December 2000 - Zope

Re: [Zope] SECURITY alert and hotfix release
by Andrew Kuchling 09 Dec '00

09 Dec '00

On Fri, Dec 08, 2000 at 05:40:13PM -0500, Shane Hathaway wrote: > AFAICT 2.1.6 is not vulnerable. Verifying this on our server, this turns out to be quite correct; Zope 2.1.6 does not demonstrate the problem repaired by the hotfix. --amk

1 0

newbie question -- database list/report with sort by column header
by John Cappelletti 09 Dec '00

09 Dec '00

I am listing the results of a database query using dtml-in. I'd like to be able to give the user the option to re-sort the list by clicking on a column header. ok... I'm starting small with a form and radio buttons to allow the user to specify the sort. I've created what I believe to be a global variable for this page using the property screen. The variable is to capture the column name for the sort. My simple question is how do I assign a value to this variable inside of the dtml method! I'm not finding a description of variable assignment in the documentation (yeah, I must be missing the obvious). Any pointers would be appreciated. (also, know if anyone has implemented interactive sort by column header?) thanks, John Cappelletti AverStar, Inc. 1593 Spring Hill Road, Suite 700 Vienna, VA 22182-2249 Tel: (703) 827-2606 x 4291 (also, 301 443-7509) Fax: (703) 827-5560

4 3

StructuredText with Metapublisher content
by olpa＠sybcom.de 09 Dec '00

09 Dec '00

Hi, when I render a DTML-Method abc containing structured text content with <dtml-var abc fmt=structured-text>, the output is correctly rendered. when I render the content of a MetaPublisher entry with <dtml-var "mp_entries..." fmt=structured-text>, then the output is not correctly rendered. Only constructs like **bold** are recognized. No tables or lists or paragraphs. Did anyone experience this with a solution ? Regards, oliver --- ..you could spend *all day* customizing the title bar. Believe me. I speak from experience." (By Matt Welsh) --- Oliver Pabst .-------------------------. mailto:olpa@sybcom.de : : phone :+49 681 56600600 : project department : SYBCOM GmbH fax :+49 681 56600660 : : http://www.sybcom.de

1 0

Re: [Zope] persistence and dictionaries
by Matt 09 Dec '00

09 Dec '00

Ok, here are some of the offending bits out of my boringplus product .... which I can send again if people want. I have another product that keeps a dictionary of cookies so I can see how many times someone uses the back button to access the same forms page again. This worked as expected, where I had to issue an _p_changed=1 to get them to persist. But I am doing a similar thing below, or so I thought, once with a dictionary in the product and once in a dictionary within a class that does not inherit Persistent. This is what is confusing. Through restarts etc, everything perisists class Boring( OFS.SimpleItem.Item, # A simple Principia object. Not Folderish. Persistent, # Make us persistent. Yaah! Acquisition.Implicit, # Uh, whatever. AccessControl.Role.RoleManager # Security manager. ): def __init__(self, id, title=''): self._things = {} self._more = myClass.MoreStuff() def manage_edit(self, title, REQUEST=None): if REQUEST is not None: if REQUEST.has_key('thing'): self._things[REQUEST['thing']] = REQUEST['thing_value'] self.addToMore(REQUEST['thing'],REQUEST['thing_value']) def addToMore(self,name,value): self._more.addStuff(name,value) return "" class MoreStuff: def __init__(self): self._stuff = {'animal':'monkey'} def addStuff(self,stuff_name,stuff_item): On Sat, 09 Dec 2000, Jonothan Farr wrote: > Maybe I'm mistaken, but it seems like you can put an instance of an object that > doesn't inherit from Persistent into the ZODB just fine, but its contents won't > persist, so you'll always end up with a copy of the object as it was first added > to the database. > > --jfarr > > ----- Original Message ----- > From: "Chris McDonough" <chrism(a)digicool.com> > To: <matt.bion(a)eudoramail.com> > Cc: <zope(a)zope.org> > Sent: Friday, December 08, 2000 11:57 AM > Subject: Re: [Zope] persistence and dictionaries > > > > Huh. If they do, it's by chance only. I'd be hard-pressed to explain it. > > > > Do they inherit from *anything*? > > > > ----- Original Message ----- > > From: "Matt" <matt.bion(a)eudoramail.com> > > To: "Chris McDonough" <chrism(a)digicool.com> > > Cc: <zope(a)zope.org> > > Sent: Friday, December 08, 2000 2:30 PM > > Subject: Re: [Zope] persistence and dictionaries > > > > > > > Chris, this was my original confusion .... the two places below where you > > say > > > > > > "You can put instances which do not inherit from Persistence.Persistent in > > > your database. They just won't "stick". They'll hang around until the > > > server is restarted or for an undetermined amount of time during normal > > > operations." > > > > > > "No. It'll work for "a while" or until the server is restarted. :-)" > > > > > > actually do persist after restarts ... that's what confused me, they > > wouldn't > > > go away and they should!! > > > > > > regards > > > Matt > > > > > > Chris McDonough wrote: > > > > > > > > Thanks for the reply, that is really useful. There are a couple of > > things > > > > > though that still don't add up. Firstly, you say below, as do all the > > > > ZODB > > > > > documents that "Custom" classes can certainly persist, they just need > > to > > > > mix in > > > > > the "Persistence.Persistent" class as a base class. Well, in my > > example I > > > > > attached in my first email, my product certainly has > > > > Persistence.Persistent, > > > > > but my second class that I add to this one does not, yet it still > > > > persists. > > > > > There was an email sometime ago on the mailing list that told someone > > that > > > > this > > > > > was why their product instances disappearing from the ZODB. > > > > > (the ref for the original email is : > > > > http://www.egroups.com/message/zope/44263 > > > > > ... I can't find the reply again.) > > > > > > > > > > > > > You can put instances which do not inherit from Persistence.Persistent > > in > > > > your database. They just won't "stick". They'll hang around until the > > > > server is restarted or for an undetermined amount of time during normal > > > > operations. > > > > > > > > > So my current understanding would be that any classes you want to add > > in > > > > do not > > > > > need to derive from Persistence.Persistent, and if it is pickleable > > then > > > > all > > > > > should be fine if you call on instances of that object within you > > product. > > > > > > > > No. It'll work for "a while" or until the server is restarted. :-) > > > > > > > > > The next part that worried me came from the "python product tutorial" > > > > > http://www.zope.org/Members/hathawsh/PythonProductTutorial > > > > > > > > > > This stated that the class dictionary self.votes = {} needed to be > > changed > > > > to > > > > > self._votes = Globals.PersistentMapping() so that updates to it > > persist. > > > > > Hence my query about dictionaries. > > > > > > > > This was for convenience, I'd imagine. > > > > > > > > > I also noticed your comment about __setstate__ . What is it about > > this > > > > that is > > > > > dangerous. > > > > > > > > Nothing implicitly dangerous, but it can get confusing if you have > > multiple > > > > revisions of your product and you use variables caused by __setstate__. > > > > Also, once you add a __setstate__ which modifies the object in-place, > > > > there's a likelihood that it can never go away (you're can never be sure > > if > > > > all instances have been updated). > > > > > > > > > Recently I built a product out of some python classes I wrapped > > > > > around 4DOM, and since 4DOM documents do not seem to persist(well the > > > > document > > > > > does, but it loses all its children), then I persisted them to the > > local > > > > file > > > > > system, since I needed to do that anyway for what I was doing. > > Setstate > > > > seemed > > > > > to work nicely to bring them back, though watching its behaviour I > > noticed > > > > that > > > > > it was called very often by zope. > > > > > > > > Sure, that works... although at that point you're creating your own > > object > > > > database. :-) > > > > > > > > > > > > > > Chris McDonough wrote: > > > > > > > > > > > All pickleable Python primitive types (strings, dictionaries, lists, > > > > Nones, > > > > > > integers, floats, longs, etc.) can live in the ZODB. They can > > persist > > > > just > > > > > > like instances that inherit from the Persistent class. > > > > > > > > > > > > I think you read a little too much in to the fact that you need to > > > > "treat > > > > > > mutable objects immutably" when working with them in the ZODB. This > > > > > > statement doesn't mean that these kinds of objects can't be saved in > > the > > > > > > ZODB, it just means you need to treat them specially when putting > > them > > > > in > > > > > > the database. > > > > > > > > > > > > For instance, if you were doing this inside of an external method: > > > > > > > > > > > > def amethod(self): > > > > > > self.mydict = {} > > > > > > self.mydict['a'] = 1 > > > > > > > > > > > > (where self is the persistent object that is usually the external > > > > method's > > > > > > "container") > > > > > > > > > > > > It wouldn't work as you expected. Although you'd see an 'a' in > > mydict > > > > for a > > > > > > little while in further accesses to it, 'mydict' would eventaully > > show > > > > up as > > > > > > an empty dictionary on the first access of it after it was expired > > from > > > > the > > > > > > RAM cache (after it was 'ghosted'), because the last thing that the > > ZODB > > > > > > "saw" (via the __setattr__ on 'self' and a subsequent transaction) > > was > > > > you > > > > > > setting a empty dictionary. > > > > > > > > > > > > Persistent objects (like "self" in the above example) are only smart > > > > enough > > > > > > to notice changes to themselves that happen through their > > __setattr__ > > > > (e.g. > > > > > > self.mydict = {} calls self's __setattr__). Mutating the attribute > > > > 'mydict' > > > > > > above "in-place" (via self.mydict['a'] = 1) does not trigger self's > > > > > > __setattr__, so the ZODB never notices that "mydict" got changed. > > > > > > > > > > > > There are two ways to handle this. The first is to treat mutable > > > > attributes > > > > > > "immutably" via assigning to a temporary variable and then making > > sure > > > > the > > > > > > persistent container's __setattr__ gets called: > > > > > > > > > > > > def amethod(self): > > > > > > dict = {} > > > > > > dict['a'] = 1 > > > > > > self.mydict = dict # trigger persistence mechanism implicitly > > > > > > > > > > > > The second is to use the _p_changed attribute of the persistent > > object > > > > on > > > > > > which the primitive is set. This explcitly tells the persistence > > system > > > > to > > > > > > include the object on which it's set into the current transaction: > > > > > > > > > > > > def amethod(self): > > > > > > self.mydict = {} > > > > > > self.mydict['a'] = 1 > > > > > > self._p_changed = 1 # trigger persistence mechanism manually > > > > > > > > > > > > Variations on this theme extend to list methods too (e.g. > > list.append, > > > > > > list.pop, etc.) > > > > > > > > > > > > "Custom" classes can certainly persist, they just need to mix in the > > > > > > "Persistence.Persistent" class as a base class. > > > > > > > > > > > > As long as you obey this (slightly annoying, but necessary) rule, > > you > > > > > > shouldn't need to use PersistentMapping (it's really just a > > convenient > > > > > > wrapper that does this "magic" for you) or make any other wrappers > > for > > > > other > > > > > > mutable objects. > > > > > > > > > > > > I don't know why you're using __setstate__, but ummmm.. I won't go > > > > there. > > > > > > :-) I didn't look at your product, but I don't think I need to to > > > > answer > > > > > > your question... > > > > > > > > > > > > > Hi I am trying to get a handle on how I should handle peristence > > in my > > > > > > > python products. I have read all the ZODB documents and all the > > > > Product > > > > > > > tutorials, which all led me to believe that 1) mutable objects > > such as > > > > > > > lists and dictionaries are not persistent and that updates to > > these > > > > will > > > > > > > not be implicitly saved into the ZODB, and 2) that custom classes > > > > would > > > > > > > certainly not persist. That all seemed fine, and I used persitent > > > > > > > mapping and __setstate__ to fill things back in where necessary. > > But > > > > > > > then I decided to demonstrate that persitence does break as > > suggested. > > > > > > > > > > > > > > I used boring product, added a dicitonary and a custom class that > > > > > > > contains it's own dictionary.... let the user update name : value > > > > pairs > > > > > > > for both, and print the contents through index.dtml > > > > > > > > > > > > > > The problem is that everything persists fine !!!! through > > restarts, > > > > > > > everything? > > > > > > > > > > > > > > Why does it work??? shouldn't it not? > > > > > > > > > > > > > > I have attached the modified boring product .... boringplus ..... > > it's > > > > > > > dead simple to follow if you have made products before. > > > > > > > > > > > > > > Any explanation would be really nice. > > > > > > > > > > > > > > regards > > > > > > > Matt > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > Zope maillist - Zope(a)zope.org > > > http://lists.zope.org/mailman/listinfo/zope > > > ** No cross posts or HTML encoding! ** > > > (Related lists - > > > http://lists.zope.org/mailman/listinfo/zope-announce > > > http://lists.zope.org/mailman/listinfo/zope-dev ) > > > > > > > > > > > > _______________________________________________ > > Zope maillist - Zope(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope-dev ) > > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

2 3

PythonMethod (0.1.6) ZEO weirdnesss
by Dyon Balding 09 Dec '00

09 Dec '00

Hi, We've got a 2 client ZEO cluster working fine, with a number of PythonMethods (ver 0.1.6). When I tried adding a 3rd ZEO client, which I am pretty sure is set up in the same way as the other clients, PythonMethods created via the original clients barf when viewed on the new client. Wierdly, PythonMethods created in the new client work fine on all three. Any idea what is happening here? thanks d The traceback is as follows: Traceback (innermost last): File D:\dyon\DYONZO~1\lib\python\ZPublisher\Publish.py, line 222, in publish_module File D:\dyon\DYONZO~1\lib\python\ZPublisher\Publish.py, line 187, in publish File D:\dyon\DYONZO~1\lib\python\Zope\__init__.py, line 221, in zpublisher_exception_hook (Object: Traversable) File D:\dyon\DYONZO~1\lib\python\ZPublisher\Publish.py, line 171, in publish File D:\dyon\DYONZO~1\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: pytest) File D:\dyon\DYONZO~1\lib\python\ZPublisher\Publish.py, line 112, in call_object (Object: pytest) File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\PythonMethod.py, line 163, in __call__ (Object: pytest) File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\PythonMethod.py, line 144, in makeFunction (Object: pytest) File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\PythonMethod.py, line 126, in _newfun (Object: pytest) File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\VSExec.py, line 344, in UntupleFunction File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\code_editor.py, line 260, in __init__ File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\code_editor.py, line 267, in __init__ (Object: pytest) File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\code_editor.py, line 287, in init_tuple (Object: pytest) File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\code_editor.py, line 162, in __init__ File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\code_editor.py, line 177, in __init__ File D:\dyon\dyonzope224\lib\python\Products\PythonMethod\zbytecodehacks\code_editor.py, line 217, in init_tuple ValueError: unpack tuple of wrong size -- Dyon Balding <dyon(a)devcoder.com.au>

1 0

RE: [Zope] Microsoft IIS 4.0 and Zope
by Menard.Jean-Francois＠hydro.qc.ca 09 Dec '00

09 Dec '00

Hi Petter, I have the same problem. Could you tell me if you find a way? I hope someone on this list have an answer! -----Message d'origine----- De : Petter Enholm [mailto:petter@enholm.com] Envoyé : vendredi 8 décembre 2000 07:53 À : zope(a)zope.org Objet : [Zope] Microsoft IIS 4.0 and Zope Hi, This may be more of a Microsoft IIS questions than Zope question, but I give it a shot! I have installed Zope (on port 8080) on a Windows NT 4.0 server with IIS 4.0, followed to Howto that explains how to set up PCGI with IIS, and all works very well. I can access Zope through http://localhost/scripts/zope.pcgi Next step: I want to access the Zope site through a given DNS name, f eks www.mydomain.com. How can I do this with IIS 4.0? I find no way to redirect a virtual host and at the same time rewrite the URL so that the user gets http://www.mydomain.com in the browser, not .../scripts/zope.pcgi. Anybody out there with knowledge on this issue? Best regards Petter Enholm Snapper as _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

3 2

Failed upgrade to 2.2.4 - solutions?
by Luke Tymowski 08 Dec '00

08 Dec '00

Hello, I've just tried and failed to upgrade to 2.2.4 from 2.2.2. A python instance starts up and slowly swallows the CPU, ending with 99% of the CPU. A second python instance starts and doesn't do anything naughty. If I issue a ./stop, the second python instance ends properly, but the first continues to consume all CPU resources. I've tried recompiling it several times, reinstalling Python, but no go. It did once start up properly, but as soon as I tried logging into Zope, python took over the CPU. I'm using OpenBSD 2.8, python 1.5.2, x86, 196MB of RAM, GBs of free disk space. I've been using Zope since 2.0 and have never had this much trouble upgrading. the only Zope product I'm using is SiteAccess (the same setup as the old Zope.org before the cluster upgrade). Any ideas? thanks, Luke

2 4

Weird ZCatalog problem... bug?
by sean.upton＠uniontrib.com 08 Dec '00

08 Dec '00

On my developmet box, I'm using Zope 2.2.1 and ZCatalog to index ZClass-based classified ad objects; for some reason on sort="title" in the <dtml-in Catalog ... I get inconsistent results. I perform a search and get incorrect results. I then click refresh, get results sorted differently, then click refresh again, and it's messed up again. Anyone seen anything like this? Thoughts? Other info about setup: Globbing vocabulary Catalog and indexed objects are in BTree folder ZClasses catalog aware Other sort= values seem to work. Here is a DTML snippet... <dtml-var expr="REQUEST.get('fieldsort')"> <dtml-in Catalog size=50 start=query_start sort="REQUEST['fieldsort']"> ... </dtml-in> URL looks like results?title=&AdBody=par*&WeightWords=&fieldsort=title&SUBMIT=Submit+Query Thanks, Sean ========================= Sean Upton Senior Programmer/Analyst SignOnSanDiego.com The San Diego Union-Tribune 619.718.5241 sean.upton(a)uniontrib.com =========================

1 0

SECURITY alert and hotfix release
by Brian Lloyd 08 Dec '00

08 Dec '00

Hi all, Aleksander Salwa has brought a security issue to our attention that affects all Zope versions up to and including Zope 2.2.4. We have released a Hotfix product to address the issue that can be downloaded from zope.org. (Thanks to Aleksander for finding this and to Shane Hathaway for his quick response in resolving it!) The issue involves security registration of "legacy" names for certain object constructors such as the constructors for DTML Method objects. Security was not being applied correctly for the legacy names, making it possible to call those constructors without the permissions that should have been required. This issue could allow anonymous users with enough internal knowledge of Zope to instantiate new DTML Method instances through the Web. The hotfix for this issue is available on the zope.org web site: o http://www.zope.org/Products/Zope/Hotfix_2000-12-08/Hotfix_2000-12-08.tgz We *highly* recommend that any Zope site running versions of Zope up to and including 2.2.4 have this hotfix product installed to mitigate the issue. The hotfix will work for all versions of Zope 2.2.0 and higher. A future version of Zope will contain the fix for this issue, and you will be able to uninstall the hot fix after upgrading. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 2

Applying hotfix to running zope
by Oliver Sturm 08 Dec '00

08 Dec '00

Hi, is there a way to apply a patch like the current hotfix product to a running zope without restarting the process? MfG, Oliver Sturm -- GUI (gooey): What your computer becomes after spilling your coffee on it. -- Oliver Sturm / <sturm(a)oliver-sturm.de> Key ID: 71D86996 Fingerprint: 8085 5C52 60B8 EFBD DAD0 78B8 CE7F 38D7 71D8 6996

2 1