September 1999 - Zope

XML-RPC, self and security
by Eric Kidd 01 Sep '99

01 Sep '99

I discovered a potential problem with ZPublisher, External Methods and Zope XML-RPC. Let's say you write an external method in Python, and you want to call it via XML-RPC. To make life more interesting, pretend you need access to 'self'. If you call an external method from ZPublisher (instead of calling it from DTML), you can't specify 'self' as your first parameter. Instead, you must specify it as your last parameter. Unfortunately, the user can pass a bogus 'self' parameter to your Python method, and possibly subvert any security checks you've provided (many such checks rely on 'self' in some fashion). Short Term Workaround --------------------- Access an attribute on self. Since no XML-RPC data types seem to support attributes, this should provide a small measure of security. def deliverNews(foo, self): # CAREFUL - Zope is sloppy about passing 'self' to external methods. # ZPublisher will only pass you a self argument if you leave an extra # parameter at the end of your parameter list and call it 'self'. # Unfortunately, a sneaky user could pass one extra parameter when # calling this function and give us a bogus value of self. To prevent # problems, we must double-check that self isn't some sort of XML-RPC # object. We can do that by accessing an attribute. REQUEST = self.REQUEST return foo Possible Fix? ------------- ZPublisher should probably work more like DTML rendering. In particular, it should check for a first parameter named 'self' and pass an appropriate object. Would this break something else in a complicated fashion? Cheers, Eric

2 1

ZODB size?
by Steen Suder 01 Sep '99

01 Sep '99

Hi, Running Zope 2, how big can the ZODB be before it'll take any serious security/performance/stability hit (if any)? I'm aware that absolute measurement depends on SW/HW config. I'm interested in limitations implicit in the software. (Perhaps not important, but platform is RedHat Linux 6.0. HW is PII-400, 256MB RAM, RAID storage.) -- Best regards / Mvh., Steen Suder Linux Systems Administrator Use "sfs @T sciatl DOD dk" for email or remove TOC from email address

1 0

Slow FTP from ZServer...
by Steen Suder 01 Sep '99

01 Sep '99

Hi, I ran into a little "thing" yesterday while trying out the ftp feature of ZServer (it's ZServer, right?). I've placed a 3MB binary in ZODB. I went to another machine in the same room to download the file. Doing this, I got a rate of somewhere between 20 and 40kB/s. Is this normal? I usually gets like 5MB/s or more during regular ftp or NFS between the two machines, due to a 100FX switched network and PII- 400's with U2W-SCSI. -- Best regards / Mvh., Steen Suder Linux Systems Administrator Use "sfs @T sciatl DOD dk" for email or remove TOC from email address

1 0

FYI: Business talk at NYC Internet Society
by Paul Everitt 01 Sep '99

01 Sep '99

Howdy all. Hadar and I will be giving a talk on Sept 13th at the New York Internet society. I put a News Item up at the new site: http://www.zope.org:18200/ You can go directly to the news item: http://www.zope.org:18200/Members/paul/News/ISOCNY Also (though details are sketchy) we'll be doing some stuff at Software Development East in Washington D.C. --Paul Paul Everitt Digital Creations paul(a)digicool.com 540.371.6909 ----------------------------------------- The Open Source Zope application server http://www.zope.org/

1 0

RE: [Zope] Zope Newbie Needs Install Help
by Michel Pelletier 01 Sep '99

01 Sep '99

> -----Original Message----- > From: John Turner [mailto:jturner@johnturner.com] > Sent: Wednesday, September 01, 1999 9:10 AM > To: Martijn Pieters > Cc: zope(a)zope.org > Subject: Re: [Zope] Zope Newbie Needs Install Help > > > - I've tried Zope with Apache on linux, but had problems with the > mod_rewrite changes (the more complex apache config issues > are not my best > point). So I tried the ZServer on linux...nothing on port 8080. > Nothing is a surprising result. No traceback? Nothing in the log? When you run (in the top level Zope dir): python1.5.2 z2.py -D It will either start up and tell you right away or it will raise and error and print a traceback, which we would like to see. -Michel

1 0

Re: [Zope] generating static files in the filesystem
by Heiko Stoermer 01 Sep '99

01 Sep '99

> > Hello, > > Sorry to jump off of your question with a question of my own, but... I'm > just setting up a Flash navigation frame for my site. Have you noticed a > problem with Flash under IE5 (may be earlier versions as well) where a > GetURL flash command will retrieve the desired page from cache, even if the > page has changed? I don't see the same behavior under Netscape. And if I put > a standard HTML link in the nav frame, that works fine under IE. This has > been bugging me, so I was curious if you had seen it too... > > Kevin I'm really sorry, but I can' t help you in this case, as all the flash stuff is being done by our flash designers... I'm the developer for background things. Heiko -- Heiko Stoermer MIG Augsburg

1 0

Re: [Zope] Zope Newbie Needs Install Help
by Heiko Stoermer 01 Sep '99

01 Sep '99

John, smile for a while... :) I don't want to frustrate you, but installing it was the slightest problem... One thing that might be important for you: Zope _requires_ python ver. 1.5.2. AFAIK it will not work with any other version. so if you have python preinstalled on your machines, you're likely to run into problems because 1.5.2 is not the latest python release! On my Debian/Linux, I just grabbed the latest binary beta release for Linux (Beta6), and installed it according to the README. It was absolutely no problem. You might want to check your python interpreter and then report to the list if this was the problem. and next time: ask the list members earlier ;) I found all of these people to be extremely nice, they helped me an awful lot. Heiko. John Turner wrote: > Hello, All - > > My apologies if this is a sore subject with list members. > > Zope has been generating a lot of buzz, so I decided to check it out. I > have been through the bugs list, the online docs, the docs distributed > with Zope, and have searched this list, to no avail. Joining the list is > my last resort. > > Basically, after two weeks of trying, I have yet to get Zope to work. I > have tried it on the following: > > - redhat 6, compiled from source, on a system with a working > Apache/PHP/MySQL configuration > > - WinNT4 using the Zope Win32 binary release > > - Win98 using the Zope Win32 binary release > > - linux MIPS (Cobalt RaQ2 server) compiled from source, also with a > working Apache/PHP/MySQL configuration > > Nothing has worked so far. It is very frustrating. The docs do not > coincide with the actual software (port numbers are wrong, installation > steps that are listed in the docs don't happen when you install the > software, etc). > > It certainly hasn't been fun. From the traffic on this list, it looks > like Zope is actually something that works, but so far, I have yet to see > it. I'm still eager to try it, but my eagerness is fading fast! <grin> > I'm an accomplished webmaster with experience on many platforms, and I've > found my experiences so far with Zope to be extremely discouraging. > > Are there any other docs that are better than those found at zope.org and > distributed with the code? Is there an installation/troubleshooting FAQ > other than the one at zope.org? > > I've tried Zope as PCGI with an existing webserver, and also with the > built-in HTTPServer. Starting up Zope with it's own server on Win32 gets > nothing on either port 8080 or port 9763. The start.bat file is using the > wrong python executable (python was already installed on the system). The > problems go on and on, I will not bore you with them. > > Any and all help/suggestions would be greatly appreciated. I realize my > problems and issues may be trivial to most of you, judging by the > qualities of the posts on this list that I've seen so far. > > Thanks in advance for any help you can provide to this Zope newbie. > > - John Turner > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (To receive general Zope announcements, see: > http://www.zope.org/mailman/listinfo/zope-announce > > For developer-specific issues, zope-dev(a)zope.org - > http://www.zope.org/mailman/listinfo/zope-dev ) -- Heiko Stoermer MIG Augsburg

2 2

Re: [Zope] generating static files in the filesystem
by Anthony Baxter 01 Sep '99

01 Sep '99

standard response to this: Use a web client like wget or curl (or the mirror script in the Python distribution's Tools directory) to mirror the content out of the Zope site. Anthony >>> Heiko Stoermer wrote > Hi Zopists, > > I'm currently working on an authoring system for my company to prove > them how cool zope is... > In short: they want an application to enter data with which > html-documents will be generated. > the problem is that they want static html files on their harddisk to > serve them with apache, or their netscape server (don't ask...). > > So: does anyone have a brilliant idea on how to get DTML-Documents (with > their data stored in properties) out of Zope as a complete file? > (to make it worse: including the embedded images...) > > One approach I thought of was to write a HTTPClient that sucks the pages > out of zope via the web, but actually I don't find this to be a very > elegant solution. > > Thanks for thinking about it > :) > > Heiko > > -- > Heiko Stoermer > MIG Augsburg > > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (To receive general Zope announcements, see: > http://www.zope.org/mailman/listinfo/zope-announce > > For developer-specific issues, zope-dev(a)zope.org - > http://www.zope.org/mailman/listinfo/zope-dev ) -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

Zope Newbie Needs Install Help
by John Turner 01 Sep '99

01 Sep '99

Hello, All - My apologies if this is a sore subject with list members. Zope has been generating a lot of buzz, so I decided to check it out. I have been through the bugs list, the online docs, the docs distributed with Zope, and have searched this list, to no avail. Joining the list is my last resort. Basically, after two weeks of trying, I have yet to get Zope to work. I have tried it on the following: - redhat 6, compiled from source, on a system with a working Apache/PHP/MySQL configuration - WinNT4 using the Zope Win32 binary release - Win98 using the Zope Win32 binary release - linux MIPS (Cobalt RaQ2 server) compiled from source, also with a working Apache/PHP/MySQL configuration Nothing has worked so far. It is very frustrating. The docs do not coincide with the actual software (port numbers are wrong, installation steps that are listed in the docs don't happen when you install the software, etc). It certainly hasn't been fun. From the traffic on this list, it looks like Zope is actually something that works, but so far, I have yet to see it. I'm still eager to try it, but my eagerness is fading fast! <grin> I'm an accomplished webmaster with experience on many platforms, and I've found my experiences so far with Zope to be extremely discouraging. Are there any other docs that are better than those found at zope.org and distributed with the code? Is there an installation/troubleshooting FAQ other than the one at zope.org? I've tried Zope as PCGI with an existing webserver, and also with the built-in HTTPServer. Starting up Zope with it's own server on Win32 gets nothing on either port 8080 or port 9763. The start.bat file is using the wrong python executable (python was already installed on the system). The problems go on and on, I will not bore you with them. Any and all help/suggestions would be greatly appreciated. I realize my problems and issues may be trivial to most of you, judging by the qualities of the posts on this list that I've seen so far. Thanks in advance for any help you can provide to this Zope newbie. - John Turner

3 4

AW: [Zope] Zope Newbie Needs Install Help
by Schmidt, Jens-Uwe 01 Sep '99

01 Sep '99

Hi John, I got Zope (1.X and 2.X) up and running with the "all inclusive" package for Linux (with python included). Give it a last try with this tarball and enjoy it -- you'll be infected by the Zope Virus pretty soon. I never tried compiling it from source (here, the problem seems to be quite often a python_compiled_without_threads) and never tried it on a M$ platform. Don't get disappointed by the comments on the list, another one for Zope-Newbies would be a great idea (I would switch immediately). Bye Jens Jens-Uwe Schmidt * j.schmidt(a)first-fm.de Mail und Internet Administration FIRST-Reisebüro Management GmbH * Lister Straße 11 30163 Hannover * Tel 0511/9658-357 * Fax..-303 > Von: John Turner [SMTP:jturner@johnturner.com] > Gesendet am: Mittwoch, 1. September 1999 14:12 > An: zope(a)zope.org > Betreff: [Zope] Zope Newbie Needs Install Help > > > Hello, All - > > My apologies if this is a sore subject with list members. > > Zope has been generating a lot of buzz, so I decided to check it out. > I > have been through the bugs list, the online docs, the docs distributed > > with Zope, and have searched this list, to no avail. Joining the list > is > my last resort. > > Basically, after two weeks of trying, I have yet to get Zope to work. > I > have tried it on the following: > > - redhat 6, compiled from source, on a system with a working > Apache/PHP/MySQL configuration > > - WinNT4 using the Zope Win32 binary release > > - Win98 using the Zope Win32 binary release > > - linux MIPS (Cobalt RaQ2 server) compiled from source, also with a > working Apache/PHP/MySQL configuration > > Nothing has worked so far. It is very frustrating. The docs do not > coincide with the actual software (port numbers are wrong, > installation > steps that are listed in the docs don't happen when you install the > software, etc). > > It certainly hasn't been fun. From the traffic on this list, it looks > like Zope is actually something that works, but so far, I have yet to > see > it. I'm still eager to try it, but my eagerness is fading fast! > <grin> > I'm an accomplished webmaster with experience on many platforms, and > I've > found my experiences so far with Zope to be extremely discouraging. > > Are there any other docs that are better than those found at zope.org > and > distributed with the code? Is there an installation/troubleshooting > FAQ > other than the one at zope.org? > > I've tried Zope as PCGI with an existing webserver, and also with the > built-in HTTPServer. Starting up Zope with it's own server on Win32 > gets > nothing on either port 8080 or port 9763. The start.bat file is using > the > wrong python executable (python was already installed on the system). > The > problems go on and on, I will not bore you with them. > > Any and all help/suggestions would be greatly appreciated. I realize > my > problems and issues may be trivial to most of you, judging by the > qualities of the posts on this list that I've seen so far. > > Thanks in advance for any help you can provide to this Zope newbie. > > - John Turner > >

1 0