October 2001 - Zope - Zope lists

SECURITY ALERT: Hotfix for dtml format method checking
by Brian Lloyd 01 Oct '01

01 Oct '01

Hello all, Shane Hathaway recently identified a potential security issue in Zope that could affect sites that let untrusted users write DTML code. The issue affects Zope versions 2.2.0 through 2.4.1. The issue involves the "fmt" attribute of dtml-var tags. Without this correction, Zope does not check security access to methods invoked through "fmt". This issue could allow partially trusted users with enough knowledge of Zope to call, in a limited way, methods they would not otherwise be allowed to access. We highly recommend that any Zope site running Zope 2.2.0 through Zope 2.4.1 have this hotfix product installed to mitigate the issue. Zope 2.4.2 will contain a fix for the issue, at which time the hotfix can be removed. http://www.zope.org/Products/Zope/Hotfix_2001-09-28/README.txt http://www.zope.org/Products/Zope/Hotfix_2001-09-28/Hotfix_2001-09-28.tgz Brian Lloyd brian(a)zope.com Software Engineer 540.361.1716 Zope Corporation http://www.zope.com

1 0

zope technical summary?
by seb bacon 01 Oct '01

01 Oct '01

I need to present some technical blurb to a partner, who in turn will present it to potential clients. He would like to be able to hand it to people who make Technical Decisions in order to field off any awkward questions, and generally make them feel Contented. The kind of thing I've got in mind to draw up includes entity diagrams, prose which glosses over the ZODB (irrational people are suspicious of it ;) in favour data connectors, emphasis on standards, and a whole section on ZEO, since words like 'massive scaleability' are easier to slip into a sentence in that context. Has anyone done something like this before? seb

1 0

New Tab Bar product
by Kevin Lewandowski 01 Oct '01

01 Oct '01

Hi, All. I've seen a few people post about this in the past. And I just recently had the need for a Tab Bar so I created a product for it (it was a great way to learn ZClasses too!) This let's you create tab bars similar to those in the Zope management interface. Except they are 100% HTML-based; no rounded corner graphics. And the colors are confugurable. http://www.zope.org/Members/kevinsl/tabbar regards, Kevin __________________________________________________ Do You Yahoo!? Listen to your Yahoo! Mail messages from any phone. http://phone.yahoo.com

1 0

RE: [Zope] Different row colors
by Meilicke, Scott 01 Oct '01

01 Oct '01

I'm guessing what is happening is the <dtml-in ebird> is creating a list, then the <dtml-if "end_date > ZopeTime()...> bit is filtering out some of your entries, causing evens and odds to be next to each other. While I haven't done this, you may be able to build your list based off of your <dtml-if> criteria and store it in another, then display based on the new list using a fresh <dtml-in> statement. Here's an example from: http://www.zope.org/Members/lstaffor/Breadcrumbs. It filters out stuff that the user isn't authorized to see, puts that into a list (rev), then iterates over the list.  <dtml-call "REQUEST.set('rev', [])"> <dtml-in PARENTS skip_unauthorized> <dtml-let item=sequence-item> <dtml-call "rev.insert(0, item)"> </dtml-let> </dtml-in> <dtml-in rev> <dtml-with sequence-item> <a href="<dtml-var absolute_url>"> <dtml-if "hasProperty('nickname')"><dtml-var nickname><dtml-else><dtml-var title_or_id></dtml-if></a> </dtml-with> <dtml-unless sequence-end> >  </dtml-unless> </dtml-in>  Scott -----Original Message----- From: Todd Loomis [mailto:tloomis@dmso.mil] Sent: Monday, October 01, 2001 12:53 PM To: zope(a)zope.org Subject: [Zope] Different row colors All: I'm trying to create two different background colors for my rows. Here is what I'm currently using: <dtml-var standard_html_header> <h2>News Briefs</h2> <table cellpadding="5" cellspacing="0" border="0" width="100%"> <dtml-with "ebird"> <dtml-in "objectValues('Ebird')" sort=display_order> <dtml-if expr="end_date > ZopeTime() and start_date <= ZopeTime()"> <dtml-if sequence-even> <tr> <td class="whitebody"><a href="ebird/<dtml-var id>"><dtml-var title></a></td> </tr> <dtml-else> <tr> <td class="graybody"><a href="ebird/<dtml-var id>"><dtml-var title></a></td> </tr> </dtml-if> </dtml-if> </dtml-in> </dtml-with> </table> <dtml-var standard_html_footer> But this seems to group some of the backgrounds together when I want to have every other row a different color (white, gray). Can this be done another way? Thanks, Todd _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

using a variable plus attribute inside a DTML-CALL
by Mitchell Model 01 Oct '01

01 Oct '01

I am constructing a URL for a redirection based on a variable 'arg' in the REQUEST. I can use that variable in a DTML-CALL, as follows (helped by discussions I found at NIP from a while ago in this list, e.g. http://zope.nipltd.com/public/lists/zope-archive.nsf/242bb7cc2b2c343d802568…) <dtml-call expr="RESPONSE.redirect('http://www.zope.org/SiteIndex/search?text_content=' + arg)"> However, I want to url_quote_plus the arg. The usual variable attribute syntax (either <dtml-var arg.url_quote_plus> or &dtml.url_quote_plus.arg;) isn't available inside the Python expression in the dtml-call. Without creating an external method to do the quoting, how can I get the quoted version of the variable inside the Python expression? I've tried lots of different ideas, but none worked.

1 0

Different row colors
by Todd Loomis 01 Oct '01

01 Oct '01

All: I'm trying to create two different background colors for my rows. Here is what I'm currently using: <dtml-var standard_html_header> <h2>News Briefs</h2> <table cellpadding="5" cellspacing="0" border="0" width="100%"> <dtml-with "ebird"> <dtml-in "objectValues('Ebird')" sort=display_order> <dtml-if expr="end_date > ZopeTime() and start_date <= ZopeTime()"> <dtml-if sequence-even> <tr> <td class="whitebody"><a href="ebird/<dtml-var id>"><dtml-var title></a></td> </tr> <dtml-else> <tr> <td class="graybody"><a href="ebird/<dtml-var id>"><dtml-var title></a></td> </tr> </dtml-if> </dtml-if> </dtml-in> </dtml-with> </table> <dtml-var standard_html_footer> But this seems to group some of the backgrounds together when I want to have every other row a different color (white, gray). Can this be done another way? Thanks, Todd

1 0

Catalog Aware
by Sidnei da Silva 01 Oct '01

01 Oct '01

Anyone has some tutorial or code snippet n how to implement a Python-based Catalog Aware product? -- Sidnei da Silva X3ng Consultoria e Desenvolvimento Ltda. sidnei(a)x3ng.com.br

1 0

ZODB Caching Questions
by Martin Gfeller 01 Oct '01

01 Oct '01

Dear ZOPE experts, I have some (newbie) questions on ZODB and its caching mechanism: We're using a number of ZODBs to store financial deal objects and assorted static data objects. A reference to each object in a database is kept in a 'root' object, which is a PersistentMapping. 1. If objects are referenced from a root object, they can never be deallocated, because at least one reference is always kept. Is this so, and what are alternative ways to do it? 2. If an object is a simple Python object, instead of being derived from Persistent, cache control never seems to touch it. Is this correct? 3. If I change our code so that the class is now derived from Persistent, I cannot load the existing objects that were saved before. Is there any simple workaround for this? 4. The cache statistics cache_mean_deal and cache_mean_deac never seem to show anything else than 0.0, despite tracing shows that deactiviations occur. Any hints appreciated. Best regards, Martin Gfeller, mailto:martin.gfeller@comit.ch, +41 1 298 9284 COMIT Gruppe, http://www.comit.ch Risk Advice Services, http://www.quantax.com

1 0

Deleting an object from python (command line)
by Gilles Lenfant 01 Oct '01

01 Oct '01

Hi, I made a buggy access rule at the root of ZODB that makes the ZMI unreachable (error in Python script) I want to delete this accessrule so I stopped Zope and % cd $ZOPEROOT/lib/python % $ZOPEROOT/bin/python >>> import Zope >>> app = Zope.app() >>> dir(app) [..., 'accessrule'...] >>> app.manage_delObjects(['accessrule']) >>> dir(app) [...] # no more "accessrule" >>> ^D but 'accessrule' is STILL HERE ! When I do again : % $ZOPEROOT/bin/python >>> import Zope >>> app = Zope.app() >>> dir(app) [..., 'accessrule'...] # Thought it was deleted !!! Did I miss something ? Is there a "commit" like to do before quitting python? Thanks in advance --Gilles

1 0

RE: Usersession - how to get one sessionid per open browser?
by Jean Jordaan 01 Oct '01

01 Oct '01

Hi Etienne > When I open a different browser from a link in one of my pages > <a href="newPage" target="_blank" . . .) The browser windows are indistinguishable to the remote server unless you give it some way of distinguishing between HTTP transactions from the different windows. AFAICS, there are two ways of accomplishing this: using URL-based session management, or using hidden form variable session management. Cookie-based session management isn't going to distinguish between browser windows. Here are a couple of links that might be useful: - http://zdp.zope.org/portals/developers/sessionmanagement/hsm - http://www.zope.org/Members/Duncan/SessionURLs - http://www.zope.org/Members/czimmet/CookieLess If you use URL-based session tracking, your URL above becomes something like <a href="newPage?s__=as983wkj32" target="_blank" . . .> where s__=as983wkj32 is the session ID. (Disclaimer: I haven't actually *done* any of the above ;) Regards, Jean PS You might want to consider switching off HTML email when posting to the mailing list ..

1 0