December 1999 - Zope

Zope 2.1.0 Linux binary now fixed for RH 5.x users...
by Brian Lloyd 06 Dec '99

06 Dec '99

Hi all, For those of you who have reported strange problems with the Zope 2.1.0 binary release on your Linux systems, the Zope 2.1.0 binary release for Linux has been updated. The previous one was compiled with a backward-incompatible version of glibc on an RH 6 machine, which caused a problem for some users. The updated build has been verified to work on RH 5.x systems, and should work on 6.x as well (I'd appreciate it if a 6.x user out there could make a post to the list to verify this). The re-build is available from the usual place on Zope.org: http://www.zope.org/Products/Zope/2.1.0/ Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

4 3

Zope 2.1 on NT with Apache
by Martijn Faassen 06 Dec '99

06 Dec '99

Hi there, I'm having trouble configuring Zope 2.1 to work with Apache on Windows NT. The last time I've installed a Zope on NT was with the 1.x branch, and I got the whole Apache/rewriterule business setup then. This time however it seems to have become more difficult again. I figured I should use the PCGI option (with ZServer). This because PCGI worked last time, and because I couldn't find any FastCGI precompiled module for Apache. Problem 1: * It is claimed in doc/WEBSERVER.TXT that my Zope install should've come with a Zope.cgi file. I can't find any such file, however. That file needs to be placed in the cgi-bin directly and in the Zope directory, so I need it. :) Problem 2: * Even if I did have a Zope.cgi file I fail to see how to configure Zope to use it. WEBSERVER.TXT tells me what command line options to use, but I'm running Zope as a NT service. How to pass command line options to that? Problem 3: When I put in a (modified) Zope.cgi from my Linux box just to see if it'd work, I ran into odd behavior by Zope. When I restarted the Zope service, it (or Python, at least from what I could see) would start using a lot of CPU resources for apparently nothing at all, slowing the entire machine down to a crawl. Shutting down the Zope service and removing the Zope.cgi file fixes that problem. So even if I have a Zope.cgi file, it doesn't seem to work properly. It might be that running Zope over PCGI with Apache on NT is an odd setup, and I wish I could use Linux, but I also think the WEBSERVER.TXT file is currently lacking in NT specific explanations. At least I can't figure it out at all. And is it a bug that Zope.cgi is missing from Zope 2.1's Windows install (it is there in the linux install). Did anybody have any more luck? Regards, Martijn

1 0

Z Catalog, acquiring title from container?
by Art Hampton 06 Dec '99

06 Dec '99

I've created a simple Z Class ("NewsItem") that contains two items: headline - the headline for the news item body - the body of the news item. I then created a Z Catalog item ("NewsCatalog") that allows me to search all news items. That all works great. But I'm missing one important feature. I'd like to be able to search on multiple categories. Here's a sample of the tree I'm envisioning: News | +- Category1 | | | +- NewsItem1 | NewsItem2 | NewsItem3 | +- Category2 | | | +- NewsItemA | NewsItemB | NewsItemC | . . . +- CategoryN The categories are just folders within which are contained news items. I want users to be able to select which categories they're interested in, and display the latest news items from each category. I was hoping that when I added "title" to the list of items to index/make meta-data, it would acquire the title of the folder. Apparently that didn't happen. I need that to so I can search for the latest news in the user desired categories. Is there a way to get the NewsCatalog to be aware of the acquired title for each item? Or am I stuck with creating a property for each news item which is some identifier (the title, some ID number, etc.) which I assign to the NewsItem at creation/modification time? Thanks for any input.

1 0

RE: [Zope] RedHat Secure Web Server 3.1 & Zope 2.1 & MySQL
by Michel Pelletier 06 Dec '99

06 Dec '99

> -----Original Message----- > From: CURTIS David [mailto:David.Curtis@state.or.us] > Sent: Monday, December 06, 1999 11:32 AM > To: Zope(a)zope.org > Subject: [Zope] RedHat Secure Web Server 3.1 & Zope 2.1 & MySQL > Sensitivity: Personal > > > Hi, > > My Web site got hacked. I was told that RedHat Secure Web > Server 3.1 can prevent certain types of attacks. Does Zope > run on Secure Web Server 3.1? I was running Apache and Zope > (ZAP) together before. Not knowing exactly the method of my > server's breach makes it hard to prevent further attacks but > what is best way to prevent such problems again? As far as I know, RH Secure Server is just Apache plus SSL. It isn't in any way more 'secure' than plain vanilla Apache, it can just use strong encryption on your data. If there is an apache exploit that exists but is not yet fixed (say, a buffer overflow) it probably exists in RH's Secure server also. Also, since you say you don't know the nature of the hack, it could be completely unrelated to Apache or Zope. There are gobs and gobs of online security references. Start with the XDP (http://www.linuxdoc.org/) -Michel

1 0

BUG: Conflict competing write causes loss of form input
by Li Dongfeng (RA of H. Wong) 06 Dec '99

06 Dec '99

If you create new object in a form action, and the form action takes noticable time to finish, this bug may appear if two person is submitting the form simutaneously. One of the persons may lose his form input. These steps can reproduce this bug: 1. Make a temporary folder. 2. In the temporary folder, add an external method: import time def addFile(self, name, content): time.sleep(3) # this simulate a long action if hasattr(self, name): self.manage_delObjects([name]) self.manage_addDocument(name, name, content) 3. Add a DTML method/document named test_conflict with the following HTML form: <html><body> <form method="post" enctype="multipart/form-data" action="test_conflict_action"> name : <input name="name" value="tmpf1"><br> Content: <input name="content" value="This is tmpf1"><br> <input type="hidden" name="processing_form" value="1"> <br> <input type="submit" value="ADD File"> </form> </body></html> 4. Add a DTML method test_conflict_action: <html><body> <dtml-if processing_form> <dtml-var "REQUEST.form"> <dtml-call "addFile(name, content)"> <dtml-else> <em>Warning: Input lost</em> </dtml-if> </body></html> 5. Open two browser windows and view the "test_conflict" document. In the first browser window, input name as "tmpf1", in the second browser window, input name as "tmpf2. 6. Click the two submit buttons quickly. 7. The first browser window gives expected correct result: {'processing_form': '1', 'name': 'tmpf1', 'content': 'This is tmpf1'} but the second browser window will give the warning: input lost message: The server console will give the message: ------ 1999-12-05T11:02:45 INFO(0) Z2 CONFLICT Competing writes at, /Stat/TestBed/test_conflict_action Possible cause: When the two form action run simutaneously, a write conflict will occur because Zope use a transaction system. But the loss of the form input is not expected. In addition to the loss of form input bug, any suggestion on a work around of the conflict competing write problem? Can I avoid the conflict?

2 1

Re: [Zope] RedHat Secure Web Server 3.1 & Zope 2.1 & MySQL
by Patrick Phalen 06 Dec '99

06 Dec '99

[CURTIS David, on Mon, 06 Dec 1999] """ My Web site got hacked. I was told that RedHat Secure Web Server 3.1 can prevent certain types of attacks. Does Zope run on Secure Web Server 3.1? I was running Apache and Zope (ZAP) together before. Not knowing exactly the method of my server's breach makes it hard to prevent further attacks but what is best way to prevent such problems again?""" ============ Sorry to hear about your problems. I believe that RH Secure Web Server is targeted at secure transactions for ecommerce (SSL support, Squid proxy), not the particular case of providing a server secured against crackins. Securing *nix systems is a *big* subject and certainly off topic for this list, but ... Make sure that you have a good tape backup strategy in place. I recommend O'Reilly's books: Practical Unix and Intenet Security Building Internet Firewalls However, both are now dated (as any printed and bound security book would be) -- the subject changes daily. Be aware also that these two books total 1500 pages of dense information. As a starting point check out: http://www.redhat.com/mirrors/LDP/LDP/lame/LAME/linux-admin-made-easy/c2458… http://www.redhat.com/mirrors/LDP/HOWTO/Security-HOWTO.html Make sure that you have a good tape backup strategy in place. The December Linux Journal has a basic tutorial on security. Make sure that you have a good tape backup strategy in place. Subscribe to the Redhat Watch list to get early notice of security fixes and apply them early and often. Make sure that you have a good tape backup strategy in place. Unless you have the time (DAILY!) to devote to this, consider hiring a security professional to set things up for you. Make sure that you have a good tape backup strategy in place.

1 0

ANNOUNCE: Zope in education SIG forming
by Timothy Wilson 06 Dec '99

06 Dec '99

Hi everyone, I've just finished posting a news item at zope.org about this, but I thought a mention on the list would be good too: A listserv has just been established to host discussions surrounding the use of Zope in educational institutions or for educational purposes. To subscribe, send email to 'majordomo(a)sicfa.org' with the line 'subscribe zope-edu' in the body of the message. The group is already discussing various projects and goals. If you're interested, subscrie now and get in on the early planning stages. -Tim -- Timothy Wilson | "The faster you | Check out: Henry Sibley H.S. | go, the shorter | http://slashdot.org/ W. St. Paul, MN, USA | you are." | http://linux.com/ wilson(a)visi.com | -Einstein | http://www.mn-linux.org/

1 0

GUF problems
by Pavlos Christoforou 06 Dec '99

06 Dec '99

Zopistas I have intalled the Generic User Folder on Zope-2.1.0. Upon restarting and trying to access the management screen I get an IOError: Permission denied. (full traceback included in bottom) I entered Zope directly through python and deleted the GUF product from the control panel (as well as from the filesystem) but I still get the same error. I have also undone all the relevant transactions directly from python but the error persists. IMHO installing a new product should not under *any* circumstances corrupt your db. Any ideas how to restore the ZODB back to normal? Pavlos ----traceback--- : <H2>Zope Error</H2> <P>Zope has encountered an error while publishing this resource. </P> <P><STRONG>IOError</STRONG></P> Sorry, a Zope error occurred.<p> <!-- Traceback (innermost last): File /usr/local/Zope-2.1.0-src/lib/python/ZPublisher/Publish.py, line 214, in publish_module File /usr/local/Zope-2.1.0-src/lib/python/ZPublisher/Publish.py, line 179, in publish File /usr/local/Zope-2.1.0-src/lib/python/Zope/__init__.py, line 202, in zpublisher_exception_hook (Object: ApplicationDefaultPermissions) File /usr/local/Zope-2.1.0-src/lib/python/ZPublisher/Publish.py, line 165, in publish File /usr/local/Zope-2.1.0-src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: manage) File /usr/local/Zope-2.1.0-src/lib/python/ZPublisher/Publish.py, line 102, in call_object (Object: manage) File /usr/local/Zope-2.1.0-src/lib/python/App/special_dtml.py, line 120, in __call__ (Object: manage) File /usr/local/Zope-2.1.0-src/lib/python/DocumentTemplate/DT_String.py, line 443, in __call__ (Object: manage) File /usr/local/Zope-2.1.0-src/lib/python/DocumentTemplate/DT_String.py, line 381, in cook (Object: manage) File /usr/local/Zope-2.1.0-src/lib/python/DocumentTemplate/DT_String.py, line 374, in read (Object: manage) File /usr/local/Zope-2.1.0-src/lib/python/DocumentTemplate/DT_String.py, line 538, in read_raw (Object: manage) IOError: [Errno 13] Permission denied: '/usr/local/Zope-2.1.0-src/lib/python/App/manage.dtml'

2 6

RedHat Secure Web Server 3.1 & Zope 2.1 & MySQL
by CURTIS David 06 Dec '99

06 Dec '99

Hi, My Web site got hacked. I was told that RedHat Secure Web Server 3.1 can prevent certain types of attacks. Does Zope run on Secure Web Server 3.1? I was running Apache and Zope (ZAP) together before. Not knowing exactly the method of my server's breach makes it hard to prevent further attacks but what is best way to prevent such problems again?

1 0

RE: [Zope] Urgent - server down.
by Michel Pelletier 06 Dec '99

06 Dec '99

> -----Original Message----- > From: chas [mailto:panda@skinnyhippo.com] > Sent: Monday, December 06, 1999 10:33 AM > To: zope(a)zope.org > Subject: [Zope] Urgent - server down. > > > Well, it's been a nightmare day for Zope on our box. > Does it self destruct when Data.fs reachs a certain > size or something ? There are no built-in limits on Data.fs size. Your OS may have one however. How big is the file? > It's been running fine for the past 2 months. > Then today we've been getting these error messages > almost non-stop : > > "Temporarily Unavailable > The resource you requested is temporarily unavailable - > please try again > later. > (116) unable to connect, fd=3 " PCGI cannot connect to Zope. Can you connect to ZServer? > Alternatively, the server just hangs and doesn't respond > (but ps -aux shows the process is running). Is it spinning? (consuming 100% CPU resources?) or hung? (consuming none..) -Michel

1 0