June 1999 - Zope - Zope lists

release schedule?
by Alex Rice 14 Jun '99

14 Jun '99

When is Zope 2 going to be released approximately? I've got a project that needs to be finished in 30 days and am trying to figure out whether to use Zope 1 or 2. I wouldn't think about running the alpha version, but OTO it seems very stable to me, for an alpha. Alex Rice | alrice(a)swcp.com | http://www.swcp.com/~alrice Current Location: N. Rio Grande Bioregion, Southwestern USA

2 1

ISP and Zope
by Catalin Braescu 14 Jun '99

14 Jun '99

Dear Aaron, I recomend you my brand new web hoster: Cubesoft (www.csoft.net) They are very-very permisive and you can check my words yourself. If what you see is what you need, contact julien(a)csoft.net . I moved thre weeks ago from Intercomm (www.icom.com) to Cubesoft because I need Zope... Best regards, Catalin Braescu Coltronix www.coltronix.com P.S. Tell Julien you know Cubesoft from me. I won't earn money but he will see I try to help too (he was incredibly responsive to our requests).

1 0

Various security aspects to Zope as an Internet HTTPD server ...
by Bryan J. Smith 14 Jun '99

14 Jun '99

Various security aspects to Zope as an Internet HTTPD server ... [ I am on the Digest, so please respond directly ] [ to me @ mailto:b.j.smith@ieee.org,bjs@crc.com ] I am looking at using Zope as a corporate Internet HTTPD service (i.e. as the main service people hit on the Internet). I am a Zope newbie, but have installed and used it on the port (i.e. 9673, NOT integrated with Apache). I have an idea of my basic configuration along with some security-oriented questions. Proposed configuration: ----------------------- A. Two servers, one in a DMZ behind a firewall and one on the internal corporate network, also behind the firewall (but on a different port not accessable from the outside). B. Users would ONLY UPLOAD TO THE INTERNAL network server. Then, at an X periodical, the internal server's contents would be copied to the external server. So even if the external server's HTTPD site/contents are cracked/replaced, the data will be overwritten ever X minutes with the clean/internal version (very simple to do -- something the FBI should have take note of ;-). C. Not sure if I should keep Zope on its own port (9673, with a simple redirect from Apache on port 80 (//sitename -> //sitename:9673) or integrate it with Apache (security is the issue here). D. Looking to use OpenBSD/i386 as the OS (on both systems, or at least the external server in the firewall DMZ). Questions: ---------- 1. Since Zope runs as a user-level service, does that make it any more secure than Apache? Or is it more securite to integrate it as a bunch of cgi-bin scripts under Apache? Or does anyone see even a more secure setup? 2. Available SSL support? Or is that the commercial Medusa (Zope+SSL) product from Digital creations? 3. Anyone got Zope running under OpenBSD/i386? I really am aiming for the OpenBSD avenue since they are the best when it comes to finding security holes (don't need slick console-side interfaces like with Linux/FreeBSD/NT). If it runs under FreeBSD, it should run under OpenBSD, but just wanted to see if anyone was running it under OpenBSD (or FreeBSD for that matter). Thanx in advance ... -- Bryan "The BS" Smith Software Engineer FL-based Aerospace Company and OpenSource developer/consultant P.S. As a side-note, there are those FrontPage 98 wennies out there who "just-have-to-have" the FP98 extensions on the Apache server. Does that not create a security risk? I (as well as PCWeek) have found using Amaya (the W3C standard HTML 4.0 WYSIWYG) much better and combined with Zope's built-in upload functionality (is that via the HTTP 1.1 protocol??? as well as 2.0 WebDAV support), there is NO REASON to have to support M$'s proprietary extensions on the same server as Zope. Any comments here??? I think even they are SOL on FP2000 since it REQUIRES an NT Server for publishing (no more Apache support?). Bryan J. Smith mailto:b.j.smith@ieee.org,bjs@crc.com Software Engineer http://www.SmithConcepts.com/legal.html =========================================================== "Microsoft's efforts to position Windows NT as an embedded operating system remind one of an elephant entering a track meet." -- PC Week's Peter Coffee

1 0

Authentication challenge on database query bug
by Graham Chiu 14 Jun '99

14 Jun '99

Well, this appears to be a real bug in 1.11pr1 ? 2.x. When doing a database query I would occasionally get an authentication challenge. It was always the same query. If I cancelled the challenge, I got an error message saying that I was not allowed access to RRP, which was one of the fields in my query. Now this was the same bug that Butch Landingin was getting in his SquishDot product which he solved by replacing all NULLs in the TinyTables he was using. I therefore did the same. I removed all NULLs from my RRP field, and now the challenge has disappeared. So, in short, when anonymous queries a table which returns a set containing nulls, Zope mounts an authentication challenge. ------- Regards, Graham Chiu gchiu<at>compkarori.co.nz

1 0

RE: [Zope] Explicitly avoiding acquisition, how?
by Alexander Staubo 14 Jun '99

14 Jun '99

Thanks! Just what I needed, and about time too :-) -- Alexander Staubo http://www.mop.no/~alex/ "`This must be Thursday,' said Arthur to himself, sinking low over his beer, `I never could get the hang of Thursdays.'" --Douglas Adams, _The Hitchhiker's Guide to the Galaxy_ >-----Original Message----- >From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of >Pavlos Christoforou >Sent: 14. juni 1999 22:07 >To: Alexander Staubo >Cc: Zope Mailing List (E-mail) >Subject: Re: [Zope] Explicitly avoiding acquisition, how? > > >On Mon, 14 Jun 1999, Alexander Staubo wrote: >> >> I'd like to get at an attribute or folder subobject without going >> through implicit acquisition. For example, I'd like to have a DTML >> Method that checks its parent folder if that folder and >_not_ its parent >> folders carry a specific attribute. In other words, I want >to test for >> the _existence_ of an attribute. Same for folder subobjects. > >the aq_base attribute of your object returns the 'unwrapped' object. > >so  gets the object without the acquisition >wrappers. > >Pavlos > > >_______________________________________________ >Zope maillist - Zope(a)zope.org >http://www.zope.org/mailman/listinfo/zope > >(For developer-specific issues, use the companion list, >zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

Zope Hosters Welcome Here :-)
by Hadar Pedhazur 14 Jun '99

14 Jun '99

Howdy to everyone out there in Zope land. There have been a flurry of emails recently, and a handful of posts as well, regarding commercial Zope Hosting. While I will likely send a private copy of this post to each of the people who have written to us at Digital Creations, separately, I thought that a general posting might be a good thing to do, and it won't be _too_ long, so I hope that no one will mind me hijacking the bandwidth for this "noble" cause. :-) The following block is a verbatim extract from an email I sent to a potential Zope Hosting Provider this morning. I will leave out the contact details to protect the innocent, but I hope the my response to their request to host Zope will be interesting to others who might be considering the same: *** "Well, we truly believe that the market for Zope hosters will grow significantly in the coming year, and further that there is an opportunity for hosters to more easily layer on value-added options to increase the profitability of the account. Some will be home-grown, and some will be avilable commercially or from the community. Now to the hard part. While we constantly strive to improve Zope, and to make it easier to administer in a multi-virtual domain environment, it still isn't perfect in that regard. Therefore, it takes a fair bit of technical know-how, and a willingness to sweat some tears in order to get it just right for your shop. Luckily, the envrionment that you describe above is nearly ideal for Zope, which will mitigate the above somewhat. This will definitely change in the near future (think months not years), so you could wait. The advantage of not waiting is that there are quite a number of people currently looking to find a reliable Zope Hoster. We have one very high quality hoster available now (http://www.codeit.com) They are so good at Zope hosting, that we host both http://www.zope.org and http://www.digicool.com there. We couldn't be happier with the arrangement. Still, the marketplace likes choices, and the next few hosters to truly give Zope the care and attention that it deserves will gain a fair number of new users in a realtively short period of time (my opinion only!). If there is any other info that we can provide, please don't hesitate to ask. If you do decide to host Zope, we'll help you get it right (up to a point, and then perhaps you should consider a support contract). Also, the zope mailing list is extremely knowledgable and helpful with regard to setting up Zope on all types of platforms. Then, we'll happily list you in the Zope Hosting Providers page, and help drive customers to your site!" *** So, if you're a hoster out there who is struggling with the choice as to whether to dive in and offifially offer Zope or not, I hope I've added a little confusion (I mean fuel) to help you over the hump. From my perspective, people who want to host commercial sites on Zope will want to go with "proven" hosters, and not someone who is simply willing to let them start a long running process and "see how it goes". Therefore, those that host early, will be able to build up a credible reference list and snag the people that will eventually discover the beauty and power of Zope. Dive right in, the water is fine. :-)

2 1

Re: [Zope] (116) unable to connect, fd=3
by Tim Hawes 14 Jun '99

14 Jun '99

Michel Pelletier wrote: > > I wish I knew > > more of its nature. :-/ > > > > Put just this bit of DTML into a method (lets it's called 'themethod') > somewhere in your root Zope folder. > > *Shut down Zope* > > go to 'Zopedir/lib/python' > > do this: > > [michel@aldous python]$ python > Python 1.5.1 (#2, Jan 26 1999, 10:47:10) [GCC 2.7.2.3] on linux2 > Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam > >>> import ZPublisher, Main > >>> > ZPublisher.Main('themethod?pin=blah&from=blah(a)blah.com&message=blahblah' > ) > > 'themethod' should be the name of the method containing the errant DTML > code > > 'pin', 'from', and 'message' should be sensable values that make your > code fail through the web also. > > ZPublisher.Main has the effect of calling 'themethod' just like a web > request would. Something is happening to make your pcgi connection fail > with the Zope long running process, and thus you cannot see the error > that the python process is giving you. Since pcgi is not involved in > this little test, you will see the error printed on your terminal. It > could be a syntax error, a core dump, an SMTP error that causes > something to get sent to stderr instead of raising an exception, who > knows. Sniff it out. Well, first thing this morning, I tried it out, and could not reproduce the error. In fact it successfully paged the pin number I used. Here is what I have found: If I start ZPublisher manually within python (import ZPublisher, Main) the page works, if it is started from a connection through the web (Zope.cgi) I get the (116) unable to connect, fd=3 error. Are we getting warmer? -- Tim Hawes tim.hawes(a)ncmail.net

2 3

Explicitly avoiding acquisition, how?
by Alexander Staubo 14 Jun '99

14 Jun '99

I asked this before. Jim? Got two seconds? You should know the answer to this one. I'd like to get at an attribute or folder subobject without going through implicit acquisition. For example, I'd like to have a DTML Method that checks its parent folder if that folder and _not_ its parent folders carry a specific attribute. In other words, I want to test for the _existence_ of an attribute. Same for folder subobjects. -- Alexander Staubo http://www.mop.no/~alex/ "`This must be Thursday,' said Arthur to himself, sinking low over his beer, `I never could get the hang of Thursdays.'" --Douglas Adams, _The Hitchhiker's Guide to the Galaxy_

2 1

Time fields in MSSQL/ODBC (urgent!)
by Alexander Staubo 14 Jun '99

14 Jun '99

I am using the ODBC DA to connect to Microsoft SQL Server 6.5. I've encountered this problem before and never found a solution. Doing a simple select ArticleTime from Articles where ArticleTime is my datetime column, I get: Error Type: ValueError Error Value: Invalid value, 1999-04-29 21:36:00.000, for ArticleTime in record 0 Iirc, DateTime() barfs if a time zone is omitted in the string, so "1999-04-29 21:36:00.000" would not be a valid value, whereas "1999-04-29 21:36:00.000 GMT+1" would be. Now, naturally I can do something like select convert(varchar(12), ArticleTime) + 'GMT+1' as ArticleTimeStr from Articles which will convert the column into a string value, more or less, and I can then feed the string back into DateTime using an External Method. Phew. But of course I'd like to avoid this kind of coding. Anything I can do to make Zope accept these datetime values? -- Alexander Staubo http://www.mop.no/~alex/ "`This must be Thursday,' said Arthur to himself, sinking low over his beer, `I never could get the hang of Thursdays.'" --Douglas Adams, _The Hitchhiker's Guide to the Galaxy_

1 0

using Zope2 for a newbie?
by Daniel Pfile 14 Jun '99

14 Jun '99

Hi there, I've been reading about Zope for a while now, I've had 1.1x running on my main server with rewrite, and Zope2 running on my personal system with the built in server. This afternoon I'm going to start really digging in and learning zope by building a (non important) website with it. I was wondering if it is better to go with Zope1 or Zope2. As far as upgrading goes. I'm a pretty capable unix user with several years experience at that. Before I've done alot of projects with perl and c. I've also done alot with Frontier on Mac and Windows, so the concept of an odb is not new to me. I hope to learn enough zope to dig in and develop some cool stuff. My python skills aren't the best yet, but I am getting better. So I guess my question is, with my background should I bother learning how zope1 works, or just skip to zope2? # Daniel Pfile # clarus(a)cryogen.com # http://www.marietta.edu/~pfiled/ # # Freelance Web Designer and CGI Programer # We are all worms. But I do believe I am a glowworm. -- Winston Churchill

5 5