December 2000 - Zope

RE: [Zope] One-To-One, Story Server, Teamsite, ... Zope?
by sean.upton＠uniontrib.com 18 Dec '00

18 Dec '00

I, perhaps, can answer a portion of your questions with some thoughts on news content management from someone who has worked for several medium to large daily newspaper's online presences. News portal - I am currently developing code to create an intranet editorial system, with archive and asset management capabilities that revolves around the collection of millions of objects using the News Industry Text Format XML (NITF) and IIM Guideline 3 (a subject hierarchy specification that works well for portals); both of these are international standards from the International Press Telecommunications Council (IPTC). I am currently working on a content-management front-end, as well as a search/browse/display front end using Zope/ZCatalog as a navigation means using IPTC subject codes as a means to browse by fine-grained subject. A news portal is nothing more than a query (perhaps using RSS results) to such a subject system. Zope is a perfect fit, given it caches parsed XML (using the internal DOM). XML support in Zope is constantly improving, so this looks optimistic. Plus, there are tricks in Zope that can increase your performance (like using ZCatalog for navs, and perhaps using ZCatalog's metadata tables as a cache for renderings of XML DOM traversals). I'm planning on an initial code release before years end as a product on zope.org, and I would be happy to share what I have with you now, if you are interested. >>>>> More specific answers to your questions in the line-by-line below... The three first are the most recognized brands for content management software, at least among industry journalists. For anyone previously involved with content management of a large scale site, Interwoven's, Broadvision's and Vignette's high-end suites, respectively, are probably the default chooses for web and e-business management, no questions asked. I'm reflecting this because I would like to have the big picture of what each product is able to do, without exagerations. I've never seen running any of those products, and since I must advice the company I work for about the software it will need for its news portal, in adition to what nice pdfs and catalogs can show off, I am truly interested about what Zope can do and what it can't, COMPARED to those first. >>>>> Perhaps the biggest problem with those packages is that for the most part, those companies are marketing companies, which means that they are going to spend a lot of time having sales people convincing you that they have a turnkey solutions, when there is really no such thing. I see no reason to spend a quarter-million on software after consulting and customization and not have a completely open platform (i.e. not be held hostage to one of these vendors). I don't have experience with most of these products; I have a copy of Vignette StoryServer in my desk that I haven't even opened or installed, partially because I don't have time to evaluate a piece of software that has finite limits in terms of being extended, when I am having no problems coding in Zope. Building content management systems using tools provided by Zope is powerful enough to create EXACTLY what I want, without a lot of fuss. >>>>> Is Zope stable enough working connected to large databases? How does it behave with high traffic sites? Does it support clustering? What is the largest site running it? Have anyone put their hands on any of the mentioned tools and make comparisons? >>>>> The site for my company (a top-20 daily newspaper) probably draws 12-13 million hits a day, mostly served from static pages, automated on the production side (rather than delivery). As part of a datacenter move, we are redesigning online classifieds, running on Zope; at first this will be running on a single server that is used for a variety of tasks (a Sun E450 that will be running our MySQL and Sybase database services as well as some dynamic content served from ColdFusion and Zope). If traffic increases, Zope will move onto our load-balanced web cluster/farm nodes using ZEO. I haven't deployed these things, but I can safely say that I am confident that scalability is less of a domain of your platform, and more of an issue with app design and hardware you have. Bottom line, invest in cool hardware and good people, and you are set. If you can save $100k by going with Zope over a proprietary CMS solution, you can devote that money toward staff training and retention, as well as load-balanced HA hardware configs. A thought on scalability: these days, it is really cheap to add extra 1U servers (look at the Linux hardware companies like VA, Penguin, etc, not at wasted money on Sun Netras and the like), and load-balancers are either cheap or free, if you have the time (if you don't put down 10-25k in a pair of hardware-based load-balancing appliances). Note: Zope uses transactions and these are transparently extended (hooked) into the transaction machinery of your RDBMS. This is good for a lot of reasons; a lot of folks have had good luck using Oracle with Zope. A thought on choosing solutions: choose a platform that will fit your use cases well, and one that gives you control over your destiny. I worked for a software vendor previously that depended on content systems from Folio/Nextpage for a core component of their software suite. The folio LivePublish system is a search engine and repository with an SDK that allows some levels of customization, but that is only finite. Being dependant upon that company hurt the OEM/partner software vendor in a business sense (they were sold to Lexis-Nexis, then to Open Market, then back to investors in Utah, who renamed the company, which means agendas of the vendor were constantly changing); they changed their business model to collecting royalties depending upon site traffic and sales, which screwed their OEMs that previously were exempt from that status - renting software sucks! Every proprietary solution will go down a similar sort of road, it is a question of when; with Zope, at least everything is open, there are multiple vendors to choose from, and nobody has a hidden agenda to sell you software products like SDKs that you may or may not need. Also, in open-source solutions, you tailor the platform to meet your use cases; you can then worry about scalability as a secondary concern, because there is much room to make things faster if you are clever in systems design. In truth, the biggest bottlenecks to scalability are not going to be web applications or hardware that they run on, rather proxy servers (especially non-caching) and load-balancers without out-of-path return (Cisco and Intel load-balancers have this), as well as your database and RAID/storage backend (primarily due to latency). This does necessitate spending more, perhaps, on system administration staff (more machines = more people to admin), but that is probably an inevitability regardless of the platform you choose. >>>>> Although it sounds silly, I need reasons to convince someone else that saving money is for good. That none of those super-coded-worth-a-third-million solutions is much better that a genuine GNU initiative, meaning Zope in this particular case. >>>>> While Zope isn't GNU software (open source != GNU, necessarily), it does have the advantage of being open, not holding you hostage, and exhibiting the best-of-breed in terms of development processes. Countless companies throw millions of dollars at product vendors only to find out what they needed was so much customization that they should have rolled their own solution; or they throw those millions into capital expenditures budgets without concern for their human resources budget; either way, there is problems. An open source solution will save you money, and allow you to concentrate spending that money what it is really needed: guaranteeing the success of the project by keeping people. >>>>> And, by the way, when are we going to see the first large ASP (meaning NASDAQ registered) with support for Zope? >>>>> I don't think ASPs should be a factor in deciding platforms. The upside is this: anything you design in Zope can be extended to other folks using XML-RPC, and Zope can be an XML-RPC client, enabling you to use and create services for partner sites, customers, and vendors. With that said, I think Zope is the most appropriate for the problem domain of news content from my standpoint in the news industry (I've developed software working for 2 newspapers and was director of development at a News/Photo archive/repurposing vendor). And with all news content (AP, Reuters, AFP, newspapers) moving to using NITF XML and the IPTC subject guidelines, it's time to start thinking about how easy it is to create portal and asset/content management solutions using (Zope && ZCatalog && the IPTC subject system). I have a hunch that XML and Object Databases are a natural fit (especially in light of creating customized indexes using methods to render text, field, and keyword indexes), which relegates relational databases to the back-burner in XML solutions. Zope is especially a good fit if you want to publish to multiple media (print, wireless, html, palm, PDF, etc). Zope is the best solution I have seen for such a solution - and I've been looking for years. There is more of a picture of what I am thinking at: http://www.zope.org/Members/seanupton/newsportal.pdf Good luck, Sean ========================= Sean Upton Senior Programmer/Analyst SignOnSanDiego.com The San Diego Union-Tribune 619.718.5241 sean.upton(a)uniontrib.com =========================

1 0

ANNOUNCE: Zope security alert and hotfix release
by Brian Lloyd 18 Dec '00

18 Dec '00

Hi all - <Tis the season for hot - fix - es, fa la la la la, waa waa waa waa...> Peter Kelly has brought another potential security issue to our attention that is important enough to make a Hotfix available for those who allow untrusted users to edit DTML on their sites. The issue involves incorrect protection of a data updating method on Image and File objects. Because the method was not correctly protected, it was possible for users with DTML editing priveleges to update the raw data of a File or Image object via DTML though they did not have editing priveleges on the objects themselves. We recommend that any Zope site running versions of Zope up to and including 2.2.4 have this hotfix product installed to mitigate the issue if the site is accessible by untrusted users who have DTML editing privileges. http://www.zope.org/Products/Zope/Hotfix_2000-12-18/README.txt http://www.zope.org/Products/Zope/Hotfix_2000-12-18/Hotfix_2000-12-18.tgz The hotfix will work for all versions of Zope 2.1.x and higher. A Zope 2.2.5 release later this week will contain the fix for this issue (as well as all hot fixes to date) and you will be able to uninstall the hot fix after upgrading. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

PTK
by Nuno Goncalves 18 Dec '00

18 Dec '00

Hi there ! I'm trying to use ptk to build a portal in zope ! Does anyone knows how to add a design scheme ? initialy it shows onle the generic Portal interface. I wonder if it is possible to build my own design scheme and how to add one ! thanks in advance, Best regards, Nuno ______________________________________________________________________ Nuno Gonçalves nuno(a)fccn.pt Fundação para a Computação Cientifíca Nacional http://www.fccn.pt TEL: +351-218440127 ______________________________________________________________________

1 0

AW: [Zope] error by adding Poll
by Kaeidinejad, Shahram 18 Dec '00

18 Dec '00

Hi Bill, i changed into itemAdd.dtml from <form action="manage_addSamplePollItem" method="POST"> to <form action="manage_addItem" method="POST"> but i get the same error like this: Cannot locate object at: http://192.168.190.238:23456/Test_Folder/manage_addProduct/Poll/manage_addIt em how can i use Hotfix_2000-12-8? i untared it into Products directory and restart zope. how can i have to do it correct? bye Shahram -----Ursprüngliche Nachricht----- Von: Bill Welch [mailto:bill@carbonecho.com] Gesendet: Freitag, 15. Dezember 2000 16:36 An: zope(a)zope.org Betreff: Re: [Zope] error by adding Poll Manage_addSamplePollItem is a 'legacy' mapped to addItem (see Poll/__init__.py) and Hotfix_2000-12-8 shuts down the legacy mechanism. I went into itemAdd.dtml changed it to use addItem directly. Bill. On Fri, 15 Dec 2000, Kaeidinejad, Shahram wrote: > Hi > i install Poll-0.7.1 and try to add it. > but i get an erro like this: > > Cannot locate object at: > > http://192.168.190.238:23456/Test_Folder/manage_addProduct/Poll/manage_addSa > mplePollItem > .... > > Traceback (innermost last): File > /dgn-devel01/opt/Zope-2.2.4/lib/python/ZPublisher/Publish.py, line 222, in > publish_module File > /dgn-devel01/opt/Zope-2.2.4/lib/python/ZPublisher/Publish.py, line 187, in > publish File /dgn-devel01/opt/Zope-2.2.4/lib/python/Zope/__init__.py, line > 221, in zpublisher_exception_hook File > /dgn-devel01/opt/Zope-2.2.4/lib/python/ZPublisher/Publish.py, line 162, in > publish File > /dgn-devel01/opt/Zope-2.2.4/lib/python/ZPublisher/BaseRequest.py, line 366, > in traverse File > /dgn-devel01/opt/Zope-2.2.4/lib/python/ZPublisher/HTTPResponse.py, line 539, > in debugError NotFound: (see above) > > what do i false? > > bye > > shahram > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 2

RE: [Zope] new 2.2.4 security/role bug ?? (ZCatalog related ??)
by Didier Georgieff 18 Dec '00

18 Dec '00

Brian, Le 18 Dec 2000, à 11:54, Brian Lloyd a écrit : > Note that 'Manager' does not automatically give you "full > authorization". It is only a convention that Manager often > has all permissions. > This is important, because in Zope 2.2, you can't give a > proxy role unless you have *that role* yourself. OK. So if i understand well, i need to create a user with manager AND ALL the roles so i'll be able to set any proxy role with that user. Thanks for the explanation. So i guess my other weird problem with not accessing objects via the catalog and accessing them directly has something to do with some new security feature in 2.2 i didn't understood ? But i can't figure wich one, even in re-reading carefully the zope book. Anyway, thanks for your clear explanation. Regards. -- Didier Georgieff DDAF du Bas-Rhin - Cellule SIG 2, rue des Mineurs 67070 Strasbourg Cedex tél : 03.88.25.20.33 - fax : 03.88.25.20.01 email : didier.georgieff(a)agriculture.gouv.fr SIT du Bas-Rhin : http://www.bas-rhin.sit.gouv.fr GéoWeb http://sertit10.u-strasbg.fr

1 0

new 2.2.4 security/role bug ?? (ZCatalog related ??)
by Didier Georgieff 18 Dec '00

18 Dec '00

Hello, I'm experimenting some really weird and annoying things since i upgraded to 2.2.4 with 12-08 and even with 12-15a hotfix (seems to be ok in 2.2.2) For all objects, I can access directly (URL) with no problem (according to the roles and the local roles. This is ok). For some of those objects (seems to be all the one i've added in 2.2.4 in folders with local roles) I can't (exeption raise) access the objects while in the context of the catalog (those objects are Catalog Aware via Yihaw product). I epurate the method until this minimal test method who still raise the exeption <dtml-in Catalog> <dtml-with "Catalog.getobject(data_record_id_)"> <a href="&dtml-absolute_url;"><dtml-var title_or_id></a><br> </dtml-with> </dtml-in> I have a workaround with a <dtml-try> but i miss all the objects, while they are fully reachable directly via their URL The problems seems to be on objects with local roles (anonymous has no view, no access content and other roles have this autorisations via local roles). The second weird thing (should help for a diagnostic) is : While i have "manager" role (i can do whatever i want on the manage interface), i tried to give a proxy role to my test method, to see if i could investigate further. And trying to change the proxy role raised an execption, despite the fact i have manager role with full autorisations. This last thing makes me think is an acquisition/role/security bug. Any idea/solution because we offcially open tomorrow morning, and i'm in a deep.... well embarassed ;-)) =======> This is the FIRST traceback. Zope Error Zope has encountered an error while publishing this resource. Unauthorized You are not authorized to access title_or_id. Traceback (innermost last): File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/OFS/DTMLMethod.py, line 172, in __call__ (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/DocumentTemplate/DT_In.py, line 611, in renderwb (Object: Catalog(bobobase_modification_time=ZopeTime()-14, bobobase_modification_time_usage='range:min', sort_on='bobobase_modification_time', sort_order='reverse')) File /home/georgieff/Zope-2.2.2- src/lib/python/DocumentTemplate/DT_With.py, line 146, in render (Object: Catalog.getobject(data_record_id_)) File /home/georgieff/Zope-2.2.2- src/lib/python/OFS/DTMLMethod.py, line 194, in validate (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/AccessControl/SecurityManager.py, line 139, in validate File /home/georgieff/Zope-2.2.2- src/lib/python/AccessControl/ZopeSecurityPolicy.py, line 209, in validate Unauthorized: (see above) =======> This is the SECOND traceback. Zope Error Zope has encountered an error while publishing this resource. Forbidden You are not authorized to change test_latest because you do not have proxy roles. Traceback (innermost last): File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/georgieff/Zope-2.2.2-src/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: test_latest) File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: manage_proxy) File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: manage_proxy) File /home/georgieff/Zope-2.2.2-src/lib/python/OFS/DTMLMethod.py, line 278, in manage_proxy (Object: test_latest) File /home/georgieff/Zope-2.2.2-src/lib/python/OFS/DTMLMethod.py, line 271, in _validateProxy (Object: test_latest) Forbidden: (see above) -- Didier Georgieff DDAF du Bas-Rhin - Cellule SIG 2, rue des Mineurs 67070 Strasbourg Cedex tél : 03.88.25.20.33 - fax : 03.88.25.20.01 email : didier.georgieff(a)agriculture.gouv.fr SIT du Bas-Rhin : http://www.bas-rhin.sit.gouv.fr GéoWeb http://sertit10.u-strasbg.fr

2 1

Python Method and builtin-functions
by Sven Hohage 18 Dec '00

18 Dec '00

Hello, I'd like to use Python - Methods but I'm afraid that some builtin-functions are not implemented like type() or list(). Is this a problem of me or are my nightmares fulfilled. Another question is if the Python-Method-product is the same thing as the one shipping with Zope 2.3? Thanks.

2 1

ANNOUNCE: Zope security alert and hotfix release
by Brian Lloyd 18 Dec '00

18 Dec '00

Hi all - A security issue has recently come to our attention (thanks to Erik Enge for identifying this) that affects Zope versions up to and including Zope 2.2.4. The issue involves the computation of local roles. In some situations the computation was not climbing the correct hierarchy of folders, sometimes granting local roles inappropriately. This could allow users with privileges in one folder to gain the same privileges in another folder. We *highly* recommend that any Zope site running versions of Zope up to and including 2.2.4 have this hotfix product installed to mitigate the issue. - http://www.zope.org/Products/Zope/Hotfix_2000-12-15/README.txt - http://www.zope.org/Products/Zope/Hotfix_2000-12-15/Hotfix_2000-12-15.tgz The hotfix will work for all versions of Zope 2.2.0 and higher. A future version of Zope will contain the fix for this issue, and you will be able to uninstall the hot fix after upgrading. Note that we will be making a Zope 2.2.5 release early next week that includes the fix for this issue as well as the issue addressed by the recent 12/08 hotfix. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

2 3

Stupid File Upload Question
by jpenny＠universal-fasteners.com 18 Dec '00

18 Dec '00

This is for Jos: I ran into the same problem today. I had previously used this method, and it works better than LocalFS for my purposes. Anyway, be absolutly sure that your form says: <form method=post action=whatever method="multipart/form-data"> ... </form> Then you should be able to access REQUEST.form['attachment'].filename and REQUEST.form['attachment'].read() (Well, I hope). If the method=post is omitted, Netscape (linux at least) will work. MSIE will not. Man I ain't got enough hair for these kinds of problems! Jim Penny

3 3

PopyDA and DBMS Transactions
by Paolo Quaglia 18 Dec '00

18 Dec '00

Hi I heve finally installed the PopyDA0.7 that is a Multithreaded DA (multiple concurrent access on the DBMS) Now I'm doing tests to verify the DBMS transactions (Postgress support DB transations): But something doesn't work as expected: I summarize my tests: I have two DTML Documents: first DTML: now called D1 <dtml-var header> ...1st sql statement: select * from customers where name='white' ...time.sleep(10) #external function that invokea the sleep function (10 sec) ...2dn sql statement: update customer set descr='Updated 1' where customer='white' <dtml-var footer> Second DTML: now called D2 <dtml-var header> ...sql statement: update customer set descr='Updated 2' where customer='white' <dtml-var footer> with two browser I called: D1 and then D2 My expected Behaviour was: -With the first statement of D1, Postgres would locks the table The update of D2 has to wait to write because the table is locked only when D1 has finished, D2 commit As result the updated field has to result "Update 2" and not 'Update 1" With the option Auto-commit mode ON the Behaviour was: -D2 autocommit without waiting the end of D1! (as espected with autocomm. off) As result the updated field has to result "Update 1" (because D1 ended after D1) With the option Auto-commit mode OFF the Behaviour was: -D2 autocommit without waiting the end of D1!!!!!!!!!! Why??????!?!??!? -When D1 finished an error occurs: Error Type: ProgrammingError Error Value: ERROR: Can't serialize access due to concurrent update As result the updated field has to result "Update 2" FAULT!! HOW CAN I HAVE TO DO in order to build a concurrent transaction Application with Popy and Postgress??? Thank you Very Much for your Help! Paolo Quaglia Information Technology Coordinator Sitek S.p.A. paolo(a)sitek.it

2 1