnQuery'], 'TraversalRequestNameStack': ['returnQuery']} Unauthorized: You are not allowed to access 'queryBFE' in this context This e-mail and any attachments may contain confidential and privileged information. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this e-mail and destroy any copies. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal.

1 0

Referencing a python method from a product page template
by Coletti Massimo 20 Oct '04

20 Oct '04

Hi, I am defining a Zope product to create a new portlet, the portlet will display some contents retrieved from a python module. Under the product dir I have a file queryBFE.py, with a method returnQuery(); the method returns a dictionary. In the __init__.py at product level, there is an: allow_module('Products.CorpQuotes.queryBFE') The portlet page template is stored under a skin directory, properly registered in CFM. In the portlet text, I tried two syntaxes to call the method: a) b) The first one returns: Exception Type AttributeError Exception Value queryBFE The second one returns: Tipo di errore AttributeError Valore dell'errore queryBFE Module Products.PageTemplates.TALES, line 220, in evaluate - URL: /Plone/FinnatHome_view - Line 13, Column 10 - Expression: standard:'here/queryBFE' - Names: {'container': <PloneSite instance at 0170EF50>, 'context': <Document at /Plone/index.html>, 'default': <Products.PageTemplates.TALES.Default instance at 0x010BF5F8>, 'here': <Document at /Plone/index.html>, 'loop': <SafeMapping instance at 025E2C50>, 'modules': <Products.PageTemplates.ZRPythonExpr._SecureModuleImporter instance at 0x010AED00>, 'nothing': None, 'options': {'args': ()}, 'repeat': <SafeMapping instance at 025E2C50>, 'request': <HTTPRequest, URL=http://localhost:8082/index.html>, 'root': <Application instance at 017C29E0>, 'template': <ZopePageTemplate at /Plone/FinnatHome_view used for /Plone/index.html>, 'traverse_subpath': [], 'user': coletti} Module Products.PageTemplates.Expressions, line 201, in __call__ Module Products.PageTemplates.Expressions, line 189, in _eval Module Products.PageTemplates.Expressions, line 145, in _eval - __traceback_info__: here Module Products.PageTemplates.Expressions, line 354, in restrictedTraverse - __traceback_info__: {'path': ['queryBFE'], 'TraversalRequestNameStack': []} AttributeError: queryBFE HELP! massimo This e-mail and any attachments may contain confidential and privileged information. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this e-mail and destroy any copies. Any dissemination or use of this information by a person other than the intended recipient is unauthorized and may be illegal.

1 0

session error
by Gerry Kirk 20 Oct '04

20 Oct '04

A user got this error trying to edit content. It only happened once, and on second try she was ok. Using Zope 2.7.0: Traceback (innermost last): Module ZPublisher.Publish, line 100, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 40, in call_object Module Products.CMFFormController.FSControllerPageTemplate, line 81, in __call__ Module Products.CMFFormController.BaseControllerPageTemplate, line 42, in _call Module Shared.DC.Scripts.Bindings, line 306, in __call__ Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec Module Products.CMFCore.FSPageTemplate, line 191, in _exec Module Products.CMFCore.FSPageTemplate, line 124, in pt_render Module Products.PageTemplates.PageTemplate, line 96, in pt_render - <FSControllerPageTemplate at /saultdiocese/base_edit used for /saultdiocese/DioceseOffice.2004-04-26.0049447933/WorkspaceFolder.2004-04-26.0631977769/Workspace.2004-07-15.1703647729/News.2004-10-13.7108192668/en> Module TAL.TALInterpreter, line 189, in __call__ [ some TALInterpreter lines snipped ] Module TAL.TALInterpreter, line 459, in do_setLocal_tal Module Products.PageTemplates.TALES, line 220, in evaluate Module Products.PageTemplates.ZRPythonExpr, line 47, in __call__ - __traceback_info__: widget.postback and request.get(fieldName, here.session_restore_value(fieldName, value)) or value Module Python expression "widget.postback and request.get(fieldName, here.session_restore_value(fieldName, value)) or value", line 1, in <expression> Module Products.CMFCore.FSPythonScript, line 104, in __call__ Module Shared.DC.Scripts.Bindings, line 306, in __call__ Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec Module Products.CMFCore.FSPythonScript, line 160, in _exec Module None, line 2, in session_restore_value - <FSPythonScript at /saultdiocese/session_restore_value used for /saultdiocese/DioceseOffice.2004-04-26.0049447933/WorkspaceFolder.2004-04-26.0631977769/Workspace.2004-07-15.1703647729/News.2004-10-13.7108192668/en> - Line 2 Module ZPublisher.HTTPRequest, line 1218, in __getattr__ Module ZPublisher.HTTPRequest, line 1178, in get Module Products.Sessions.SessionDataManager, line 93, in getSessionData Module Products.Sessions.SessionDataManager, line 180, in _getSessionDataObject Module Products.Transience.Transience, line 176, in new_or_existing Module Products.Transience.Transience, line 799, in get Module Products.Transience.Transience, line 548, in _getCurrentBucket Module ZODB.Connection, line 559, in setstate Module tempstorage.TemporaryStorage, line 94, in load KeyError: '\x00\x00\x00\x00\x00\x00\x05B'

3 2

Re: [Zope-dev] RE: Re: svn vs. cvs (some documentation)
by Jim Fulton 19 Oct '04

19 Oct '04

Tres Seaver wrote: > Jim Fulton wrote: > >>> 3. Up to this point, we haven't had to be careful about managing >>> bugfixes across multiple releases. >> >> >> Sure we have. We've had a release branch for >> some time. Perhaps I should add: > > > The complaint you made earlier today (about bugs fixed on the head, but > not on the release branch) is a symptom of this issue. FWIW, it is > standard doctrine that bugs should be fixed *first* on the release > branch, and then forward-ported to the trunk, rather than vice versa. I agree that that is a good doctrine. ... > When collaborating on a feature which touches many files, it is often > desirable to check in intermediate versions; activity branches make > this possible, without risking the stability of the trunk. Yup. There are definately examples of this in Zope 3's history and future. I'd put it a little differently, in that it is not necessarily the number of files but the overall time to complete a development project that sometimes makes separate development (activity) branches necessary. > The CVS > document (http://dev.zope.org/CVS/ZopeCVSFAQ) says: > > It is very important that the trunk remain stable so that releases > can be made on short notice. To keep the trunk from becoming > unstable, all work is done on branches in CVS and when the work has > stabilized it can be merged into the trunk. For Zope 3 and svn, I would change this to something like: It is very important that the trunk remain stable so that releases can be made on short notice. To keep the trunk from becoming unstable, no change can be checked into the trunk, or to a release branch unless: - All tests pass, and - All new code has adequate unit and functional tests. If you need to check in intermediate work, because a project takes a long time or there are multiple participants, then create a development branch and work there. When development is completed and the resulting changes are stable and adequately tested, then the branch can be merged to the trunk (or to a release branch) and committed if all tests pass. Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

2 2

Python2.4 and Zope 2.7
by Matt Hamilton 18 Oct '04

18 Oct '04

Hi All, I'm having some trouble getting python2.3.4 running on FreeBSD 5.3b7 on an AMD Opteron, so for kicks tried python2.4rc3. It managed to pass the recursion regex test in test_re.py that was causing python2.3.4 to barf, but in trying to start Zope with python2.4rc3 I get the error below. Does anyone here know if Zope 2.7.0 should work with python 2.4? -Matt zeo1# bin/runzope /usr/local/lib/python2.4/whrandom.py:38: DeprecationWarning: the whrandom module is deprecated; please use the random module DeprecationWarning) Traceback (most recent call last): File "/usr/local/Zope-2.7.0/lib/python/Zope/Startup/run.py", line 49, in ? run() File "/usr/local/Zope-2.7.0/lib/python/Zope/Startup/run.py", line 18, in run opts = _setconfig() File "/usr/local/Zope-2.7.0/lib/python/Zope/Startup/run.py", line 41, in _setconfig opts.realize(doc="Sorry, no option docs yet.") File "/usr/local/Zope-2.7.0/lib/python/zdaemon/zdoptions.py", line 264, in realize self.load_configfile() File "/usr/local/Zope-2.7.0/lib/python/zdaemon/zdoptions.py", line 308, in load_configfile self.zconfig_options) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/loader.py", line 43, in loadConfig return _get_config_loader(schema, overrides).loadURL(url) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/loader.py", line 71, in loadURL return self.loadResource(r) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/loader.py", line 183, in loadResource self._parse_resource(sm, resource) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/loader.py", line 234, in _parse_resource parser.parse(matcher) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/cfgparser.py", line 63, in parse section = self.end_section(section, line[2:-1]) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/cfgparser.py", line 116, in end_section self.context.endSection( File "/usr/local/Zope-2.7.0/lib/python/ZConfig/loader.py", line 201, in endSection sectvalue = matcher.finish() File "/usr/local/Zope-2.7.0/lib/python/ZConfig/matcher.py", line 170, in finish return self.constuct() File "/usr/local/Zope-2.7.0/lib/python/ZConfig/matcher.py", line 212, in constuct v = v.convert(ci.datatype) File "/usr/local/Zope-2.7.0/lib/python/ZConfig/info.py", line 65, in convert return datatype(self.value) File "/usr/local/Zope-2.7.0/lib/python/Zope/Startup/datatypes.py", line 106, in importable_name package = __import__(n, g, g, component) File "/usr/local/Zope-2.7.0/lib/python/DBTab/ClassFactories.py", line 18, in ? import OFS.Uninstalled File "/usr/local/Zope-2.7.0/lib/python/OFS/Uninstalled.py", line 16, in ? import SimpleItem, Globals, Acquisition File "/usr/local/Zope-2.7.0/lib/python/OFS/SimpleItem.py", line 27, in ? from CopySupport import CopySource File "/usr/local/Zope-2.7.0/lib/python/OFS/CopySupport.py", line 549, in ? action ='manage_main',) File "/usr/local/Zope-2.7.0/lib/python/DocumentTemplate/DT_String.py", line 474, in __call__ try: result = render_blocks(self._v_blocks, md) File "/usr/local/Zope-2.7.0/lib/python/DocumentTemplate/pDocumentTemplate.py", line 202, in render_blocks cond=md[cond] File "/usr/local/Zope-2.7.0/lib/python/DocumentTemplate/pDocumentTemplate.py", line 140, in __getitem__ v = self.dicts[key] File "/usr/local/Zope-2.7.0/lib/python/DocumentTemplate/pDocumentTemplate.py", line 100, in __getitem__ raise KeyError, key KeyError: "'v'" -- Matt Hamilton matth(a)netsight.co.uk Netsight Internet Solutions, Ltd. Business Vision on the Internet http://www.netsight.co.uk +44 (0)117 9090901 Web Design | Zope/Plone Development & Consulting | Co-location | Hosting

7 9

RE: [Zope3-dev] Re: svn vs. cvs (some documentation)
by Brian Lloyd 18 Oct '04

18 Oct '04

> > http://dev.zope.org/CVS/ContributorFAQ refers to CVS (and zope3-dev). > > I think all references to CVS should be changed to SVN. Should I go > > ahead and update the document? > > No. CVS is still used for managing the 2.7 branch of Zope, and is still > relevant there. > > Tres. Speaking of, the dev.zope.org/CVS/ area should probably be updated to: 1. capture the current state of affairs (2.8 / HEAD on svn and 2.7 on CVS), since it is currently mostly 'in the heads' of the various Zope devs 2. translate the CVS FAQ to the svn world (recommendations for how to manage our 'activity branch' pattern in svn in particular 3. clarify other questions that would be obvious to new devs looking at that area of the site for guidance ;) I've bcc'ed to myself to try to make a stab at this as I can, but its pretty likely someone out there could get this done faster. If you can get the me the content, I promise I can get your mods up on the site quickly ;) To the zope-web folks and others managing zope.org content - we should also change the 'Zope CVS' (and zope.org/CVS) to 'Contributing' or some such... Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

3 3

Re: [Zope-dev] Python2.4 and Zope 2.7
by Tim Peters 18 Oct '04

18 Oct '04

[Andreas Jung] > Running the tests with 2.8 under Linux fails for me: Yes, I was replying to you, confirming that they also fail on Windows, and identifying the specific tests that failed. > Collector #1542. Thanks -- I've added comments there. > Looks also related to asyncore. Since it blows up in the same asyncore-related place under Windows and Linux, that's a pretty safe bet <wink>.

1 1

Re: [Zope-dev] Python2.4 and Zope 2.7
by Tim Peters 18 Oct '04

18 Oct '04

[Andreas Jung] > Zope 2.7.3 + Python 2.4 fails when running the unittests: > > EETraceback (most recent call last): > File "/develop/sandboxes/Zope-2_7-branch/Zope/lib/python/ZEO/tests/zeoserver.py", line 216, in ? > main() > File "/develop/sandboxes/Zope-2_7-branch/Zope/lib/python/ZEO/tests/zeoserver.py", line 212, in main > ThreadedAsync.LoopCallback.loop() > File "/develop/sandboxes/Zope-2_7-branch/Zope/lib/python/ThreadedAsync/LoopCallback.py", line 156, in loop > poll_fun(timeout, map) > File "/develop/sandboxes/Zope-2_7-branch/Zope/lib/python/ThreadedAsync/LoopCallback.py", line 108, in poll > r, w, e = select.select(r, w, e, timeout) > select.error: (9, 'Bad file descriptor') So it does. On Windows the error msg is a bit different: select.error: (10038, 'An operation was attempted on something that is not a socket') Looks like these come out of two related tests: testNOK (ZEO.tests.testAuth.PlainTextAuth) testNOK (ZEO.tests.testAuth.DigestAuth) Curiously, the same tests pass on Zope 2.8 trunk under 2.4, and in Zope3 under 2.4. Unfortunately, I have no idea what those tests do. Possibly relevant is that 2.4's asyncore is less tolerant of leaving garbage in its socket_map (like closed sockets). One other thing to note: a lot of deprecation warnings about importing whrandom. That module has been officially deprecated for years (although the warning is new in 2.4) -- it's high time to stop importing it.

2 1