- Zope-Dev - Zope lists

How (in)secure is Zope?
by Christian Tismer 23 Mar '03

23 Mar '03

Dear Zope community, please excuse my ignorance, but I am asked from time to time how secure or insecure Zope actually is, and I always have to say that I actually don't know. There are people claiming that Zope opens a system to quite some level, others claim the opposite. Can someone please enlighten me and give me some details? Especially, are there some Zope products considered especially "insecure"? And, pondering more on security, are these issues, if they exist, bounded to Zope itself, or becomes a system generally more "open" to attacks, after Zope was installed? I don't mean to offend anybody by this, it is just a very simple question which I cannot answer alone. thanks so much in advance -- chris -- Christian Tismer :^) <mailto:tismer@tismer.com> Mission Impossible 5oftware : Have a break! Take a ride on Python's Johannes-Niemeyer-Weg 9a : *Starship* http://starship.python.net/ 14109 Berlin : PGP key -> http://wwwkeys.pgp.net/ work +49 30 89 09 53 34 home +49 30 802 86 56 pager +49 173 24 18 776 PGP 0x57F3BF04 9064 F4E1 D754 C2FF 1619 305B C09C 5A3B 57F3 BF04 whom do you want to sponsor today? http://www.stackless.com/

18 34

Using index.htm(l) files like index_html
by David Cain 22 Mar '03

22 Mar '03

How can I customize my Zope server to treat index.html and index.htm files like index_html files? Thanks David Cain Senior Web Developer, Information Systems Department Syracuse University Library Syracuse, New York 13244-2010 (315) 443-5923 mailto:dacain@library.syr.edu mailto:dacain@syr.edu

4 3

XMLRPC with varargs
by Marco Catunda 21 Mar '03

21 Mar '03

Hello, I have tried call a function via XMLRPC with * and ** args with no success! The following error have appeared: ------------------------------------------------ Unexpected Zope error value: Traceback (most recent call last): File "/home/catunda/projetos/zope/cvs/zope/lib/python/ZPublisher/Publish.py", line 150, in publish_module response = publish(request, module_name, after_list, debug=debug) File "/home/catunda/projetos/zope/cvs/zope/lib/python/ZPublisher/Publish.py", line 114, in publish sys.exc_info()[2], File "/home/catunda/projetos/zope/cvs/zope/lib/python/ZPublisher/Publish.py", line 98, in publish request, bind=1) File "/home/catunda/projetos/zope/cvs/zope/lib/python/ZPublisher/mapply.py", line 71, in mapply if len(positional) > nargs: raise TypeError, 'too many arguments' TypeError: too many arguments ------------------------------------------------ I don't know if it's a bug but I debugged zope and changed some things in mapply.py. The idea of this changes is test if a function has *,** args or not using inspect module. I don't know if this changes will affect other things in zope. Follow the patch of changes. --- mapply.py 2003-03-17 19:30:12.000000000 -0300 +++ mapply.py.new 2003-03-17 18:59:54.000000000 -0300 @@ -13,6 +13,8 @@ """Provide an apply-like facility that works with any mapping object """ +import inspect + def default_call_object(object, args, context): result=apply(object,args) # Type s<cr> to step into published object. return result @@ -23,11 +25,15 @@ def default_handle_class(klass, context): if hasattr(klass,'__init__'): f=klass.__init__.im_func - c=f.func_code - names=c.co_varnames[1:c.co_argcount] - return klass, names, f.func_defaults + #c=f.func_code + #names=c.co_varnames[1:c.co_argcount] + spec=inpect.getargspec(f) + names=spec[0][1:] + defaults=spec[3] + vargs=spec[1:3] + return klass, names, defaults, vargs else: - return klass, (), () + return klass, (), (), [] def mapply(object, positional=(), keyword={}, debug=None, maybe=None, @@ -37,7 +43,7 @@ ): if hasattr(object,'__bases__'): - f, names, defaults = handle_class(object, context) + f, names, defaults, vargs = handle_class(object, context) else: f=object im=0 @@ -53,20 +59,28 @@ if im: f=f.im_func - c=f.func_code - defaults=f.func_defaults - names=c.co_varnames[1:c.co_argcount] + #c=f.func_code + #defaults=f.func_defaults + #names=c.co_varnames[1:c.co_argcount] + spec=inspect.getargspec(f) + names=spec[0][1:] + defaults=spec[3] + vargs=spec[1:3] else: defaults=f.func_defaults - c=f.func_code - names=c.co_varnames[:c.co_argcount] + #c=f.func_code + #names=c.co_varnames[:c.co_argcount] + spec=inspect.getargspec(f) + names=spec[0] + defaults=spec[3] + vargs=spec[1:3] nargs=len(names) if positional: positional=list(positional) if bind and nargs and names[0]=='self': positional.insert(0, missing_name('self', context)) - if len(positional) > nargs: raise TypeError, 'too many arguments' + if (len(positional) > nargs) and not vargs: raise TypeError, 'too many arguments' args=positional else: if bind and nargs and names[0]=='self': -- Marco Catunda

3 4

New installer branch
by Christian Theune 20 Mar '03

20 Mar '03

Hi. I'm reconfiguring my dev setup for the freshly merged new installer. My zope instances refuse to load the products from the Products directory but don't complain. Here my configured Pathes: SOFTWARE_HOME /home/zagy/zope/servers/Zope-HEAD/lib/python ZOPE_HOME /home/zagy/zope/servers/Zope-HEAD INSTANCE_HOME /home/ctheune/tmp/instance-template CLIENT_HOME /home/ctheune/tmp/instance-template/var Products are sitting in /home/ctheune/tmp/instance-template/Products Thanks for a tip. Christian -- Christian Theune, gocept gmbh & co.kg phone: +49-3641-233526 mobile: +49-179-7808366 mail: ct(a)gocept.com

2 2

ch-ch-ch-changes (post-merge fallout)
by Jamie Heilman 20 Mar '03

20 Mar '03

I'm slowly fumbling my way through the massive changes of the latest branch merge... am I missing where the open databases (Globals.opened) get closed, or did that just get dropped entirely (and if so, how does that relate to the goals of the clean shutdown work)? Also, now that the hacked asyncore is no longer wedged into place in ZServer/__init__.py are there any known gotchas if one should import say, Zope and running Zope.startup() before importing ZServer? Not that I plan on doing that mind you, but the side-effects that Zope 2 suffers from in its various import dependancies drive me up a wall. It'd be cool if that one got fixed. -- Jamie Heilman http://audible.transient.net/~jamie/ "...thats the metaphorical equivalent of flopping your wedding tackle into a lion's mouth and flicking his lovespuds with a wet towel, pure insanity..." -Rimmer

2 1

Proposed installation changes for review
by Chris McDonough 19 Mar '03

19 Mar '03

Hi folks, An effort to improve Zope 2 installation, startup, and configuration for Zope 2.7 has been ongoing for some time now (see http://dev.zope.org/Wikis/DevSite/Proposals/InstallationAndConfiguration) The effort has reached a point where we believe it is reasonable to merge its fruits to the Zope trunk. Before doing so, however, we want to gather input from people who care deeply about Zope configuration and installation; particularly those who have significant investments in the existing behaviors of Zope 2 configuration and installation. A bunch of stuff is changed (most notably Zope no longer uses environment variables as configuration, and instead defers to command-line arguments and config file values). What follows is a summary of changes, a walk-through of a Zope 2 installation under this regime, and a list of the configuration-file changeable parameters exposed by the current Zope configuration schema. Please provide your feedback before this Friday, March 14. If possible, check out and try the new software. If there are showstopper issues for a lot of people, we will consider not performing the merge directly after that date. Otherwise, the merge will be performed at any time after the 14th. Thanks! - C ----- Major changes in Zope 2.7 ========================= Zope 2.7 will contain a number of changes related to the build process and configuration. The scripts used to start Zope will also be substantially changed. The implementation of these changes is not yet complete, but a substantial portion has been done and is expected to be merged into the Zope 2 trunk in the near future. The exact schedule for merging these changes has not been determined; additional notice will be provided. These changes are substantially based on efforts by Chris McDonough on the "chrism-install-branch". Major changes ------------- The following are the most important and user-visible changes compared to Zope 2.6 and the current CVS HEAD: - Configuration is normally done by editing a config file instead of passing command line options. The configuration file is handled by the ZConfig package. - Environment variables are no longer used for configuration. - Building and installing the software have become more clearly distinct; the installation can be separate from the build. - Zope 2.7 uses the "instance home" model in the normal case: a script in the installed software is used to create new "instances" of Zope. Each instance is defined by a directory tree containing configuration, scripts, and data. (For convenience, the instance and the installation can be located in the same directory, and the build area may be used in lieu of an installation if desired.) - The z2.py, start, and stop scripts have been replaced by the runzope and zopectl scripts. - The runzope/zopectl scripts do not accept the same command-line arguments as z2.py used to accept. - The wo_pcgi.py script used to build Zope without PCGI support has been replaced by the common Unix build sequence of configure, make. - The pcgi/ directory and the w_pcgi.py script have been removed from the top of the source tree. The pcgi/ directory may be made available as a separate distribution. (The application server still has support to allow connections from a PCGI-capable Web server.) - The ZServer package has been moved from the top of the source tree into the lib/python/ directory. Getting the code today ---------------------- The implementation lives in the "new-install-branch", which is a "partial" branch rather than a complete branch: only the files and directories which need to be changed have been placed on the branch; all other files are used from the CVS HEAD. The current state of this code can be checked out from CVS using the command: cvs -d :pserver:anonymous@cvs.zope.org:/cvs-repository co \ -r new-install-branch -f Zope The installation instructions in doc/INSTALL.txt has been updated on the branch; that file provides detailed information on creating an installation and instance. (A copy has been attached for convenience.) A sample installation/startup runthrough --------------------------------------- The below is the output from a sample install session. During this session, we install the Zope software to /tmp/zopehome and install an instance home to /tmp/insthome. [chrism@james software]$ cd NewInstallBranch/ [chrism@james NewInstallBranch]$ ./configure --prefix=/tmp/zopehome Configuring Zope installation Testing for an acceptable Python interpreter... Python version 2.1.3 found at /home/chrism/bin/python Python version 2.1.3 found at /home/chrism/bin/python2.1 Python version 2.2.2 found at /home/chrism/bin/python2.2 The optimimum Python version (2.2.2) was found at /home/chrism/bin/python2.2. - Zope top-level binary directory will be /tmp/zopehome. - Makefile written. Next, run make. [chrism@james NewInstallBranch]$ make "/home/chrism/bin/python2.2" inst/setup.py -q build_ext -i <... compilation output elided ...> Zope built. Next, do 'make install' (or 'make instance' to run a Zope instance directly from the build directory). [chrism@james NewInstallBranch]$ make install <... installation output elided ...> Zope binaries installed successfully. Now run '/tmp/zopehome/bin/mkzopeinstance' [chrism@james NewInstallBranch]$ /tmp/zopehome/bin/mkzopeinstance mkzopeinstance requires exactly one argument mkzopeinstance: Create a Zope instance home. usage: mkzopeinstance [options] directory Options: -h/--help -- print this help text -u/--user NAME:PASSWORD -- set the user name and password of the initial user [chrism@james NewInstallBranch]$ /tmp/zopehome/bin/mkzopeinstance \ --user=admin:123 /tmp/inst [chrism@james NewInstallBranch]$ cd /tmp/inst/ [chrism@james inst]$ ls bin etc Extensions import inituser log Products README.txt var [chrism@james inst]$ bin/zopectl start . daemon process started, pid=2947 [chrism@james inst]$ bin/zopectl stop . daemon process stopped Changing the configuration via the config file ---------------------------------------------- The Zope configuration file uses the ZConfig API and file format. See the ZConfig documentation PDF at http://cvs.zope.org/Packages/ZConfig/doc/zconfig.pdf for more information. The default Zope configuration file will live in the instance_home's /etc directory and will be named 'zope.conf'. The Zope configuration file allows you to change the following configuration variables: instance home client home debug mode effective user production installation (on/off) locale number of zserver threads the python "check interval" (thread switch timing) zserver read only mode pid file name lock file name structured text header level publisher profile file (debugging) cgi environment dns server (hostname resolving in logfiles) ip address (for zserver bindings) http realm automatic quotation of dtml request data security manager stack size security policy implementation (C, Python) skip authentication checking skip ownership checking max number of session objects session "add notify" script path session "delete notify" script path session timeout minutes access rule suppress site root suppression database quota size read only database zeo client name logging (access, event, debug, filenames, to syslog, etc). network servers (http, dav, ftp, monitor, etc) databases (storages, database classes, etc.)

12 54

PyOpenGL support?
by Edward Duffy 19 Mar '03

19 Mar '03

Hello all, I've spent the last couple of days going through the Zope docs, mail archives, and even googling, but I can't find a lot of information on using PyOpenGL with Zope. I've found a message from Anthony Pfrunder, dated July 1999: "Within the next few weeks I'll be releasing an extension patch to allow the use of the Python Imaging Library and OpenGL with Zope." And a blurb about PyOpenGL in Zope Newbie News, Jan 2001: http://weblogs.userland.com/zopeNewbies/2001/01/24 It just mentions its release but nothing about Zope. So, has been done before? And if so, is there some documentation/guide on getting it work? Thanks! -- Edward Duffy <eduffy(a)CLEMSON.EDU>

2 2

Merging the new-install-branch
by Fred L. Drake, Jr. 19 Mar '03

19 Mar '03

I'm planning to merge the new-install-branch efforts recently discussed on this list into the Zope 2 trunk tomorrow. There will be things to do after the merge, but the basic functionality will be more easily testable and easier to contribute to. There's a bit more testing to be done before the merge can occur; I'll be doing that tonight and tomorrow morning. I'll send a note to the zope-coders list before I actually start the merge. For a description of the changes (and the ensuing discussion), refer to this thread: http://mail.zope.org/pipermail/zope-dev/2003-March/018999.html Perhaps the most immediate change is that the Windows tests may become completely wedged, since we've not had time to do any testing on Windows yet. If anyone has time to do so (and a suitable platform), please don't hesitate to send bug reports before the merge! Checkout instructions are included in the message referenced above. -Fred -- Fred L. Drake, Jr. <fdrake at acm.org> PythonLabs at Zope Corporation

4 6

Session Errors
by John Eikenberry 19 Mar '03

19 Mar '03

Since upgrading to Zope-2.6 we've been getting KeyErrors when using Sessions. They seem to happen more now that we've started using hasSessionData(), but I'm pretty sure they happened prior to that. Anyways, here are the 2 related tracebacks. Has anyone else seen these? Traceback #1 occurs most frequently. The KeyError's value is an unprintable string of non-ascii characters. * Module ZPublisher.Publish, line 150, in publish_module * Module ZPublisher.Publish, line 114, in publish * Module The application server.App.startup, line 182, in zpublisher_exception_hook * Module ZPublisher.Publish, line 98, in publish * Module ZPublisher.mapply, line 88, in mapply * Module ZPublisher.Publish, line 39, in call_object * Module App.special_dtml, line 61, in __call__ * Module DocumentTemplate.DT_String, line 474, in __call__ * Module Products.Transience.Transience, line 342, in nudge * Module Products.Transience.Transience, line 467, in _getCurrentBucket * Module Products.TemporaryFolder.LowConflictConnection, line 34, in setstate * Module Products.TemporaryFolder.TemporaryStorage, line 94, in load KeyError: Traceback #2 happens less frequently, though today it seemed like it was trying to catch up (3 of these today). * Module ZPublisher.Publish, line 98, in publish * Module ZPublisher.mapply, line 88, in mapply * Module ZPublisher.Publish, line 39, in call_object * Module OFS.DTMLMethod, line 126, in __call__ * Module DocumentTemplate.DT_String, line 474, in __call__ * Module Products.DotOrg.Pages.KContent, line 149, in __call__ * Module Products.DotOrg.Pages.KContent, line 194, in getEditInfo * Module Products.DotOrg.Pages.KContent, line 506, in hasSessionData * Module Products.Sessions.SessionDataManager, line 101, in hasSessionData * Module Products.Sessions.SessionDataManager, line 175, in _hasSessionDataObject * Module Products.Transience.Transience, line 838, in has_key * Module Products.Transience.Transience, line 807, in get KeyError: 1047409860 -- John Eikenberry [jae(a)kavi.com] ______________________________________________________________ "A society that will trade a little liberty for a little order will deserve neither and lose both." --B. Franklin

4 21

Modification Help
by mattficken＠mail.com 17 Mar '03

17 Mar '03

I am trying to develop a program that generates a top-level folder within zope and then has one of its functions called to give permission to access the folder, as opposed to using the standard Zope permission system. As I understand it the only way to do this is to modify the core zope software. Am I correct or is there another way to do it? I have looked at OFS.ObjectManager and discovered that the functions _getobj, _setobj, and _delobj are called to get, set and delete an object. Presumably, if I raised an exception here, it would cause the operation to not suceed. I have also figured out how to get the ID and Title of the file, but I can't get the absolute path. How do I tell the absolute path of a file from within OFS.ObjectManager? And, is modifying OFS.ObjectManager to call the function in my program the best place to modify the core of zope? Thank You -- __________________________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup

3 2