- Zope-Dev - Zope lists

Re: CookieCrumbler and MSIE using HTTPS
by Shane Hathaway 01 Jul '03

01 Jul '03

[I'm sending this to the zope-dev in the hope that Eric sees this. Eric, the mail relay at univ-savoie.fs is misconfigured; it rejects all mail from zope.com.] Eric Brun wrote: > The problem is describe on microsoft site : > http://support.microsoft.com/default.aspx?scid->http://support.microsoft.com:80/support/kb/articles/q316/4/31.asp&NoWebCont…>1 > > I resolve it like that : > > resp.setHeader('Cache-Control','max-age->1') > against > resp.setHeader('Cache-Control','no-cache') > > What do you think of that ? Unfortunately, max-age=1 means that caches *are* allowed to store the response, if only for a short time. That could be a hazard, since it would result in *more* caching than we have now. The bug is in Internet Explorer, but MS refuses to acknowledge it. "Saving" a file is not the same as "caching" a file, but the API thinks they are the same. To give you a partial solution, I just checked in a version of CC that lets you set the Cache-Control header value. That way you can solve the problem however you want. It's probably best to disable the header in your case. Shane

1 0

[Dairy] Mail unprocessed
by panjy＠zopechina.ods.org 01 Jul '03

01 Jul '03

You are not subscribed to [Dairy]. Yours, panjy(a)zopechina.ods.org

1 0

PageTemplateFiles considered anonymous?
by Richard Jones 01 Jul '03

01 Jul '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PageTemplateFiles don't have an "id" attribute set when they're created - - they have a __name__ instead. This causes functions like getPhysicalPath (and the related absolute_url) to break in fun ways :) The SimpleItem.Item_w__name__ mixin was created for pretty much this situation. Any objections to adding that mixin to PageTemplateFile by default instead of the vanilla SimpleItem.Item? Also, is there a reason why Item_w__name__ doesn't define getId() when it does define _setId()? Richard -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE/AOgYrGisBEHG6TARAi6NAJ9MUwVfWo4p0tCRQd2TviUHGGV7xACfW+Vq dewj4ut3nC7HXx3hp83A2HQ= =chPE -----END PGP SIGNATURE-----

1 0

Heads-up: 2.6.2 b3 and 2.7 a1 releases
by Brian Lloyd 27 Jun '03

27 Jun '03

Hi all - As far as I know, all of the outstanding tasks to cut Zope 2.6.2 b3 are complete, and all of the items considered important to get into the 2.7 alpha 1 have been merged. I'd like to plan to make both releases this Friday if possible, so if you know of something that I've missed that still needs to be done (for either release), please let me know ASAP. Thanks! Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

2 1

raise_standardErrorMessage facilitates cross site scripting
by Jamie Heilman 27 Jun '03

27 Jun '03

Jamie Heilman wrote: > I have a feeling its atributable to either > raise_standardErrorMessage's "smart" tag searching, or some other > auto-magical aspect of the error handling framework. I finally got around to testing this hypothesis, and it seems to be true. raise_standardErrorMessage assumes anything stringish matching [a-zA-Z]> is markup and subsequently sets error_message, which normally isn't quoted. The problem is, while it may very well be markup there's no reason to trust it, as was shown with the case when int() is passed '<b>old', the error message may contain markup obtained from an untrusted source. So the question is, how much pain would it cause if there was mandate that error messages could not contain markup, and the behavior was changed so that error_message was always quoted, but assumed to be pre-formatted plain text? -- Jamie Heilman http://audible.transient.net/~jamie/ "Paranoia is a disease unto itself, and may I add, the person standing next to you may not be who they appear to be, so take precaution." -Sathington Willoughby

1 0

weak examples, weak exploits
by Jamie Heilman 24 Jun '03

24 Jun '03

http://exploitlabs.com/files/advisories/EXPL-A-2003-009-zope.txt This hit the full-disclosure list the other day. Vulnerabilities 1 and 3 are moot and have been since the introduction of SiteErrorLog. Although if the responsible parties had bothered digging a little deeper they'd have found the BCI HTTP headers and likely thrown a fit. Anyway, if you can wade your way past the all the spelling errors you'll see the 0day exploits are your typical abuse of badly code web apps, and apart from 1 and 3 there are probably legitimate bugs there. Your predictable response: There's just examples. Uninstall them. They shouldn't be left on a production system. Sure, you know that, I know that, my cat knows that. Joe Six Pack told me he knew, but he didn't care. Which tends to the be the consensus. But thats no excuse to be shipping bad examples. They should be fixed, bad examples are worse than no examples at all. I'll submit a fixed Examples.zexp but I need to know how its normally prepared, ownership, etc. Is there anything special I should do? -- Jamie Heilman http://audible.transient.net/~jamie/ "I was in love once -- a Sinclair ZX-81. People said, "No, Holly, she's not for you." She was cheap, she was stupid and she wouldn't load -- well, not for me, anyway." -Holly

10 17

Re: [Zope-dev] weak examples, weak exploits
by Jamie Heilman 24 Jun '03

24 Jun '03

Casey Duncan wrote: > I would be in favor of making the Examples "opt-in" like the Zope > tutorial. It seems silly to have it in evey ZODB by default. Make > people add it if they want it. I aggree. Casey Duncan wrote: > Actually the add form could be linked from the Quick Start page to make it > really stupid simple. Totally. Patch and reworked Examples may be found at http://collector.zope.org/Zope/956 -- Jamie Heilman http://audible.transient.net/~jamie/ "Paranoia is a disease unto itself, and may I add, the person standing next to you may not be who they appear to be, so take precaution." -Sathington Willoughby

1 0

zopeinstall, error in zope2.7 cvs
by PieterB 23 Jun '03

23 Jun '03

Hi, My first version of the zopeinstaller is available. It currently only build Python 2.2.3 and Zope 2.7, but I would like to enhance it to a full 'tinderbox'. See http://zwiki.org/PythonZopeTinderbox for details. It currently builds Python 2.2.3 from tarball and Zope 2.7 from CVS. It uses 'aap' to do so (http://www.a-a-p.org) For the first version of the main.aap of Zope, see http://gewis.nl/~pieterb/zope/zopeinstall/ I found one error in Zope2.7 CVS while working on the script. Zope doesn't seem to mind the <http-port> section in etc/zope.conf I changed the address, but the zopeserver started at port 8080 (default). This is my first installer/a-a-p-scripts, so please give feedback. Regards, PieterB -- http://zwiki.org/PieterB

1 0

Ordered Folder again
by Florent Guillaume 23 Jun '03

23 Jun '03

Hi, I'm sorry to revisit an problem that I see has been discussed to death last month, but I'd like to propose a change to what has currently been checked in about Ordered Folders into Zope 2.7. What I often want is an easy way to migrate existing sites to the ordered version. So I would propose that all Folders have OrderSupport, but with the following change: - in a folder, has_order_support would be either a boolean, or not present and thus found by acquisition - the zope root would have has_order_support = 0 - OrderSupport.manage_renameObject would do its special stuff only if self.has_order_support is true - dtml/main.dtml would test ordering with a simple <dtml-let hasOrderSupport=has_order_support> - dtml/folderAdd.dtml would present the user with a choice to basically decide if has_order_support should be set, unset or acquired. - manage_addFolder would take this additional argument and do nothing or create a property for has_order_support. Thus the default behavior would be the same as today, but if a folder is created with the has_order_support property (or if it's set after creation), the subtree would then be ordered. In a CMS that's always what we want. What do you think ? I think it gives the best of both worlds, as it's then very easy to migrate a site. The only downside is, I think that products like BTreeFolder2 would have to add an has_order_support=0 class variable. Florent -- Florent Guillaume, Nuxeo (Paris, France) +33 1 40 33 79 87 http://nuxeo.com mailto:fg@nuxeo.com

2 5

RE: [ZODB-Dev] BTrees & 2.6.2b3?
by Tim Peters 23 Jun '03

23 Jun '03

[seb bacon] > Just a quick repeat from last week in case it slipped from > anyone's radar... Here is the important bit again: > > a) Any reason why I shouldn't merge BTree bugfix(es) into the > 2.6 branch? > b) If "no", how about a 2.6.2b3? Specifically which changes do you have in mind? The one here: > http://cvs.zope.org/Zope/lib/python/BTrees/BTreeItemsTemplate.c.diff?r1=1.17 &r2=1.18 was backported to the 2.6 branch last week. There are now many active versions of the btree code (Zope2 head, Zope3 head, ZODB3 head, Zope-2_6-branch, ZODB3-3_1-branch, and ZODB3-3_2-branch are the ones I try to keep track of -- with *some* success <wink>), and not all changes in all branches belong in all other branches.

2 1