March 2001 - Zope - Zope lists

SECURITY ALERT and Zope hotfix release [2001-03-08]
by Brian Lloyd 09 Mar '01

09 Mar '01

Hello all - An issue has come to our attention (thanks to Randy Kern) that necessitates a Zope hotfix. Hotfix products can be installed to incorporate modifications to Zope at runtime without requiring an immediate installation upgrade. Hotfix products are installed just as you would install any other Zope product. This hotfix (Hotfix_2001-03-08)addresses an important security issue that affects Zope version 2.3.0 and the current 2.3.1 beta 1 release. The issue involves an error in the 'aq_inContextOf' method of objects that support acquisition. A recent change to the access validation machinery made this bug begin to affect security restrictions. The bug, with the change to validation, made it possible to access Zope objects via acquisition that a user would not otherwise have access to. This issue could allow users with enough internal knowledge of Zope to perform actions higher in the object hierarchy than they should be able to. We *highly* recommend that any Zope site running Zope 2.3.0 final or any alpha or beta version of 2.3.0 or 2.3.1 beta 1 have this hotfix product installed to mitigate the issue. Zope 2.3.1 beta 2 will contain a fix for the issue, at which time the hotfix can be removed. Zope versions prior to 2.3.0 are not affected by this issue. - http://www.zope.org/Products/Zope/Hotfix_2001-03-08/README.txt - http://www.zope.org/Products/Zope/Hotfix_2001-03-08/Hotfix_2001-03-08.tgz Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

[Fwd: Amphora light 2.2.26]
by Ross Lazarus 09 Mar '01

09 Mar '01

Not sure why this hasn't yet made the zope list... I just had a quick look and the demo is very nice looking. I haven't tried installing it - it's targetted at RH6.2 and needs PostgreSQL,Apache,OpenSSL,Sendmail,IMAP,QMail and relies on rpm's for normal installation. -------- Original Message -------- Subject: Amphora light 2.2.26 Date: Mon, 05 Mar 2001 15:59:11 +0200 From: Tanel Tammet <tanel(a)cs.ioc.ee> Organization: Baymountain To: python-announce(a)python.org CC: hannu(a)itmeedia.ee Newsgroups: comp.lang.python.announce Amphora Light 2.2.26 - a www-based groupware server Amphora Light (http://www.amphora.ee/freeware/) is a free open-source www-based groupware server in Python and Zope, offering basic office functionality: calendars, tasks, contacts, discussion, web email in the context of a hierarchical organisation and flexible access rights. Both Netscape and MS IE are supported as clients. It supports synchronization with MS Outlook calendar, tasks, contacts through a separate MS Windows client. Amphora is built upon the following components: Linux, Apache, MOD_SSL, PostgreSQL, Bsddb, Zope, Python, Mozilla cryptolibrary. Amphora light is a limited version of Amphora, a comprehensive commercial groupware/document management product for Linux by IT Meedia, containing also document-, project- and message management, as well as a simple interface for creating new database tables. Amphora supports ASP functionality (separate clients and quotas). integration with MS Windows and electronic signatures through a separate client. Amphora is currently being extended towards full CRM functionality. For more information, have a look at the Amphora light webpage: http://www.amphora.ee/freeware/ Amphora light is released under combined Mozilla Public Licence and Sun Community Source Licence analogues. <P><A HREF="http://www.amphora.ee/freeware/">Amphora light 2.2.26</A> - www-based groupware server (01-Mar-2001) Tanel Tammet tanel(a)itmeedia.ee

1 0

cast insensitive sorts using <dtml-in>?
by Geoffrey L. Wright 09 Mar '01

09 Mar '01

This question is, how do I do this? I seems link an obvious thing to be able to do, but the only thing I've been able to come up with is: http://www.zope.org/Members/andym/IgnoreCase Is this really the only way to go about this? And if so, does anybody know if this patch works against 2.3? Thanks, //glw

3 2

Re: [Zope] FTP and 2.3.0
by Stephan Goeldi 09 Mar '01

09 Mar '01

Yes, that was it. Thank you very much! >From: Jim Washington <jwashin(a)vt.edu> >Make sure you are not running in debug mode (-D). _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

1 0

Problems with :date tag
by Stefano 09 Mar '01

09 Mar '01

Hello It was my intention to use the :date tag in <input type> to have Zope throw exceptions if the user inputed a wrong date. However, this tags seems to work only for dates in english format mm.dd.yyyy. Is it possible to have it working in dd.mm.yyyy? If yes, how? Thanks and regards Stefano Vedovelli

1 0

system calls
by Arenz, Ralph 09 Mar '01

09 Mar '01

Hi, i' am using external methods in zope and in this external methods (python module(s)) i try to do a system call via the module os. A little more concrete: 1) assume that the the python module is foo. 2) In Zope i have defined the external method call_pdflatex in the module foo 3)The system command in foo is: os.system( 'pdflatex -interactions= '"nonstopmode"' [path]') 4)The Folders which resides on the filesystem (linux)have the right group and user adjustments according to that of Zope. 5)Starting python the interactive way(as root or as ather user) and testing the system-call will return the right result. 6)Also positiv is to call a system command which causes no fileoperation like 'ping' or 'echo' form Zope via external method As you can see in point 5 it is no problem by python e.g no permissions to write to a file or a folder. In fact it is a Zope problem (I suppose !). Is there a way to grant a permission to Zope (External Method Product) to allow system calls ?? Can anybody help me ? I'am running out of ideas. Ralph

2 1

non-root managers can remove products
by Randall F. Kern 09 Mar '01

09 Mar '01

Maybe this is how it's supposed to work, but I'm not sure. root a acl_users bob, role manager Now goto http://yourserver.com/a/Control_Panel/manage_main. Log in as bob. The page is displayed, and some of the options work, like you can remove products. Is this a bug or a misunderstanding on my part? -Randy

3 2

[WISH] adding users from pythonscript
by Jerome Alet 09 Mar '01

09 Mar '01

Hi, I want to add users from pythonscript without having to pass a REQUEST , which would mean being redirected. It doesn't seem to be possible. Am I right ? Is the only possible way using external methods ? <WISH VALUE="+10"> Why the hell the fact of having a REQUEST and using Zope's management interface seem to be so bound together ? This prevents people from using some powerful management methods from their own code, because the decision to redirect the browser to another page in the management interface is done based on the presence of REQUEST. See for example acl_users.manage_users() (_addUser is not callable from pythonscript) If all the Zope management forms included an hidden "__redirectme__" (or something like that) parameter, this would allow the better of two worlds: Zope management methods would be callable in all situations, provided they would be modified to act depending on this parameter being present in REQUEST or not. Am I the only one who finds this very bad ? </WISH> bye, and thanks in advance for any help. Jerome Alet - alet(a)unice.fr - http://cortex.unice.fr/~jerome Fac de Medecine de Nice http://wwwmed.unice.fr Tel: (+33) 4 93 37 76 30 Fax: (+33) 4 93 53 15 15 28 Avenue de Valombrose - 06107 NICE Cedex 2 - FRANCE

1 0

FTP and 2.3.0
by Stephan Goeldi 09 Mar '01

09 Mar '01

Whenever I try to FTP into my Zope 2.3.0, Zope crashes. I have to restart it then. Before, there was 2.2.5 with multiple domains (SiteRoot) without any problems. Is this a known issue? _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

2 1

Re: [Zope] Telnet to Port 8080
by Tino Wildenhain 09 Mar '01

09 Mar '01

Hi Karthick, you will the specification how to encode authentication information in rfc2616 (www.faqs.org) Basically is a base64 encoded string consisting of username:password Regards Tino karthick ramanarayanan wrote: > > Hi, > The telnet worked with 2 Enter keystrokes,which was anytime simpler than > the Host and the connection information with HTTP/1.1. > But how do I pass on the Authentication Header information also along with > the GET request. > Is there a way out.I need to fetch the source,from my program > to create a local cache and to do some HTML parsing. > Bye, > A.R.Karthick(A.R.K) > > > Hi, > > > > Wolfgang Strobl wrote: > > > > > > On 8 Mar 2001, at 23:03, Tino Wildenhain wrote: > > > > > > > Hi karthick, > > > > > > > > if your Zope is running on port 8080, you should either use: > > > > > > > > GET / HTTP/1.0[enter][enter] > > > > > > > > or more precisely: > > > > > > > > GET / HTTP/1.1[enter]Host: yourhost[enter]connection: > > > > close[enter][enter] > > > > > > > > > > > > This is because Zope does not support HTTP/0.9 > > > > > > telnet localhost 8080 > > > > > > GET /[enter}[enter] > > > > > > HTTP/1.0 200 OK > > > Server: Zope/Zope 2.3.1b1 (binary release, python 1.5.2, win32- > > > x86) ZServer/1.1b > > > 1 > > > Date: Fri, 09 Mar 2001 07:47:48 GMT > > > Content-Type: text/html > > > Content-Length: 2746 > > > ... > > > > Oh, indeed? Ok, so it _does_ support HTTP/0.9 and Karthick forgot to > > press his enter key twice ;) > > > > > > > > > > > > HTH > > > > Tino Wildenhain > > > > > > > > karthick ramanarayanan wrote: > > > > > > > > > > Why Am I not able to telnet to port 8080 and do a , > > > > > GET / like you do on port 80. > > > > > It just hangs. > > > > > Whats the problem. > > > > > Bye, > > > > > A.R.Karthick > > > > _______________________________________________ > > Zope maillist - Zope(a)zope.org > > http://lists.zope.org/mailman/listinfo/zope > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://lists.zope.org/mailman/listinfo/zope-announce > > http://lists.zope.org/mailman/listinfo/zope-dev ) > >

2 1