June 2001 - Zope - Zope lists

Re: [Zope] python script turned into a dtml document
by Luby Liao 04 Jun '01

04 Jun '01

Michael (and Chris), thank you very much for the enlightment. cheers, Luby > On 03 Jun 2001 17:42:51 -0700, Luby Liao wrote: > > > > Just noticed that, after editing two python scripts in xemacs and > > saving them, they turned into dtml documents. How do I prevent this > > from happening? cheers, Luby > > quick fix: turn off backup files for EFS. > (setq efs-make-backup-files nil) in you .emacs file should do the trick. > > long answer: whenever you save a fgile in an emacs session, emacs > renames the original file to filename.~<version>~ and creates the file > <filename>. Since Zope assumes that a newly created file is a DTML > document, all your files will be transformed into DTML Documents. > > Since there is no use for emacs version control in Zope (undo is part of > zope) and i only use EFS editing for Zope file this quick fix is okay > for me. The only correct thing to do is to make efs-make-backup-files > not only OS dependet, but also considere regexp'ing the FTP server name. > > -- > Michael Lausch > See my web page <http://www.lausch.at/> or query PGP key server for PGP > key. > "Reality is that which, when you stop believing in it, doesn't go away". > -- Philip K. Dick > Just noticed that, after editing two python scripts in xemacs and > saving them, they turned into dtml documents. How do I prevent this > from happening? cheers, Luby Turn of the 'make a backup file' option. cheers, Chris

1 0

Zope as NT Service
by Montagne, Michael 04 Jun '01

04 Jun '01

When installing zope, I chose to not run Zope as a service. Now I want to change my mind. How do I start Zope as a service and avoid the DOS window? -mjm

2 1

Method vs. Doc.
by Jason C. Leach 04 Jun '01

04 Jun '01

hi, What's the difference between a DTML method and DTML document. And what is the difference in the handling that zope does to them? Thanks, j. ...................... ..... Jason C. Leach ... University College of the Cariboo. ..

3 4

RE: [Zope] defacement/crack statistics
by sean.upton＠uniontrib.com 04 Jun '01

04 Jun '01

Typo - that's 'rm -rf /' (or if an attacker is feeling a little more benign, they'll just deface your site)... My primary security rule: you need to be root, and you need to be informed (alerts, mailing lists - set a reminder in your PIM software to check security bulletins on lwn.net every thursday afternoon, you get the idea), if you are going to manage these things... Sean -----Original Message----- From: sean.upton(a)uniontrib.com [mailto:sean.upton@uniontrib.com] Sent: Monday, June 04, 2001 12:20 PM To: jleach(a)mail.ocis.net; zope(a)zope.org Subject: RE: [Zope] defacement/crack statistics I agree: I would be nice to write a hotfix for Zope that permits a remote 'rf -rf /' command to be executed. I I could install that hotfix through-the-web, that would be even better. ;) Kidding aside, the very reasons hotfixes exist precludes the idea of TTW implementation of hotfixes in the firstplace. The only way I would think this would be acceptable is if there was a way to hard-code it only so that localhost could do this, if even that... Sean -----Original Message----- From: Jason C. Leach [mailto:jleach@mail.ocis.net] Sent: Monday, June 04, 2001 10:35 AM To: zope(a)zope.org Subject: Re: [Zope] defacement/crack statistics hi, An automated 'hotfix' management system would be a really good tool to implement in Zope. Perhaps a simple button in the Control Panel to fetch and install the latest hotfixes. j. ...................... ..... Jason C. Leach ... University College of the Cariboo. .. On Mon, 4 Jun 2001, Michel Pelletier wrote: > On Sun, 3 Jun 2001 kosh(a)aesaeion.com wrote: > > > Does anyone have any statistics on how often zope servers tend to get > > cracked? I have been looking on line and so far I have found no data on > > that. Either there has not been one which is unlikely or they are > > extremely rare which is more likely considering the ACL system. > > > > Need some information for customers and these kinds of numbers would be > > very useful. > > I've been around since the pre-Zope, and I also help do commercial support > for DC. I have never once heard from the community, or from a customer, > of any successful or unsuccessful crack of Zope. I, like you, would be > very interested to hear of one. > > Of course it can happen, there are well known exploits for older versions > of Zope, three major ones in the last year and a half, if memory serves > right. All of those exploits were fixed the same day they were reported, > often within hours, and new versions and security updates for older > versions were released, so even if there is an older version and the > maintainer patched it with a hotfix, it's safe (from the known exploit). > > Most explits (as far as I know) are discovered by community members in the > course of their experimentation with Zope. This is one of the greatest > strengths of open source. Of course, there's nothing like a full blown > security audit, but them again, there's nothing like roasting hot > dogs over large piles of burning money either. > > -Michel > > > > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev ) _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

RE: [Zope] defacement/crack statistics
by sean.upton＠uniontrib.com 04 Jun '01

04 Jun '01

I agree: I would be nice to write a hotfix for Zope that permits a remote 'rf -rf /' command to be executed. I I could install that hotfix through-the-web, that would be even better. ;) Kidding aside, the very reasons hotfixes exist precludes the idea of TTW implementation of hotfixes in the firstplace. The only way I would think this would be acceptable is if there was a way to hard-code it only so that localhost could do this, if even that... Sean -----Original Message----- From: Jason C. Leach [mailto:jleach@mail.ocis.net] Sent: Monday, June 04, 2001 10:35 AM To: zope(a)zope.org Subject: Re: [Zope] defacement/crack statistics hi, An automated 'hotfix' management system would be a really good tool to implement in Zope. Perhaps a simple button in the Control Panel to fetch and install the latest hotfixes. j. ...................... ..... Jason C. Leach ... University College of the Cariboo. .. On Mon, 4 Jun 2001, Michel Pelletier wrote: > On Sun, 3 Jun 2001 kosh(a)aesaeion.com wrote: > > > Does anyone have any statistics on how often zope servers tend to get > > cracked? I have been looking on line and so far I have found no data on > > that. Either there has not been one which is unlikely or they are > > extremely rare which is more likely considering the ACL system. > > > > Need some information for customers and these kinds of numbers would be > > very useful. > > I've been around since the pre-Zope, and I also help do commercial support > for DC. I have never once heard from the community, or from a customer, > of any successful or unsuccessful crack of Zope. I, like you, would be > very interested to hear of one. > > Of course it can happen, there are well known exploits for older versions > of Zope, three major ones in the last year and a half, if memory serves > right. All of those exploits were fixed the same day they were reported, > often within hours, and new versions and security updates for older > versions were released, so even if there is an older version and the > maintainer patched it with a hotfix, it's safe (from the known exploit). > > Most explits (as far as I know) are discovered by community members in the > course of their experimentation with Zope. This is one of the greatest > strengths of open source. Of course, there's nothing like a full blown > security audit, but them again, there's nothing like roasting hot > dogs over large piles of burning money either. > > -Michel > > > > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Re: [Zope] Dreamweaver
by dave＠kovach.com 04 Jun '01

04 Jun '01

Hi David, After some work with it and frustration I opted for using HomeSite 4.5 and the Zope extensions product and ftp access into the ZODB. Its a more flawless solution that will leave you less frustrated and getting more done - rather than trying to deal with Dreamweavers issues. Sincerely, David Kovach On Mon, 04 June 2001, CURTIS David wrote: > > Hi, > > I want to use dreamweaver to create a web site. How does one combine this product to zope? Having looked through the help files, it seems the extension .jpg can be a problem due to dhtml object code. I found some web pages that say it is currently being developed. Anyone doing this and what are your results? > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

[ANN] ZShell 1.2
by Jerome Alet 04 Jun '01

04 Jun '01

Hi, I'm pleased to announce the availability of ZShell 1.2 ZShell is an external Zope method which allows you to manipulate the ZODB using standard unix shell's commands from within Zope's Management Interface in your web browser. ZShell is the Swiss Army's Knife of the Zope Manager. ZShell is licensed under the GNU General Public Licence, with some clarifications of my own concerning it's use with Zope. You can download it from: http://cortex.unice.fr/~jerome/zshell/ New features are: ================= Some options may now be specified multiple times, and option arguments may use wildcards too, for examples look at grep's or find's documentation, or at this one: find / --id "*html" --id "!index_*" --type "DTML*" --type File --exec "catalog {}" (all on a single line): this will recursively catalog all objects which meta type begins with "DTML" or is File, which id ends in "html" but not those which id begins with "index_" This is just the sort of things you'll be able to do, but I'm confident that your own imagination can invent very complex commands to solve your particular problems. find's --user option was renamed to --owner find's --name option was renamed to --id Some options, actually --type and --owner in grep and find, and --id in find, now accept NOTarguments of the form: !arg, which can contain wildcards too. Bug fix with regard to special meta types handling (ZClasses) Better error handling in cp/mv/cut/copy/paste. Better output in cp/mv/paste. history now accepts a --clear option to empty the .zshell_history DTML Document, if allowed. history accepts multiple --user arguments to list only those commands run by the specified users (NOTarguments are allowed too). grep now accepts a --maxdepth option to be optionally used when the --recurse option is given. grep now accepts --owner, --mmin, --mtime, and --newer options, just like find. Both find and grep now accept a --older option, which works just like --newer. Overflow error fixed. What's cool ? ============= What you'll probably find very useful is the possibility to use NOTarguments in some commands arguments and some command options arguments. a NOTargument is a normal argument prefixed with a '!' character, meaning NOT. Read find and grep help for examples on how to use them: you'll like it ! Another interesting option is the new --older option for both grep and find, which will allow you, used with --newer, to search (in) and/or modify objects modified between the modification times of two other objects The third interesting thing is that now it will be easier for me to make other powerful commands like grep and find, since now they both use the same matching methods internally. The near future: ================ I'll probably add lots of options to the ls command, just to complete the find/grep duo, but I think the other commands finally may not need all this bunch of options, since you can use the find's --exec option to do very complicated things. Credits: ======== Thanks to Peter Bengtsson for his help. Hoping you'll find it more useful than ever. feel free to send me any feedback. bye, Jerome Alet

2 2

RE: [Zope] OS Error 24: Too many files open
by Astheimer, David (GXS) 04 Jun '01

04 Jun '01

Hi... Thanks for the reply. Actually, I'm using the most simple and streamline "vanilla" installation right out-of-the-box. I've not installed any additional products. I've not created any catalogs. Just simple document storage and retrieval. Regards, Dave -----Original Message----- From: Erik Enge [mailto:erik@thingamy.net] Sent: Monday, June 04, 2001 11:08 AM To: Astheimer, David (GXS) Cc: zope(a)zope.org Subject: Re: [Zope] OS Error 24: Too many files open On Mon, 4 Jun 2001, Astheimer, David (GXS) wrote: > Are long-standing temporary files a typical Zope signature? Not long-standing. Are you running any custom products? (Maybe something like ThreadSafeCounter?) Are you indexing a lot of stuff? I just saw Chris Withers mention that Zope writes big indexes to files so not to hog much memory... could be something like that?

1 0

Re: [Zope] Dreamweaver
by Tim Cook 04 Jun '01

04 Jun '01

CURTIS David wrote: > > Hi, > > I want to use dreamweaver to create a web site. How does one combine this product to zope? Having looked through the help files, it seems the extension .jpg can be a problem due to dhtml object code. I found some web pages that say it is currently being developed. Anyone doing this and what are your results? > Try here: http://zope.nipltd.com/public/lists/zope-archive.nsf/Main?SearchView=++&Que… -- Tim Cook, President - FreePM,Inc. http://www.FreePM.com Office: (731) 884-4126 ONLINE DEMO: http://www.freepm.org:8080/FreePM

1 0

Dreamweaver
by CURTIS David 04 Jun '01

04 Jun '01

Hi, I want to use dreamweaver to create a web site. How does one combine this product to zope? Having looked through the help files, it seems the extension .jpg can be a problem due to dhtml object code. I found some web pages that say it is currently being developed. Anyone doing this and what are your results?

1 0