January 2001 - Zope - Zope lists

[voipiri: Re: [Zope] Opensource DBMS for WIN?]
by Riku Voipio 23 Jan '01

23 Jan '01

too fast typing - ment this to the list... -- Riku Voipio riku.voipio(a)tietoenator.com 09-862 60764

1 0

Re: [Zope] ActiveState on Zope.org
by Tres Seaver 23 Jan '01

23 Jan '01

"Andy McKay" <andym(a)ActiveState.com> wrote > > > hi, > > > > I'm kind of surprised that Active State has such a big promo on Zope.org's > > site considering they use IIS; and considering the blurb talks about how > > much they do for Open Source. > > We use IIS for many reasons, it's fast and we use some of products in > conjunction with it. To suggest that using IIS is somehow "wrong" confuses > me, Zope.org doesn't use ZServer. Strictly speaking, not true -- the host your browser connects to is first a load-balancer, then an Apache instance; Apache is proxying for ZServer. See http://www.zope.org/About for details. Otherwise, I'd agree with the rest of your points. > For me the flexibilty of using Zope any > way we see fit is its greatest strength. We made a decision to serve > "static" content using a simple fast server and dynamic content using Zope. > > Actually we have the main web site in Zope. Its the CMS for the main web > site and only accessible internally. This allows multiple users to access > and make changes, templating and so on. Since this content changes very > rarely we use wget hack to move the information to the main web site to be > served by IIS, since IIS can serve out many more pages per second that Zope > can (because it is doing some much less). This is a "right product for the > right job" decision. > > For the dynamic portions (mailing list arcive etc.) we use Zope and ZServer > quite happily on the front end. One day we may move to having the whole site > in Zope, who knows :). > > As mentioned we do a great deal for Open Source (ActivePerl, ActivePython, > PyXPCOM, PPM and so on) to name a just a bit. ActiveState is one of the very > few companies where we pay people to hack open source stuff all day. In the > same way Guido works for DC and spends time on Python, we have many talented > Python and Perl developers (David Ascher, Paul Prescod, Gurusamy Sarathy, > Jan Dubois) who in put a great deal of Open Source work. Tres. -- =============================================================== Tres Seaver tseaver(a)digicool.com Digital Creations "Zope Dealers" http://www.zope.org

1 0

Python Products and ZODB Transactions
by Stephan Richter 23 Jan '01

23 Jan '01

Hello everyone, wow, I haven't posted here for a while now, but now I came to a bigger problem and I hope someone of you will have some suggestions: I built a Python Product that saves and gets data from a RDB. Whenever a method is called from my Python Product, the ZODB saves the transaction, even though the object was not modified at all. I really would like the ZODB to never save any of my Products actions. Any ideas? Reagrds, Stephan -- Stephan Richter CBU - Physics and Chemistry Student Web2k - Web Design/Development & Technical Project Management

2 1

LocalFS and PathHandler
by Ulrich Wisser 23 Jan '01

23 Jan '01

Hello, I try to access LocalFS from my own DTML method. (Exactly from my PathHandler method.) I got all directory information in one array like this path_to_handle = ['sub1', 'sub2', 'sub3'] How can a get a directory listining with LocalFS for path "/sub1/sub2/sub3/"? I know I need something like "lfs['sub1']['sub2']['sub3'].fileids". But what if there are more (or less) elements in path_to_handle? I hope made my point clear? Thanks Ulli -- Searchengine Know How - Webpromotion - Optimization - Internal Search World Wide Web Publisher, Ulrich Wisser, Odensvag 13, S-14571 Norsborg http://www.publisher.de Tel: +46-8-53460905 Fax: +46-8-534 609 06

3 2

Buffer overflow in MySQL < 3.23.31
by Ragnar Beer 23 Jan '01

23 Jan '01

Howdy! Just for us MySQL users I'm forwarding this from bugtraq. Ragnar >Hi, > >all versions of MySQL < 3.23.31 have a buffer-overflow which crashs the >server and which seems to be exploitable (ie. 4141414 in eip) > >Problem : >An attacker could gain mysqld privileges (gaining access to all the >databases) > >Requirements : >You need a valid login/password to exploit this > >Solution : >Upgrade to 3.23.31 > >Proof-of-concept code : >None > >Credits : >I'm not the discoverer of this bug >The first public report was made by tharbad(a)kaotik.org via the MySQL >mailing-list >See the following mails for details > >Regards, >Nicob > >Here the original post to the MySQL mailing-list : >================================================== > >On Jan 12, Jo?o Gouveia wrote: >> Hi, >> >> I believe i've found a problem in MySql. Here are some test's i've made in >> 3.22.27 x86( also tested on v3.22.32 - latest stable, although i didn't >> debug it, just tested to see if crashes ).Confirmed up to latest 3.23 > >> On one terminal: >> <quote> >> spike:/var/mysql # /sbin/init.d/mysql start >> Starting service MySQL. >> Starting mysqld daemon with databases from /var/mysql >> done >> spike:/var/mysql # >></quote> >> >> On the other terminal: >> <quote> >> jroberto@spike:~ > mysql -p -e 'select a.'`perl -e'printf("A"x130)'`'.b' >> Enter password: >> (hanged..^C) >> </quote> >> >> On the first terminal i got: >> <quote> >> spike:/var/mysql # /usr/bin/safe_mysqld: line 149: 15557 Segmentation fault >> nohup >> $ledir/mysqld --basedir=$MY_BASEDIR_VERSION --datadir=$DATADIR --skip-lockin >> g "$@" >>$err_log 2>&1> >> Number of processes running now: 0 >> mysqld restarted on Fri Jan 12 07:10:54 WET 2001 >> mysqld daemon ended >> </quote> >> >> gdb shows the following: >> <quote> >> (gdb) run >> Starting program: /usr/sbin/mysqld >> [New Thread 16897 (manager thread)] >> [New Thread 16891 (initial thread)] >> [New Thread 16898] >> /usr/sbin/mysqld: ready for connections >> [New Thread 16916] >> [Switching to Thread 16916] >> >> Program received signal SIGSEGV, Segmentation fault. >> 0x41414141 in ?? () >> (gdb) info all-registers >> eax 0x1 1 >> ecx 0x68 104 >> edx 0x8166947 135686471 >> ebx 0x41414141 1094795585 >> esp 0xbf5ff408 0xbf5ff408 >> ebp 0x41414141 0x41414141 >> esi 0x41414141 1094795585 >> edi 0x0 0 >> eip 0x41414141 0x41414141 >> eflags 0x10246 66118 >> cs 0x23 35 >> ss 0x2b 43 >> ds 0x2b 43 >> es 0x2b 43 >> fs 0x0 0 >> gs 0x0 0 >> (gdb) >> </quote> >> >> looks like a tipical overflow to me. >> Please reply asap, at least to tell me i'me not seeing things. :-)> >> Best regards, >> >> Joao Gouveia aka Tharbad. >> >> tharbad(a)kaotik.org > >Here the reponse to a email I send today to the MySQL list : >============================================================ > >Sergei Golubchik (MySQL team) wrote : >> >> Hi! >> >> On Jan 18, Nicolas GREGOIRE wrote: >> > Hi, >> > >> > Still not any info about the buffer-overflow discovered last week ? >> > Shouldn't be fixed at the beginning of the week ? >> > >> > Please, dear MySQL team, give us info !! >> > >> > Regards, >> > Nicob >> >> Fixed in latest release (3.23.31). >> >> Regards, >> Sergei > >Here an part of the 3.23.30 to 3.23.31 diff : >============================================= > >+Changes in release 3.23.31 >+-------------------------- >+ >+ * Fixed security bug in something (please upgrade if you are using a >+ earlier MySQL 3.23 version).

1 0

Re: hurryup!
by Martijn Pieters 23 Jan '01

23 Jan '01

On Tue, Jan 23, 2001 at 10:44:57AM +0500, Hasan Ali Khan wrote: > hi! > my name is John hakhan. iam using zope2-2-4 win32-x86 on o.s windows 95. > i have following queries. > 1)give me complete steps about connect the zope either oracle or MS SQL > SERVER. > 2)i am provide my client the facility of mailing +fax.what are the steps. > 3)if i use MS EXCHANGE SERVER how i connect the zope. > please reply me as soon as possible.i am in greate trouble > tata > Hi Hasan, The best place for getting quick answers to questions like the 3 you ask is at the Zope mailinglist: http://www.zope.org/Resources/MailingLists I copied this reply there as well, so people can give you answers right away. Hope this helps! -- Martijn Pieters | Software Engineer mailto:mj@digicool.com | Digital Creations http://www.digicool.com/ | Creators of Zope http://www.zope.org/ ---------------------------------------------

1 0

[2nd try] dtml-tree causing authorization errors
by yves＠njc.ch 23 Jan '01

23 Jan '01

[ I accidentally sent the last mail before I completed it... Sorry ] I've stumbled upon a strange problem with dtml-tree in version 2.2.5 (the problems occurs in the same way in any of the 2.2.x version), but didn't exhibit itself in 2.1.6: Here's some (very) crude code to generate a tree object: ------------- class Tree: def __init__(self, val='top'): self.name = val self.tpId = val def tpValues(self): tlist = [] for i in range(8): tlist.append(Tree('me: %s' % i)) return tlist def build(): return Tree() -------------- Now if I attach this to an "External Method" called "mytree" which references the function "build()", and I write the following DTML: ----- <dtml-tree mytree> <dtml-var name> </dtml-tree> ----- In version 2.1.6, I obtain a tree, it's composed of 8 items and each expands into 8 more, etc... If I do the same thing in version 2.2.5, I get an authentication failure... even though I'm logged on as superuser or an admin user... I've tried this on a fresh install to ensure nothing gets in the way. The error I get is: ------------ Zope Error Zope has encountered an error while publishing this resource. Unauthorized Sorry, a Zope error occurred. Traceback (innermost last): File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/OFS/DTMLMethod.py, line 172, in __call__ (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 154, in render (Object: mytree) File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 260, in tpRender File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 514, in tpRenderTABLE (Info: (['top', []], {'id': 'tpId', 'childless_decoration': '', 'name': 'mytree', 'branches': 'tpValues', 'url': 'tpURL', '': 'mytree'}, (['top', []],), (['top', []],))) File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 431, in tpRenderTABLE File /home/zope/Zope-2.2.5-src/lib/python/OFS/DTMLMethod.py, line 194, in validate (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/AccessControl/SecurityManager.py, line 139, in validate File /home/zope/Zope-2.2.5-src/lib/python/AccessControl/ZopeSecurityPolicy.py, line 159, in validate Unauthorized: name -------------- So it's looking like it's breaking because of the Security enhancements made in 2.2.x, but why isn't it letting me access the "name" attribute? How am I supposed to bypass this authorization process? ..Yves

2 1

python method's self parameter - calling from DTML with additional args
by Lee 23 Jan '01

23 Jan '01

Hi, I've got a problem with displaying output from one of my python methods, which has 'self' as one of its input parameters. I have a DTML method, which sets up a table using one Python method to create the table headers (the first row) and another Python method to create the table data (one row per result set). I think my problem can be solved (maybe) by asking how to call a python method from DTML when 'self' is one of the arguments expected... Here's a rough idea of my DTML method: <table> <tr> <dtml-let classcode="52.225"> * just for testing the 2nd python method directly <dtml-var index_table_headers> * python method returning first row </tr> <dtml-in get_matrics_from> *return a list of matric numbers (will be used as an argument for next python method). <tr> *** what here to get result(s) from 'final' method using matric and classcode as arguments? *** </tr> </dtml-in> </table> I've *called* other methods, where self has been in the parameter list without specifying it but in these cases it was the only parameter and there was nothing being returned. Now, most of my errors are 'not enough arguments; expected 3'. I'm hoping that some sleep, some coffee, a reply or a combination of the three will give me the answer! Thanks a lot, Lee Here's the Python method (pretty disgusting looking but I'll clean it later ;-) : Python method 'final' with parameters 'self, matric, classcode' --------------------------------------------------------------- table="class" + string.replace(`classcode`, ".", "") table=string.replace(table, "'", "") db_conn = self.Gadfly_database_connection() SQL = ("select practicals, assignments, tutorials, bonus from classes where classcode = " + classcode) result=db_conn.query(SQL) resultString = `(result[1])` length = len(resultString) # To take away the last 2 brackets i=length-1 x= "" while (i>1): x=x+resultString[length-1-i] i=i-1 # To take away the first 2 brackets newLength=len(x) j=newLength-1 y= "" while (j>1): y=y+x[j] j=j-1 # To invert the string i=len(y)-1 z="" while (i>=0): z=z+y[i] i=i-1 components = string.split(z) p = string.atoi(string.replace(components[0], ",", "")) a = string.atoi(string.replace(components[1], ",", "")) t = string.atoi(string.replace(components[2], ",", "")) b = string.atoi(components[3]) px=p ax=a tx=t bx=b db_conn = self.Gadfly_database_connection() SQL= "select " i=1 while (i<=p): SQL = SQL + "p" + `i` + ", " i=i+1 i=1 while (i<=a): SQL = SQL + "a" + `i` + ", " i=i+1 i=1 while (i<=t): SQL = SQL + "t" + `i` + ", " i=i+1 i=1 while (i<=b): SQL = SQL + "b" + `i` + ", " i=i+1 SQL= SQL + " uname, fname, lname from " + table + " where matric = " + matric result=db_conn.query(SQL) resultString = `(result[1])` length = len(resultString) # To take away the last 2 brackets i=length-1 x= "" while (i>1): x=x+resultString[length-1-i] i=i-1 # To take away the first 2 brackets newLength=len(x) j=newLength-1 y= "" while (j>1): y=y+x[j] j=j-1 # To invert the string i=len(y)-1 z="" while (i>=0): z=z+y[i] i=i-1 components = string.split(z) length=len(components) dic = {} control=0 p = px a = ax t = tx b = bx while (p!=0): tempDic = {('p'+`control+1`): string.atoi(string.replace(components[control], ",", ""))} dic.update(tempDic) p=p-1 control=control+1 while (a!=0): tempDic = {('a'+`control+1-px`): string.atoi(string.replace(components[control], ",", ""))} dic.update(tempDic) a=a-1 control=control+1 while (t!=0): tempString = string.replace(components[control], ",", "") tempString1 = string.replace(tempString, '"', '') tempString2 = string.replace(tempString1, "'", "") tempDic = {('t'+`control+1-px-ax`): `(tempString2)`} # tempDic = {('t'+`control+1-px-ax`): `(components[control])`} dic.update(tempDic) t=t-1 control=control+1 while (b!=0): tempDic = {('b'+`control+1-px-ax-tx`): string.atoi(string.replace(components[control], ",", ""))} dic.update(tempDic) b=b-1 control=control+1 lname = string.replace(components[length-1], ",", "") fname = string.replace(components[length-2], ",", "") uname = string.replace(components[length-3], ",", "") lname = string.replace(lname, "'", "") fname = string.replace(fname, "'", "") uname = string.replace(uname, "'", "") HTML = '<td><input type="checkbox" name="' + matric + '" value="true">' + matric + '</td>\n' HTML = HTML + '<td>' + fname + '</td>\n' HTML = HTML + '<td>' + lname + '</td>\n' HTML = HTML + '<td><a href="mailto:+ ' + uname + '@cs.strath.ac.uk">' + uname + '@cs.strath.ac.uk</a></td>\n' p = px a = ax t = tx b = bx while (p!=0): key="p"+`px-p+1` value = dic[key] HTML=HTML + '<td>' + `value` + '</td>\n' p=p-1 while (a!=0): key="a"+`ax-a+1` value = dic[key] HTML=HTML + '<td>' + `value` + '</td>\n' a=a-1 while (t!=0): key="t"+`tx-t+1` value = string.replace(dic[key], "'", "") HTML=HTML + '<td>' + `value` + '</td>\n' t=t-1 while (b!=0): key="b"+`bx-b+1` value = dic[key] HTML=HTML + '<td>' + `value` + '</td>\n' b=b-1 return HTML

1 1

dtml-tree causing authorization errors
by yves＠njc.ch 23 Jan '01

23 Jan '01

I've stumbled upon a strange problem with dtml-tree in version 2.2.5 (the problems occurs in the same way in any of the 2.2.x version), but didn't exhibit itself in 2.1.6: Here's some (very) crude code to generate a tree object: ------------- class Tree: def __init__(self, val='top'): self.name = val self.tpId = val def tpValues(self): tlist = [] for i in range(8): tlist.append(Tree('me: %s' % i)) return tlist def build(): return Tree() -------------- Now if I attach this to an "External Method" called "mytree" which references the function "build()", and I write the following DTML: ----- <dtml-tree mytree> <dtml-var name> </dtml-tree> ----- In version 2.1.6, I obtain a tree, it's composed of 8 items and each expands into 8 more, etc... If I do the same thing in version 2.2.5, I get an authentication failure... even though I'm logged on as superuser or an admin user... I've tried this on a fresh install to ensure nothing gets in the way. The error I get is: ------------ Zope Error Zope has encountered an error while publishing this resource. Unauthorized Sorry, a Zope error occurred. Traceback (innermost last): File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/OFS/DTMLMethod.py, line 172, in __call__ (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 154, in render (Object: glu) File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 260, in tpRender File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 514, in tpRenderTABLE (Info: (['top', []], {'id': 'tpId', 'childless_decoration': '', 'name': 'glu', 'branches': 'tpValues', 'url': 'tpURL', '': 'glu'}, (['top', []],), (['top', []],))) File /home/zope/Zope-2.2.5-src/lib/python/TreeDisplay/TreeTag.py, line 431, in tpRenderTABLE File /home/zope/Zope-2.2.5-src/lib/python/OFS/DTMLMethod.py, line 194, in validate (Object: toto) File /home/zope/Zope-2.2.5-src/lib/python/AccessControl/SecurityManager.py, line 139, in validate File /home/zope/Zope-2.2.5-src/lib/python/AccessControl/ZopeSecurityPolicy.py, line 159, in validate Unauthorized: name

1 0

Limited folderish objects
by Nolan Darilek 23 Jan '01

23 Jan '01

The Folder class offers quite a bit of the functionality which I need for a current project. However, what I'm attempting to create isn't a traditional folder for DTML objects, methods, etc. Instead, I'm creating a folder which contains subfolders which are intended for specific objects. The "available objects" list in the parent folder should only allow the creation of a certain type of object. So, how can I do this? I was told that I could modify the permissions on the folder to prevent other objects from being added, and this seems to be confirmed by what I managed to find out about filtered_meta_types, but I'm not sure. Can anyone offer any advice? Thanks.

1 0