February 2000 - Zope

Again rc
by Tom Deprez 03 Feb '00

03 Feb '00

Hi, I start Zope as daemon (-Z option) and now I've the following problem : http://localhost/Zope works (through Apache) but http://localhost:8080 doesn't work, it says that the server is down. While Zope is running (see with Apache) What am I doing wrong? Is there something I should know? Is there somewhere a port I've to activate in Linux? Thanks in advance! Regards, Tom.

1 0

Hotmail-like Zope Product?
by John Goerzen 03 Feb '00

03 Feb '00

Hi, I somehow recall reading of a Zope webmail product somewhere but couldn't find it on the website. Anyone have any tips on where it's hiding?

4 3

Re: CERT -- Malicious HTML Tags
by Squishdot 03 Feb '00

03 Feb '00

tres seaver <tseave-(a)palladion.com> wrote: > CERT has released a fairly dire advisory on the dangers of dynamic page > generation when coupled with untrusted content submission: > > http://www.cert.org/advisories/CA-2000-02.html > > Anyone care to comment on Zope's vunlerability here? For instance, the ZGotW > site allows submissions in structured text, plain text, and HTML -- but now I am > probably going to htmlquote() the last, which kills a lot of the point of it, > no? > > The key issue lies in embedding <SCRIPT>...</SCRIPT> chunks (or their immoral > equivalents, <OBJECT>, <EMBED>, and <APPLET>). Consider, for instance, those > nasty pop-up windows launched by some "free" webspace providers; then consider > what happens in Squishdot, ZGotW, or any other site which permits users to enter > arbitrary HTML as part of the feedback/collaboration process. Not a pretty Yes, I've been reading up on it as well. I'll be studying this issue as well WRT to Squishdot. I would probably need to add some validation to Squishdot to filter out these *malicious tags* -- if anyone in the Zope/Squishdot has ideas/code to fix this, please contact me ASAP. I've checked Squishdot so that all input fields are html-quoted, but the most vulnerable part seems to be the possible addition of javascript and other executable code -- If I build a validation mechanism that filters out <SCRIPT, <OBJECT, <APPLET and <EMBED html tags, would this solve the problem -- or is this only a partial solution? What other things would I need to filter out? I don't know about the Zope's cookie mechanism -- since we get the Cookie already as part of the namespace -- is this vulnerable too? Regards, Butch ===== Butch Landingin Squishdot maintainer http://squishdot.org squishdot(a)yahoo.com __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

3 3

Site access problem - inaccessible frpm admin screen
by chas 03 Feb '00

03 Feb '00

I'm adding virtual servers to Zope using siteaccess and the mod_proxy in Apache. I've set it up for one site and it works perfectly - thanks to Evan for a great product and to Anser for a superb How-to (http://www.zope.org/Members/anser/apache_zserver) However, creating a second folder with a SiteRoot is giving very strange problems. As soon as the SiteRoot is added, I can not access the folder within the management screens. Clicking on it causes Netscape's status bar to display "Host www.xxxx.com contacted. Waiting for reply...." repeatedly, flickering/twitching as if it's trying to do it repeatedly. I never succeeds. However, from the end user's perspective, the virtual host works perfectly - the site is accessible and the virtual server works. Has anybody else seen similar problems trying to access a folder with a SiteRoot in the admin interface ? This isn't a 'permission denied' problem ... I just don't get anything returned from the server. Thank you very much in advance, chas ps. configuration steps : 1. Set up apache's mod_proxy and create the proxy_pass directives for 2 domains : <VirtualHost xxx.xxx.xxx.xxx> ServerName www.domainA.com ProxyPass / http://xxx.xxx.xxx.xxx:8080/A/ ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/A/ </VirtualHost> <VirtualHost xxx.xxx.xxx.xxx> ServerName www.domainB.com ProxyPass / http://xxx.xxx.xxx.xxx:8080/B/ ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/B/ </VirtualHost> 2. create a folder : /A place a SiteRoot in /A base = http://www.domainA.com path = / Restart apache and this works fine. The site contained in the zope folder /A is viewable as www.domainA.com and it can be accessed via the administration interface. 3. create a folder : /B place a SiteRoot in /B base = http://www.domainB.com path = / After creating the SiteRoot, the folder /B is inaccessible via the admin screens though the virtual server IS acceseible from the web.

2 1

Re: [Zope] RE: zope/style sheets
by Sam Gendler 03 Feb '00

03 Feb '00

> > > That was my thought, set a cookie once on the browser and use that to > choose the style sheets and javascript files to load thereafter in > that session. > > But your jeremiad on cookies & cahes makes me wonder. Hobbling > people's squids for such a trivial matter seems inhospitable somehow. > Does Zope do anything special with cookies, like add a nocache tag to > headers on cookied pages? > What I tend to do is have the mystylesheet.css file actually be a dtml-method that can do the following. Check the cookie, decide the appropriate path Send a redirect to the client to a css file that DOES contain the correct data. This way, the html page gets cached, all html files can include the same stylesheet, and no caches get confused by caching the wrong object. It aso makes it very easy to add new options, etc. Alternatively, create a dtml method that contains just two lines. The first line would contain <dtml-call "RESPONSE.appendHeader('Cache-Control', 'proxy-revalidate')"> and the second line would contain the dtml code that includes the stylesheet based on the user agent. All pages that should contain the stylesheet code will then be served with a proxy-revalidate header. That header forces any network cache to send a if-modified-since request, which should cause things to work correctly. Some caches might not handle it well, but most should (the ones I have had my hands on do...) For industrial strength reliability, you could set cache-control: private, which allows the browser cache (a private cache) to store the object, while any public cache is not allowed to cache it. I would be VERY surprised if any caches didn't handle this correctly. Both of these solutions seem easy to implement and maintain to me. Let me know if you have any questions --sam -- Sam Gendler Chief Technology Officer - Impossible, Inc. 1222 State St. Suite 250 Santa Barbara CA. 93101 w: 805-560-0508 f: 805-560-0608 c: 805-689-1191 e: sgendler(a)impossible.com

1 0

Problem Installing Zope 2.1.3
by Matthew.Stevenson＠student.shu.ac.uk 03 Feb '00

03 Feb '00

Hi I am trying to install Zope 2.1.3 on a linux machine running Suse 6.0. I manage to run the install script ok but when I try to start ZServer I get an error on the last task it is supposed to do (which is start the ZServer Monitor Server). The script halts with the error message of roughly: IOError Errno13 Permission denied on /zopedirectory/var/Z2.pid As far as I can find there is no Z2.pid file in the var directory and I have also used chmod on the directory to try and correct any permssion problems. If anybody can help me I would be very greatful as I hope to use Zope in my University Final year Project. Thanks again, Mat.

4 3

Newbie SQL method problems
by Joseph Kocherhans 03 Feb '00

03 Feb '00

I have a ZSQL method that take 1 input category_id: select * from category_names where id=<dtml-sqlvar category_id type=int> The folder containing the method has a property category_id. If I leave the arguments feild of the SQL method blank then the method displays correctly. However if I put category_id in the arguments feild I get this error: Zope has encountered an error while publishing this resource. Error Type: Bad Request Error Value: ['category_id'] Traceback (innermost last): File C:\Program Files\ecomdev\lib\python\ZPublisher\Publish.py, line 214, in publish_module File C:\Program Files\ecomdev\lib\python\ZPublisher\Publish.py, line 179, in publish File C:\Program Files\ecomdev\lib\python\Zope\__init__.py, line 202, in zpublisher_exception_hook (Object: ElementWithAttributes) File C:\Program Files\ecomdev\lib\python\ZPublisher\Publish.py, line 165, in publish File C:\Program Files\ecomdev\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: index_html) File C:\Program Files\ecomdev\lib\python\ZPublisher\Publish.py, line 102, in call_object (Object: index_html) File C:\Program Files\ecomdev\lib\python\OFS\DTMLDocument.py, line 166, in __call__ (Object: index_html) File C:\Program Files\ecomdev\lib\python\DocumentTemplate\DT_String.py, line 502, in __call__ (Object: index_html) File C:\Program Files\ecomdev\lib\python\OFS\DTMLDocument.py, line 162, in __call__ (Object: home) File C:\Program Files\ecomdev\lib\python\DocumentTemplate\DT_String.py, line 502, in __call__ (Object: home) File C:\Program Files\ecomdev\lib\python\DocumentTemplate\DT_In.py, line 630, in renderwob (Object: category_names) File C:\Program Files\ecomdev\lib\python\Shared\DC\ZRDB\DA.py, line 396, in __call__ (Object: category_names) File C:\Program Files\ecomdev\lib\python\Shared\DC\ZRDB\Aqueduct.py, line 149, in _argdata (Object: category_names) Bad Request: (see above) In the ZSQL Method User guide it explains that if a variable is present in the arguments list then Zope looks at the HTTP request first and if it doesn't find the variable it looks at the properties of the method's containing folder. http://www.zope.org/Documentation/Guides/ZSQL-HTML/ZSQL.1.4.4.html#pgfld-91… If I pass the variable category_id in a form or a URL then the SQL method displays correctly. I appears to me (please prve me wrong) that Zope is not performing the second lookup. Has anyone else had a problem similar to this? Please let me know if I am not explaining it well enough. Thanks in advance!

1 0

SybaseDAv2 and stored procedures
by Sascha Matzke 02 Feb '00

02 Feb '00

Hello, is there any way to call stored procedures in a sybase database (11.9.2)? (Just a simple select query) Sascha -- .-> Sascha Matzke - sascha(a)bespin.de - http://www.bespin.de -. | Read the sourcecode, Luke... | | Obi Wan Kenobi | `-- On this earth for 24 years, 112 days <----------------'

1 0

pipedream : fork a dtml-method within zope ?
by chas 02 Feb '00

02 Feb '00

Consider a discussion forum product where a dozen people have already participated in a particular thread. These people, when posting their messages, checked a box which said "email me when somebody else responds/adds to this thread". (Yes, this is nicked from Cold Fusion Forums :-) Now, a 13th person adds his 2 cents to the thread and posts a response. We want to now send a mail to each of the first 12 participants. No problem so far, except mailing all 12 people is going to take quite a bit of time, and contributor #13 is going to get impatient waiting whilst this is happening. Then imagine a discussion thread with dozens of participants/posts. Solutions : a. Write some script to go through the discussion forums looking for such follow ups and mail the previous participants in the discussion thread. Cronjob it. Tiresome/boring and not as instantaneous as I'd like. b. Is it possible in any way to fork that mailing process (which is actually just one dtml method), so that it can be completed without slowing down the rendering of the page ? I'm guessing this is totally beyond zope. Or am I overlooking something obvious ? TIA, Chas

2 2

Re: [Zope] sqlsession
by Anthony Baxter 02 Feb '00

02 Feb '00

Yep. That is all you need to do. If there's anything else that needs changing, well, that's a bug, and I'll fix it. Anthony >>> Graham Chiu wrote > > Anthony, > > I was thinking of using the sqlsession product but some of the column > names you use are reserved in Interbase ( either 'name' or 'value' ). > > Do I just have to change the sqlmethods? > > ------- > Regards, Graham Chiu > gchiu<at>compkarori.co.nz > http://www.compkarori.com/dynamo - The Homebuilt Dynamo > http://www.compkarori.com/dbase - The dBase bulletin > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0