September 2000 - Zope

Re: Download Problem
by Shane Hathaway 26 Sep '00

26 Sep '00

Suzette Ramsden wrote: > > I have had this same problem downloading squishdot zip files and I don't > know if it is something I am doing. > When I attempt to unzip the file, I keep getting: > "error reading header after processing 0 entries" What archiver are you using? I'm guessing you're talking about some product I wrote, all of which are "tar.gz" files, not "zip" files. WinZip can read them, however. Shane

3 2

[Fwd: Zope Question]
by Ryan Booz 26 Sep '00

26 Sep '00

2 1

Zope.org FYI
by Shane Hathaway 26 Sep '00

26 Sep '00

Zope.org has been having some problems with memory leaks and "ghosts". Please excuse the occasional interruption. Also, /Members is now a new kind of BTreeFolder. An update to the BTreeFolder product will soon be released. With this change, some DTML installed on zope.org may have problems if it contains the expression "Members.<username>". Just change the DTML to "Members['<username>']". Updates forthcoming this week... Shane

2 1

Nasty subtle security bug
by Martijn Faassen 26 Sep '00

26 Sep '00

Hi there, I'm about to describe a very nasty bug that appears to exist in different guises in at least Zope 2.1.6 and Zope 2.2.2. The bug is nasty because it occurs under rather restricted circumstances, so nobody else noticed it yet, but it keeps biting _me_. The circumstances: * we have external method E in the root * we have a user defined in the root. This user has a certain role A. * we authenticate that user with a DTML method in root for role A. (so role A in this setup exists to force authentication only) * we give the user a local role B (or local user account with same username/password with that role) in a higher folder, X. * the external method E has security permissions to only work with role B (and manager), not with anonymous. As far as I am aware, our user should be able to execute E in the context of X and any subfolders, as the user has the right role there. Our user should not be able to execute E in the context of any other folder, however. (the execution happens through a DTML call) The symptoms: In Zope 2.1.6, the user cannot execute the external method E. Instead, the user is asked to reauthenticate. Naturally, reauthenticating the user again as himself won't work. In Zope 2.2.2, the user cannot execute the external method E either. Instead, the calling DTML code raises a NameError, basically saying our external method does not exist. The subtle bits -- when it *does* work fine --: This is probably why nobody actually ran into this one before. * it works fine when the user has manager role (at least in root) * it works fine when the external method is executable by anonymous. * it works fine when the external method is defined in another folder (not root folder) * it works fine with DTML methods * it even works fine (tested in 2.1.6) when the role is *not* added as a local role or with a local user account; if the user has role B from the start, it works. This one particularly gave me a lot of grief. The workaround that gets closest to what I want is to define the external methods in folder higher up instead. But that's not really desirable, in my circumstances I want the external method callable in the entire site, if the user is authenticated. Some minor observations: * ZClass instances seem to be affected as well. I'm not as sure about the symptoms here though. Anyway, I tried to upgrade to 2.2.2 to avoid this bug in particular, but the only thing I got was a NameError instead of an Authentication error. Sigh.. It doesn't appear to be a security leak, it appears to be overzealeous security instead. :) I'll also dump this description into the collector, but posted to the list because I like to complain. And who knows, perhaps someone else ran into the same. Regards, Martijn

3 6

ZFormulator -- how to make an SQL insert?
by Mike Renfro 26 Sep '00

26 Sep '00

I looked in the archives for anything concerning this, and came up empty. I have zformulator set up with postgres, and it appears to work fine, except that I've not found the zen to make it actually do an SQL insert -- I know the GetSQL method will extract the proper code, but am I missing something trivial that'll let me actually execute the SQL code? Thanks. -- Mike Renfro / R&D Engineer, Center for Manufacturing Research, 931 372-3601 / Tennessee Technological University -- renfro(a)tntech.edu

2 1

Re: Zope Question
by Chris McDonough 26 Sep '00

26 Sep '00

----- Original Message ----- From: "Ryan Booz" <ryanbooz(a)alumni.psu.edu> To: "Comp Ed List" <seul-edu(a)seul.org> Sent: Monday, September 25, 2000 3:03 PM Subject: Zope Question > Hey gang, > > I'm posting this question here because I know a while back some people > had mentioned they were using Zope. I'm trying to start using it, > getting used to the DTML and all the other stuff. I can get it running > with my Apache server, and that's all well and good. But I have these > two questions which I can't seem to find answers to in current Zope > documents and help. > > 1. How do I get the server process to run as a daemon? I've tried the > one script for an rc process I found on a site, but my server just hangs > and I never get a command prompt back. All other processes I've ever > run at startup are either designed to be daemons, or have a specific > switch to add to the program name. Removing the -D (debug) switch from the z2 line in start.py will cause Zope to release control of the terminal from which it was started. > 2. OK, this is kind of two part. First, where does Zope actually store > all of the directories and files you create for a site. If I have a > fake directory as the "trigger" for the persistent CGI process, than > where does it actually store this pages I'm creating? As an example, > following the install instructions that comes with Zope, I've set Apache > to send every request for /zope to the FastCGI process running in the > background. That directory does not exist in my htdocs directory. > Where is this stuff going? In the "ZODB" (Zope Object Database). See http://www.zope.org/Members/mcdonc/HowTos/gainenlightenment for some nuggets. This is a tough one to wrap your head around when you first get started. > > Two, can I get Zope to answer the general requests for a site (like > www.bms.school my internal server and fake domain.) Rather than having > to specify a directory, it would just send all requests to Zope. But to > take that one step further, if I had user accounts set up with the > /~username convention, would this stuff be able to pass through Zope and > actually go to those directories? I don't think I'm making this > question clear, but I don't know how else to state it right now. See the SiteAccess product on Zope.org

1 0

http://webcompare.internet.com/
by Hung Jung Lu 26 Sep '00

26 Sep '00

Hi, I just ran across this website: http://webcompare.internet.com/ Interesting that I did not see anything on Zope. Shouldn't we write something to webcompare(a)internet.com and let them know about Zope? (Look also under http://serverwatch.internet.com/appservers.html ) regards, Hung Jung _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

2 1

trouble with SiteAccess; can't manage subtree mapped to inaccessible domain name
by Fred Yankowski 26 Sep '00

26 Sep '00

I set up SiteAccess 2-0-0b3 on Zope 2.2.2 so that two virtual hosts front-ended by Apache map to two different subtrees in Zope. That worked OK until the local DNS server lost the entry for one of my domains. I'm working on fixing that (it's out of my hands) but I find that in the meantime I can't even get to the corresponding Zope subtree in manage mode! I think the SiteAccess object I created is still mapping URLs to the domain name which now fails to resolve. How do I get out of this jam? I tried deleting the Products/SiteAccess folder, restarting Zope, and deleting the SiteAccess product from the Control_Panel/Products view, but now I'm getting an AttributeError when I try to access the subtree that has a SiteAccess object. Since I can't get to that tree, I can't figure out how to delete that object. Is there some way to delete it by name from a higher point in the tree? -- Fred Yankowski fred(a)OntoSys.com tel: +1.630.879.1312 Principal Consultant www.OntoSys.com fax: +1.630.879.1370 OntoSys, Inc 38W242 Deerpath Rd, Batavia, IL 60510, USA

3 3

1000-record limit?
by Christopher J. Kucera 26 Sep '00

26 Sep '00

Greetings! I know I saw this discussed a long time ago, but I completely failed to find the thread anywhere, so here goes . . . We're running a somewhat older release of Zope with ZOracleDA, and we've run up against a 1000-record limit when returning data for reports, etc. I know that this is intended behavior (careful_range in DT_Util.py), but I'm wondering what the reasoning is, and if I should be even considering playing around with this (I'm assuming it was put in there for *some* reason . . . :) Thanks in advance for your help! -CJ

2 2

ZClass + ZSQLmethods bug in 2.2.2?
by Alexander Schonfeld 26 Sep '00

26 Sep '00

Hi, I've seen lots of ZSQLmethods patches and such and tried a few of them under 2.1.6, but thought upgrading to 2.2.2 would fix this problem. It didn't. Basically: 1. Create a ZClass 2. Inside create a DTML method and ZSQLmethod 3. from the dtml method call the ZSQLmethod 4. do a <dtml-with "myClassInstanceObj"> <dtml-var myMethod> </dtml-with> 5. get a Unauthorized error no matter what the access privileges are set to This is with the "MySQLda". Is there a newer MySQLda somewhere that fixes this? Or some patch (that works with 2.2.2???)?! Running 2.2.2 from source... now with less hair... Sincerely, Alex. ================================ Zope Error Zope has encountered an error while publishing this resource. Unauthorized You are not authorized to access sqlGetValue. Traceback (innermost last): File /Zope-2.2.2/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /Zope-2.2.2/lib/python/ZPublisher/Publish.py, line 187, in publish File /Zope-2.2.2/lib/python/ZPublisher/Publish.py, line 171, in publish File /Zope-2.2.2/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: testmeth) File /Zope-2.2.2/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: testmeth) File /Zope-2.2.2/lib/python/OFS/DTMLMethod.py, line 172, in __call__ (Object: testmeth) File /Zope-2.2.2/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: testmeth) File /Zope-2.2.2/lib/python/DocumentTemplate/DT_With.py, line 146, in render (Object: testcrp) File /Zope-2.2.2/lib/python/OFS/DTMLMethod.py, line 168, in __call__ (Object: craptest) File /Zope-2.2.2/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: craptest) File /Zope-2.2.2/lib/python/DocumentTemplate/DT_In.py, line 633, in renderwob (Object: sqlGetValue(tableId='Artist',columnId='Name',keyId='3f69016017c39d5da0a1d60d0a98dbed55d46414')) File /Zope-2.2.2/lib/python/DocumentTemplate/DT_Util.py, line 331, in eval (Object: sqlGetValue(tableId='Artist',columnId='Name',keyId='3f69016017c39d5da0a1d60d0a98dbed55d46414')) (Info: sqlGetValue) File /Zope-2.2.2/lib/python/OFS/DTMLMethod.py, line 194, in validate (Object: testmeth) File /Zope-2.2.2/lib/python/AccessControl/SecurityManager.py, line 139, in validate File /Zope-2.2.2/lib/python/AccessControl/ZopeSecurityPolicy.py, line 209, in validate Unauthorized: (see above) 1010011010101001101010100110101010011010 0 Digital Garage　デジタル車庫　:) 1 Alexander Schonfeld 0 alex(a)garage.co.jp - pear - 03-5454-7219 1 http://www.zope.ne.jp/ http://www.garage.co.jp

1 0