- Zope-Dev - Zope lists

Zope2.7.0rc2 AttributeError: 'NoneType' object has noattribute 'setHeader'
by Christophe Tronche 27 Mar '04

27 Mar '04

Hello all. Has this problem been solved ? I'm stuck in the very same problem after having switched from python 2.6.2 to 2.6.4, both using the same python2.2.3. Pure Zope, no Product other than my own (where not a single line of code has been modified) and no funny name like Tony's SYS or whatever. The problem occurs when trying to interpret App/dtml/manage_page_header.dtml and /OFS/dtml/main.dtml in a management tab. Any idea someone ? Regards, Ch. Tronche Thanks again for the reply Dieter, On 6 Feb 2004, at 21:14, Dieter Maurer wrote: > "REQUEST.RESPONSE" is set up in > "ZServer.HTTPServer.zhttp_handler.continue_request". > It should be impossible that is is "None". > > Agreed. > Maybe, we have a memory corruption. > I have seen objects magically becoming "None" in > Python versions with memory corruption problems (Python 2.1.1). > > -- > Dieter Could be memory perhaps, but this is python2.3.3. > Christian Heimes wrote: > [...] > > And the next one: > > Python2.3.3/Zope2.70rc2/Plone2rc5. > > Exception Type > AttributeError > Exception Value > 'str' object has no attribute 'RESPONSE' > > [...] > Module Products.CMFPhoto.Photo, line 510, in clearCache > AttributeError: 'str' object has no attribute 'RESPONSE' > > The relevant code line is self.REQUEST.RESPONSE.setHeader(). The error > occured at object creation. > > Something really bad is going on! > > Christian > > The problem I'm having is that these are all stock Zope products from a Zope2.7.0rc2 release. The traceback is coming from the Zope core. Traceback (innermost last): ... Module Shared.DC.Scripts.Bindings, line 320, in __render_with_namespace__ Module Shared.DC.Scripts.Bindings, line 343, in _bindAndExec Module App.special_dtml, line 175, in _exec Module DocumentTemplate.DT_Util, line 201, in eval - __traceback_info__: RESPONSE Module <string>, line 0, in ? AttributeError: 'NoneType' object has no attribute 'setHeader' This also seems different from what Christian is reporting; > Christian Heimes wrote at 2004-2-6 23:01 +0100: > And the next one: > > Python2.3.3/Zope2.70rc2/Plone2rc5. > > > Exception Type > AttributeError > Exception Value > 'str' object has no attribute 'RESPONSE' > > [...] > Module Products.CMFPhoto.Photo, line 510, in clearCache > AttributeError: 'str' object has no attribute 'RESPONSE' > > The relevant code line is self.REQUEST.RESPONSE.setHeader(). The error > occured at object creation. > > Something really bad is going on! So, I'm still baffled by this. Many thanks to all those providing more data points. I *think* this is a 'Zope' thing and not a 'Tone' thing, but I've been wrong in that area before ;) cheers tone. -- Dr Tony McDonald, Asst Director, FMSC. 0191 245 4223 Project Manager, FDTL-4 ePortfolios http://www.eportfolios.ac.uk/

2 2

PageTemplateFile vs. Bindings vs. Security
by Jamie Heilman 25 Mar '04

25 Mar '04

So... remember way back when Brian warned about the binding breakage due to the improved security checks? It just bit me in a way I didn't forsee. I forgot that PageTemplates use bindings too, which means those changes affect more than just PythonScripts they affect Products that use PageTemplateFile methods. My product had declared its object instances to be private, and in doing so it totally breaks the ability to use PageTemplateFile methods. This sucks. Using DTML for product methods goes against the fiber of my being, I just can't bring myself to do it; the namespace pollution as programing paradigm is so frustrating it just makes me want to throw things. But DTMLFile has a huge advantage ... it does the Right Thing with respect to Zope security. It ignores it completely. Paradoxically, by ignoring Zope's security framework in the context of on-disk methods this actually improves Zope's overall security. It allows you to fully take advantage of the API seperation available to Products. To briefly enumerate, you've got 3 basic types of methods: def _python_only_methods(): """docstring doesn't "matter" as this can't be published or accessed TTW, security declarations are superfluous, can't be accessed by RestrictedPython either""" def python_or_RestrictedPython_methods(): # no docstring ensures its not publishable, security declarations # are necessary to dictate RestrictedPython's privileges pass def publishable_python_or_RestrictedPython_methods(): """docstring dictates publishablility, security declarations are necessary and dictate both RestrictedPython's privileges and TTW privileges""" Now DTMLFile does its work with the privileges of "python" code, which is great because it means you can define methods which generate content fragments without any restrictions on what APIs it can and can't use. This is useful--more on why in a sec. Conversely the PageTemplateFile does it work with the privileges of "RestrictedPython" code, which might seem great at first, ("More security? What can possibly be bad about that?!") but rapidly wears thin when you try to use PageTemplateFiles in API code, and screws Product authors who were trying to write secure code. To illustrate the first point where PageTemplateFile forces a weakened API, consider the case of Tabs.manage_tabs() ... this method must be declared *public* so that Products using PageTemplateFile can access it. The caller's security context is taken into account with PageTemplateFiles and as 2 different products using PageTemplateFile methods might require completely different permissions to access the method which in turn relies upon Tabs.manage_tabs() the only way to satisfy all possible permission combinations is to just give up and declare the method public so it always succeeds. Products using DTMLFile OTOH don't care, it could be totally private, as it *should* be, and DTMLFile methods would still be able to call it and use the results to display content without regards to callers security context, this makes DTMLFiles useful because you can maintain the integrity of your API and not expose stuff to RestrictedPython that true RestrictedPython has no business calling. If only DTML wasn't such a horrible, syntactically braindamaged, stack-bound HELL to work with! But DTML is hell, and thats not going to change, its better to focus energies on the future which is ZPT, and I assert that PageTemplateFile behavior needs to change. Back to the second point, that the current behavior screws Product authors trying to write secure code. My product called security.declareObjectPrivate() because this is the only way I know of to ensure a product and its attributes are safe from tampering, and until the Binding changes, I thought this was a great deal. Now that the hole in bindings have been fixed though it turns out that because my product uses PageTemplateFile methods which in turn pay attention to bindings, and, unfortunately, pay attention to the callers security context as well, none of those methods work anymore, they raise Unauthorized: Not authorized to access binding: container I can fix this by changing my object security declaration to be public or restricted to a permission, but that has side effects that I don't want, namely opening my object instances up to tampering from within RestrictedPython given the appropriate security context. Given that my need to have the object instance completely private and my desire to avoid DTML are now in direct conflict I'm basically forced to choose between a range of compromises and I don't like any of them. So here's the questions I have for you all... is there a way to declare appropriate security on the bindings that are screwing me right now from within my product code so that I can selectively poke holes to allow container access where needed, or am I to be forcibly coerced into exposing my object to restricted code? And two, assuming I haven't overlooked some detail about why forcing PageTemplateFile to work within the calling security context is a good thing... Shouldn't we fix PageTemplateFile to work like DTMLFile wrt security? How hard is it going to be to do that? -- Jamie Heilman http://audible.transient.net/~jamie/ "...thats the metaphorical equivalent of flopping your wedding tackle into a lion's mouth and flicking his lovespuds with a wet towel, pure insanity..." -Rimmer

6 12

manage_access patch
by Johan Carlsson 25 Mar '04

25 Mar '04

Hi, I've made a patch to manage_access (and AccessControl.Role.permission_settings) that displays the current effective security setting (something that have been bugging me for ages). It also uses a small javascript and disabled property of the checkboxes (with potential problems with old browsers that don't support the disabled property). So where should I send the patch, I'm not currently active as a Zope contributor. Regards, Johan Carlsson -- Johan Carlsson Tel: + 46 8 31 24 94 Colliberty Mob: + 46 70 558 25 24 Torsgatan 72 Email: johanc(a)easypublisher.com SE-113 37 STOCKHOLM Skype: colliberty

2 1

APE and SQL Storages in Zope 2.7
by santi＠zetadb.com 24 Mar '04

24 Mar '04

Hi all, I'm trying to use APE (yesterday CVS version) on Zope 2.7.0 and Postgresql, but I'm not able to make it work. With some minor changes in datatypes.py (change loadConf for load_conf), it works fine using FSConnection, but DBAPIConnection seems not to be ready to work together with ZConfig machinery. Is there any way to have a working config for postgresql and zope 2.7 ? Or everybody is working with FileSystem storages and SQL storages are just working with zope 2.6 ? Thanks in advance Santi Camps http://zetadb.sourceforge.net

4 4

...but I want to access 'a particular tuple' in that context!
by Jamie Heilman 23 Mar '04

23 Mar '04

Try this in a PythonScript: d = {1:2} for t in d.iteritems(): pass Annoyingly, it raises Unauthorized: You are not allowed to access 'a particular tuple' in this context Is there a reason for this, or is it just part of AccessControl/RestrictedPython that hasn't been fleshed out yet? -- Jamie Heilman http://audible.transient.net/~jamie/ "I was in love once -- a Sinclair ZX-81. People said, "No, Holly, she's not for you." She was cheap, she was stupid and she wouldn't load -- well, not for me, anyway." -Holly

3 3

Problem with editing dtml in textarea
by pieter claassen 23 Mar '04

23 Mar '04

For some reason if I do the following: <textarea name="col1" rows="30" cols="120" ><dtml-var expr="_.getitem('1_col',0)" html_quote></textarea> I can edit the html but all dtml is interpreted. I am trying to build a dtml page with which I can edit other pages: 1. Any recommendations on how to do this? 2. How do then overwrite the previous page with the edited code? Thanks, Pieter

2 1

How to create a product with all_meta_types and the name of the product
by Garito 23 Mar '04

23 Mar '04

Hi all I would like to create a product knowing the name of these product. How to do it? I arrive to product but I don't know how to create it and set to de container With these code self['manage_addProduct']['product'].manage_addMyProductManageAdd(id, content) In the information retrieved by self.all_meta_types()['product']['action'] I can retrive the 'manage_addProduct' string, 'product' string but I don't retrieve manage_addMyProductManageAdd but I retrieve manage_addMyProductManageAddForm (this is the form of the constructor) Any idea? Thanks

4 6

asyncore -> twisted
by Duncan M. McGreggor 22 Mar '04

22 Mar '04

The Zope2 sprint has been focusing on HTTPServer, and one of the interesting ideas that came up was to replace asyncore with twisted. Several people have worked on this in the past, and we were hoping that you could share your experiences, warnings, intuitions, and hopefully even code :-) We look forward to any input, - PyCon2004 Zope2 Sprint

2 1

Re: [ZODB-Dev] [Problem] strange state after SIGSEGV
by Dieter Maurer 22 Mar '04

22 Mar '04

Sorry, the message was intended for "zope-dev". I have accidentally sent it to "zodb-dev". Redirected... Shane Hathaway wrote at 2004-3-22 11:03 -0500: >Dieter Maurer wrote: >> This problem report is for Zope 2.7.0, Python 2.3.3, Linux 2.4.19. >> >> After an application provoked SIGSEGV (caused by a C runtime stack overflow), >> my Zope process entered a strange (and unhealthy) state: >> >> Zope did not die completely (as it should have done) but only partially: >> One of the threads had disappeared, the others where in >> the following state: >> >> * their parent pid has been set to "1" >> >> * attaching with "GDB" was only allowed as "root" >> >> * at least two of the three remaining processes were waiting in "accept" >> >> * they would not die on SIGTERM but only SIGKILL >> >> Consequences: >> >> * Zope did no longer respond to requests >> >> * "stop" did not work (as "SIGTERM" was ineffective) >> >> * "start" did not work, as the dangling processes kept >> the HTTP port bound. >> >> >> Anyone with some understanding what can cause such a strange state? > >While developing, this happens all the time for me. The most reliable >way to get there is to Ctrl-C out of a 'pdb' session. > >I can explain some of it. Python threads other than the main thread set >a mask that blocks most signals, but SIGKILL (9) can't be blocked. You >can find out the signal mask for a process by looking at the SigBlk line >of /proc/(process_id)/status. I think Python freezes because a lock >held by the dead thread never gets released--perhaps the storage's >commit lock. The parent pid and gdb issues could be normal for Python >threads. Thank you for your response! The commit lock is held only during the last phase of a request (the commit). It is unlikely that it is being held. It definitely was not held in my case. The parent pid and gdb issues are not normal for Python threads. It looks wrong that a SIGSEGV does not terminate the complete process. Such a behaviour interferes with what "zdaemon" is supposed to do (restart Zope in case of a problem). Python threads indeed block signal 11 (SIGSEGV). -- Dieter

1 0

TALES context
by Garito 22 Mar '04

22 Mar '04

Hi I try to create another context object for TALES like 'container' or 'here' Is there any mechanism to create these? Like PUT_factory for FTP/WevDav or meta_types for the products Thanks!!

2 1