- Zope-Dev - Zope lists

What catalog/index to use ...
by Joachim Werner 10 Nov '02

10 Nov '02

Hi! Currently there are at least three options for doing full text indexing with ZCatalog: - good old TextIndex - ZCTextIndex - TextIndexNG TextIndex basically works fine for me and handles German umlauts well (if you use the right locale settings in the Zope start skript), but ZCTextIndex is generally better, except that it does not handle umlauts correctly as far as I can see. So without a bug fix ZCTextIndex is good for US, but not for us ;-) Then there is Andreas Jung's TextIndexNG, which seems to be really impressive. What are the plans for Zope 2.6.x/2.7? Will ZCTextIndex be replaced by TextIndexNG? Does it make sense to get ZCTextIndex fixed (there seems to be a patch in the collector already) or should I go with TextIndexNG? If yes, is it ready for production environments? Cheers Joachim _________________________ Joachim Werner iuveno AG Wittelsbacherstraße 23b 90475 Nürnberg Tel. +49 (0) 911 / 988398-4 Fax +49 (0) 911 / 988398-5 Mail: joachim.werner(a)iuveno.de WWW: http://www.iuveno.de

6 16

Simplifying the zdaemon package
by Guido van Rossum 09 Nov '02

09 Nov '02

The zdaemon package contains a bunch of dead wood, or "decoys", as Jim would call it, that I'd like to remove. AFAICT, Heartbeat.py is not used anywhere. At least not in the Zope sources -- maybe there are outside users??? And ZDaemonLogging.py is a very thin layer on top of zLOG -- can I get rid of it too? The SignalHandler.py class is not used by zdaemon itself; perhaps it can be moved into the Signals package? --Guido van Rossum (home page: http://www.python.org/~guido/)

2 3

Unit tests for Zope products: how to test HTTP access to objects in ZODB?
by Craeg K Strong 08 Nov '02

08 Nov '02

Hello: I am trying to add some unit tests for my XMLTransform product that test URL to Zope object traversal. For example, I want to ensure that one XSLT (a zope object) can include another using <xsl:include "../foo.xsl"/> Zope should transform the above into a request for a zope object with an ID of "foo.xsl" in the parent folder of the original XSLT. My question: how have you, dear reader, tested Zope's mapping of URLs (relative and/or absolute) to objects in ZODB? I am hoping that it can be done, possibly at the cost of bringing in additional Zope machinery (which means additional unit test startup time)...? Thanks in advance, --Craeg

2 1

ZEO 2.0 testConnection() takes 30 seconds (MountedStorage)
by Brad Clements 08 Nov '02

08 Nov '02

I'm using mounted storage.. Whenever my Zope server restarts, it takes 30 seconds after the first web hit before it's really up and running because testConnection() is called by "somebody". 1. Why does testConnection() take 30 seconds to run, or is it something else? 2. Why is testConnection() being called at all, since there is only one server so there's nothing to fall back to? Anyone have any ideas where to look for more clues? Maybe it's not testConnection.. 2002-11-08T13:57:27 INFO(0) ZODB Opening database for mounting: "{'host':'localhost','port':'4400','storage':'Common',}" ------ 2002-11-08T13:57:27 INFO(0) ZCS:4080 ClientStorage (pid=4111) created RW/normal for storage: 'Common' ------ 2002-11-08T13:57:27 INFO(0) ZEC ClientCache: storage='Common', size=20971520; file[0]='/home/bkc/Zope/Manage/var/cCommon-Common-4400-0.zec' ------ 2002-11-08T13:57:27 INFO(0) ZCS:4080 Testing connection <ManagedConnection ('127.0.0.1', 4400)> ------ 2002-11-08T13:57:57 INFO(0) ZCS:4080 Connected to storage ------ 2002-11-08T13:57:57 INFO(0) ZEC read_index: cache file 0 has 122 records and 386963 bytes ------ 2002-11-08T13:57:57 INFO(0) ZODB Mounted database "{'host':'localhost','port':'4400','storage':'Common',}" at Managers/Common Exception exceptions.AttributeError: "Connection instance has no attribute '_Connection__connection'" in <method Connection.close of Connection instance at 0x8bea73c> ignored Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax AOL-IM: BKClements

1 0

User Module
by Karthikeyan 08 Nov '02

08 Nov '02

Hi All, I am pretty new to zope. I have been asked to implement a project done by me in zope. I had user modules, group modules and some content management in my project(php). Now i need to do all in zope, which i not aware of. Please tell me what to do and where to start. PLease give me code for user module if possible. I should be able to create users and they should login thru the login page to enter the site and view the contents. I am running out of time to give my first module. Please help me out. Thanks S.Karthikeyan

4 4

RE: [Zope-dev] Re: Unsecure design of ExternalFile
by sean.upton＠uniontrib.com 07 Nov '02

07 Nov '02

I'm not familiar with ExternalFile, but likely plan to use it in the future. I think a list of expressly permitted directory locations (including all subdirectories) might be more secure. You can't go wrong with a default directory for files (perhaps $INSTANCE_HOME/var/files or something?), but otherwise an implicit deny all - then leave it up to the user to edit some access list file in the product (for example, call it 'diraccess.txt'). Does this seem reasonable? Sean -----Original Message----- From: Craeg K Strong [mailto:cstrong@arielpartners.com] Sent: Thursday, November 07, 2002 8:25 AM To: Jonagustine Lim Cc: support(a)arielpartners.com; zope-dev(a)zope.org Subject: [Zope-dev] Re: Unsecure design of ExternalFile Yikes! Scary stuff. However, here are some things to consider: a) ExternalFile advertises itself as being a developers/ content authors tool, not really for production. Of course, most folks end up using it for production, anyway... ;-) b) Once created, an ExternalFile cannot be retargetted to point to another file in the file system c) The permission to create an ExternalFile instance is different than the permission to edit one. The permission to create an ExternalFile instance should be assigned judiciously... d) the Zope server should be run as a user that has very limited permissions. e) Even if a user *does* have permission to edit an ExternalFile, they only have whatever permission the user running the Zope server has. If the Zope user (usually "webserver" or something like that) does not have permission to write to /etc/passwd, it doesn't matter if you create an ExternalFile pointing to it, you still can't write to it... However, the points you raise are valid, as they are Zope-specific, and the zope user "webserver" *would* probably have permission to do your (1) and (2) examples. What would you recommend? Perhaps there should be a predefined list of "forbidden" directories for ExternalFiles? The problem is that-- in the development scenario-- the very things you mention below might be what you legitimately *want* to do as a developer. Well, thanks for pointing this out. Let's continue the conversation a bit, perhaps a good solution will reveal itself (even if it is only some kind of warning in the documentation...) Regards, --Craeg PS I am CC-ing the zope-dev mailing list, as I think this warrants a wider audience Jonagustine Lim wrote: > Hi! > > I just noticed that it's possible to create or replace > any files in the filesystem using the ZMI with > ExternalFile installed. > > Possible exploits: > > 1. Use ExternalFile web interface to replace Zope > Data.fs > > 2. Create a .py file in /Zope/Extensions and run it by > creating an Extenal Method. > > Anyway, I hope you can fix this or put a warning up. > > Jon > _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

2 1

OFS : bas_id
by Bertrand LOCQUET 06 Nov '02

06 Nov '02

Why, in standard OFS\ObjectManager.py do you reject Object Id's with % character ? I've modified the 45th line of Python script from : bad_id=re.compile(r'[^a-zA-Z0-9-_~,.$# ]').search #TS to bad_id=re.compile(r'[^a-zA-Z0-9-_~,.$# ]%').search #TS and every thing seems all-right ;-) The advantage is that you can directly manage special character within the Id of object with url_quote and url_unquote. By example in your File Library Example, Zope will accept every file name with a little modification of CookId in OFS\Image.py Thank you for telling me if is is unsure to keep % character into Ids. Best regards Bertrand

1 0

bug in mapply.py?
by Tim Hicks 06 Nov '02

06 Nov '02

Hi all, I've been trying to track down the problem outlined here *: http://zope.nipltd.com/public/lists/zope-archive.nsf/ByKey/B9323F6D666D3D5C I got a traceback (see below), that indicates that the problem occurs when mapply.py inspects my method. I must admit to not understanding why this should only break over xmlrpc and not directly from Zope. The problem appears to be that my method is defined something like: def method(self, *args, **kw) As far as I can tell, this means that co_argcount is 1, which makes 'names' == [self,]. Passing in positional arguments to the method then fails as len(positional) > len(names). (All this is taken from around line 54 of mapply.py) Well, that seems to be why my code fails. Can anyone tell me either what I'm doing wrong or tell me I've found a bug. The latter seems pretty unlikely I would think - I'm assuming this code has been around and working for quite a while now. cheers, tim 'File "D:\\Zlave\\zope251\\lib\\python\\ZPublisher\\Publish.py", line 150, in publish_module\n response = publish(request, module_name, after_list, debug=debug)', 'File "D:\\Zlave\\zope251\\lib\\python\\Products\\Localizer\\__init__.py", line 65, in new_publish\n mapply)', 'File "D:\\Zlave\\zope251\\lib\\python\\ZPublisher\\Publish.py", line 114, in publish\n sys.exc_info()[2],', 'File "D:\\Zlave\\zope251\\lib\\python\\Zope\\__init__.py", line 159, in zpublisher_exception_hook\n f(client, REQUEST, t, v, traceback)', 'File "D:\\Zlave\\zope251\\lib\\python\\ZPublisher\\Publish.py", line 98, in publish\n request, bind=1)', 'File "D:\\Zlave\\zope251\\lib\\python\\ZPublisher\\mapply.py", line 69, in mapply\n if len(positional) > nargs: raise TypeError, \'too many arguments\' * One final unrelated point. I was only able to get this far by hacking at ZPublisher/xmlrpc.py so that def exception(self...) appended the 'server-side' traceback to the faultString that is returned to the client. This seems like a *very* useful feature. Any chance of this getting implemented?

3 5

PKI, SOAP with Zope?
by Teemu Yli-Elsilä 06 Nov '02

06 Nov '02

Dear All, We are considering Zope as a platform for product development in our company. There are a few important requirements the availability of which was not obvious to me. 1. PKI support for authenticating users using client-side certificates (obviously over a SSL connection). To be used with smart cards as well as certificate files as client-side authentication vessel (ie. no username/password prompts). 2. Related to the former, digital signing of content on the Zope server. 3. Further related: Encrypted storage for selected documents on the server (PGP/whatever). 4. SOAP support, acting as both server and client. Can anyone enlighten me as to the possibilities of having Zope support these? And, if a product is not available, what would it take to implement such support in Zope? We are currently only beginning to train our staff in Python/Zope, so any insight would be greatly appreciated. The products would likely utilize the CMF/Plone frameworks. Thanks in advance for any help, -- Teemu Yli-Elsilä Software Designer, Mawell Oy http://www.mawell.com/

1 0

Are there any known critical limitations of WinNT Workstation?
by kretschmar＠infoman.de 06 Nov '02

06 Nov '02

Hello, are there any known artifical limitations of WinNT Workstation as opposed to e.g. WinNT Server regarding the scheduling scheme of the threads? For e.g. the medusa thread receives a http request and "passes" it to the pool of ZORB threads. We have a small Zope product which remains sleeping in a loop until a file contains a matching line. We trigger the execution of this product by requesting the proper URL and also are able to monitor its doings. With WinNT Server and W2K Server Zope is still able to respond towards further http requests, even though the one ZORB worker thread is actually waiting in the loop. With WinNT Workstation we receive no errors and the medusa thread still receives requests which are queued. But there is no real progress along the ZORB threads because only one worker seems to receive timeslots and that is the one waiting and sleeping within the loop. The rest of the thread pool is "active" but seems to receive no time slots. So effectivly Zope comes to a quite a halt but will of course continue nicely, if the waiting ZORB thread is allowed to exit the loop. The queued requests are then handled as if nothing has happend. Is this a known behaviour of WinNT Workstation as opposed to e.g. WinNT Server or W2K Server? Regards, Martin

2 1