- Zope-Dev - Zope lists

ESI support
by Bjorn Stabell 12 Jan '04

12 Jan '04

Any news on Zope support for ESI? http://mail.zope.org/pipermail/zope-dev/2003-January/018619.html http://www1.cn.squid-cache.org/mail-archive/squid-dev/200208/0047.html >From what little I can gather from the Squid mailing lists, it looks like ESI support is materializing in Squid. Bye, -- Bjorn

3 3

xmlrpclib.py
by Chris McDonough 11 Jan '04

11 Jan '04

There is an xmlrpclib.py included with Zope. It's a bit different than the one in Python 2.3. Is there any reason we shouldn't just delete it (aside from fear and the lack of unit tests? ;-) - C

2 1

Re: [Zope-dev] _.min and _.max still used by ZMI
by Dirk 11 Jan '04

11 Jan '04

Hi Johan, maybe the patch can fix your problem. Regards, Dirk

2 1

_.min and _.max still used by ZMI
by Johan Carlsson 10 Jan '04

10 Jan '04

Since the new security release for Zope 2.6.3 (and 2.7) the _.min and _.max doesn't work any more. But they are still used by the ZMI in the following places: OFS\dtml\properties.dtml(140): size="<dtml-var "_.min(7, _.len(getProperty(select_variable)))">"> OFS\dtml\properties.dtml(152): size="<dtml-var "_.min(7, _.len(_[select_variable]))">"> OFS\dtml\propertyType.dtml(93): size="<dtml-var "_.min(7, _.len(_[select_variable]))">"> OFS\dtml\renameForm.dtml(27): "_.max(40,_.len(getId())+4)">" value="&dtml-id;" /> This breaks at least "multiple selection" properties. Are there a work around for DTML files using these features? Best Regards, Johan Carlsson -- Johan Carlsson Tel: + 46 8 31 24 94 Colliberty Mob: + 46 70 558 25 24 Torsgatan 72 Email: johanc(a)easypublisher.com SE-113 37 STOCKHOLM Skype: colliberty

1 0

Where to put Zope 3 in Zope 2
by Jim Fulton 10 Jan '04

10 Jan '04

I want to make the zope.interface (Zope 3 Interfaces) package available on the Zope 2 head (aka Zope 2.8). I propose to add lib/python/zope3 as a container for zope 3 packages. This new directory will be added to the path used by Zope 2. A separate directory is needed because there are packages in Zope 2 and Zope 3, most notably zope and Zope, with names differing only in case. I will also replace the existing Interfaces package with a facade package that uses zope.interfaces. Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

2 1

Builtins on Zope 2.6.3
by Christian Theune 09 Jan '04

09 Jan '04

Hi, i have the strange feeling that somebody forgot to include the AccessControl.ZopeGuard.safe_builtins for DTML. See DT_Utils.py around line 56 and the corresponding imports as well as the definition of safe_builtins in ZopeGuard.py. Could someone verify this? Cheers, Christian -- Christian Theune, gocept gmbh & co. kg http://www.gocept.com - ct(a)gocept.com fon: 03496 3099112 fax: 03496 3099118 mobile: 0179 7808366

3 2

ANNOUNCE: Zope 2.6.3 Release and Security Update
by Brian Lloyd 09 Jan '04

09 Jan '04

Zope 2.6.3 Release and Security Update Zope 2.6.3 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.6.3 from Zope.org: http://www.zope.org/Products/Zope/2.6.3/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.6.3 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.6.3 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.6.3 in the near future. Also note that there are binary code changes in the 2.6.3 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation. Zope 2.6.3 provides fixes for all of these issues. A description of each issue, who is affected and issue status is included below. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.6.3/CHANGES.txt - http://www.zope.org/Products/Zope/2.6.3/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html ISSUES RESOLVED BY Zope 2.6.3: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher.

5 8

Re: [Zope3-dev] substransactions and beforeDelete
by Florent Guillaume 08 Jan '04

08 Jan '04

[Cc zope-dev and not zope3-dev anymore as my question is now zope 2 related...] Ok so Jim mentionned it was possible to do rollback of subtransactions in Zope 2. How can I do that ? What's the idiom that would be equivalent to: tid = startSubTransaction() ... if something: rollbackSubTransaction(tid) Thanks, Florent Steve Alexander wrote: > >>> Why are you catching the exception? >> >> >> Because I want to display a nice message to the user. If I don't catch >> the exception, it will go up to the Publisher that will display a >> not-nice error message. Hm are you suggesting I could provide a custom >> error message for that particular exception? That could work, but I >> would have like the flexibility of catching the exception from normal >> skin code and display my error message there. > > > Jim already mentioned a customised view on the exception. > > Another option that is not as architecturally clean, but might work > better for you, is to catch the exception, but doom the transaction. > > I wonder if it's a good idea to support having an application say "I > want to doom this transaction", and have the publication object just > abort that transaction without returning an error page. > > -- > Steve Alexander > > -- Florent Guillaume, Nuxeo (Paris, France) +33 1 40 33 79 87 http://nuxeo.com mailto:fg@nuxeo.com

2 1

Re: CVS: Zope/lib/python/Products/PluginIndexes/common - util.py:1.10.68.2
by Tres Seaver 07 Jan '04

07 Jan '04

Andreas Jung wrote: > Update of /cvs-repository/Zope/lib/python/Products/PluginIndexes/common > In directory cvs.zope.org:/tmp/cvs-serv8545/lib/python/Products/PluginIndexes/common > > Modified Files: > Tag: Zope-2_7-branch > util.py > Log Message: > - Using "_usage" parameters in a ZCatalog query is deprecated and > logged as DeprecationWarning. > > > === Zope/lib/python/Products/PluginIndexes/common/util.py 1.10.68.1 => 1.10.68.2 === > --- Zope/lib/python/Products/PluginIndexes/common/util.py:1.10.68.1 Mon Sep 29 08:02:02 2003 > +++ Zope/lib/python/Products/PluginIndexes/common/util.py Tue Jan 6 07:57:13 2004 > @@ -15,6 +15,7 @@ > > > import re > +from warnings import warn > from types import StringType,ListType,TupleType,DictType,InstanceType > from DateTime import DateTime > > @@ -65,7 +66,6 @@ > """ > > self.id = iid > - > if not request.has_key(iid): > self.keys = None > return > @@ -74,6 +74,7 @@ > usage_param = iid + '_usage' > if request.has_key(usage_param): > self.usage = request[usage_param] > + warn("\nZCatalog query using '%s' detected.\nUsing query parameters ending with '_usage' is deprecated.\nConsider using record-style parameters instead (see lib/python/Products/PluggableIndexes/README.txt for details)" % usage_param, DeprecationWarning) > > param = request[iid] > keys = None > Andreas, This checkin doesn't have accompanying changes to the tests (which now spew DeprecationWarnings on the 2.7 branch). It is also not propagated to the HEAD (only the doc/CHANGES.txt change made it there). Tres. -- =============================================================== Tres Seaver tseaver(a)zope.com Zope Corporation "Zope Dealers" http://www.zope.com

2 3

Zope 2.7 broken on Windows
by Andrew Veitch 06 Jan '04

06 Jan '04

http://collector.zope.org/Zope/1128 Not being able to use the calendar module on Zope 2.7 breaks our MailManager and more importantly the CMF! Has there been any progress on this? Or is there a sensible work-around I can give to our users - other than to switch to Linux! A

5 6