February 2002 - Zope

Choose propper view permission / How to build a secure Site? (long)
by Peter Ehrenberg 18 Feb '02

18 Feb '02

Dear Readers! There is a (IMHO) subtile difference in respect to the view permission between DTML documents and DTML methods (this is true at least for Zope 2.5.0): If you insert into index_html the content of one DTML document and one DTML method, you need view permission for the method but not necessarily for the document. On the other hand you don't need access-contents-information permission for the method. (I don't know which operation on the method require this permission) Why? Now the long description. Imagine the following object tree: root | +- myFolder | | ~ ... +- index_html ~ | +- mySubfolder1 | | | +- myDocument | +- mySubfolder2 | | ~ ... +- myDocument ~ | +- mySubfolderN | | | +- myDocument | +- myMethod | ~ ... ~ There is the DTML method index_html. It's responsible (per acquisition) to view the content of one of the myDocument documents from one of the mySubFolder1..N folders. It also use myMethod. Both myDocument and myMethod are inserted into index_html via <dtml-var...>. There are N DTML documents myDocument with includes some content each in its own SubFolder. You can view one myDocument by request http://myFolder/mySubfolderX with X one of 1 until N. There is the DTML method myMethod which create some content based on the properties of the current document. So far so good. But now: How to set up strict access permissions? (In the moment I'm only talking about permissions for read access to the objects via whose URL --- a.k.a. "the third view".) The requirements to the permissions are (this is what I want): 1. index_html is viewable for anonymous. 2. Only index_html is directly viewable. So http://myFolder/mySubfolder1 until http://myFolder/mySubfolderN are the only valid urls. 3. From 2nd follows: all myDocument documents and the myMethod method must not be directly viewable but only by (or thru) index_html. So requests to http://myFolder/myMethod or http://myFolder/mySubfolderX/myDocument are not permitted. I tried this: o remove view permission from myFolder and o set view permission explicit to index_html. For my surprising this doesn't work but results into error at request http://myFolder/mySubfolderX: Error Type: Unauthorized Error Value: You are not allowed to access myMethod in this context I have to give view permission to myMethod for work around. However now, myMethod can be directly viewed via its url which shouldn't. My questions now are: 1. Why it is as it is? I mean: It is a bug or feature? 2. How to set up the objects properly, to fit the above requirements? With Respect Peter -- Dipl.-Ing. Peter Ehrenberg Tel.: (040) 756604-40 Rotenhäuser Straße 51 Fax: (040) 756604-41 21109 Hamburg Netz: http://www.dipe.de Germany mailto:pe@dipe.de

1 0

CST 0.9 Problems under load?
by Tim Hicks 18 Feb '02

18 Feb '02

Zopers and Chris, I have written a little zope app that allows people to search an oracle database thru-the-web. Relevant details: Zope 2.3.3 Win NT DC Oracle 1 CST 0.9 - used in just about every request as it provided shopping basket functionality Session timeout set to 20 mins Using ZServer (i.e. no apache/squid in front) P2 450MHz Can't remember how much RAM, but we didn't use it all. [From Analog] Day: reqs: pages: Wed: 133586: 2458: Thu: 48310: 831: Fri: 24890: 438: We launched the site last Wednesday (10am), and the little box it was running on was a bit overwhelmed. We started to see KeyErrors relating to the session data manager (more on that below), so backed off to an earlier search app that had no CST component. CPU had been running at 100% almost solidly for about half an hour, but we still had half our RAM free. At this stage, we weren't logging the errors. After the load died down a bit (the first hour was far and away the worst), we switched back to the CST'ified app. Server load was lower, and although we still weren't logging, we got the impression that the errors had gone. Sadly, the KeyErrors were spotted again. At this point, I setup standard_error_message to email me with the REQUEST and traceback whenever it caught a KeyError. That began at 5pm Wednesday. From then until 1pm Friday, I received 174 error messages of the following form: ----- <snipped REQUEST> Traceback (innermost last): File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 171, in publish File C:\PROGRA~1\zope233\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: results) File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 112, in call_object (Object: results) File C:\PROGRA~1\zope233\lib\python\OFS\DTMLMethod.py, line 189, in __call__ (Object: results) File C:\PROGRA~1\zope233\lib\python\DocumentTemplate\DT_String.py, line 540, in __call__ (Object: results) File C:\PROGRA~1\zope233\lib\python\OFS\DTMLMethod.py, line 182, in __call__ (Object: standard_html_header) File C:\PROGRA~1\zope233\lib\python\DocumentTemplate\DT_String.py, line 540, in __call__ (Object: standard_html_header) File C:\PROGRA~1\zope233\lib\python\DocumentTemplate\DT_Util.py, line 339, in eval (Object: sdm.getSessionData().has_key('your_results')) (Info: sdm) File <string>, line 0, in ? File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionDataManag er.py, line 264, in getSessionData (Object: sdm) File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionDataManag er.py, line 375, in _createSessionDataObject (Object: sdm) File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionDataConta iner.py, line 191, in set (Object: /accom2/search/sdm) File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionDataConta iner.py, line 344, in __setitem__ (Object: /accom2/search/sdm) KeyError: 64396498A0K2Wz9uuoA ----- As far as I can tell, the only difference between each of the 174 errors is a different key value (corresponding to different sessions I presume). I also received 4 of this sort: ----- Traceback (innermost last): File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 171, in publish File C:\PROGRA~1\zope233\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: results) File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 112, in call_object (Object: results) File C:\PROGRA~1\zope233\lib\python\OFS\DTMLMethod.py, line 189, in __call__ (Object: results) File C:\PROGRA~1\zope233\lib\python\DocumentTemplate\DT_String.py, line 540, in __call__ (Object: results) File C:\PROGRA~1\zope233\lib\python\OFS\DTMLMethod.py, line 182, in __call__ (Object: standard_html_header) File C:\PROGRA~1\zope233\lib\python\DocumentTemplate\DT_String.py, line 540, in __call__ (Object: standard_html_header) File C:\PROGRA~1\zope233\lib\python\DocumentTemplate\DT_Util.py, line 339, in eval (Object: sdm.getSessionData().has_key('your_results')) (Info: sdm) File <string>, line 0, in ? File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionDataManag er.py, line 258, in getSessionData (Object: sdm) File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionDataManag er.py, line 390, in _getSessionDataObject (Object: sdm) File C:\PROGRA~1\zope233\lib\python\ZODB\Connection.py, line 508, in setstate File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionStorage.p y, line 156, in load (Object: SessionStorage) KeyError: ----- <No key value given!?> As I said, the relevant REQUEST objects for each of these errors if they can help shed any light on the problems I'm seeing... just ask. In addition, I also managed to salvage this traceback from about 10.15am on Wednesday, when the CST site was getting hammered. I only saw it once, but wasn't logging at that stage... ----- Error Type: TypeError Error Value: function requires exactly 1 argument; 2 given Traceback (innermost last): File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 223, in publish_module File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 187, in publish File C:\PROGRA~1\zope233\lib\python\Zope\__init__.py, line 221, in zpublisher_exception_hook (Object: Traversable) File C:\PROGRA~1\zope233\lib\python\ZPublisher\Publish.py, line 175, in publish File C:\PROGRA~1\zope233\lib\python\Zope\__init__.py, line 235, in commit File C:\PROGRA~1\zope233\lib\python\ZODB\Transaction.py, line 300, in commit File C:\PROGRA~1\zope233\lib\python\ZODB\Connection.py, line 377, in commit (Info: (('BTrees.OOBTree', 'OOBTree'), '\000\000\000\000\000\000\000\020', '')) File C:\PROGRA~1\zope233\lib\python\Products\CoreSessionTracking\SessionStorage.p y, line 182, in store (Object: SessionStorage) File C:\PROGRA~1\zope233\lib\python\ZODB\ConflictResolution.py, line 177, in tryToResolveConflict (Object: SessionStorage) TypeError: (see above) ----- I don't really no how to try to reproduce these errors short of getting a few thousand people to access the site at the same time again. The CST site is still up and in use under much lighter load. I haven't received any of these errors since Friday lunch time, so it really does seem to be a load issue. I don't have much Zen, so to me it looks like the first error is CST not being able to find (losing?) some session information. The second one is a bit of a mystery to me, and the third looks like it might just be a bug in the way the CST code calls ConflictResolution.<some class>.tryToResolveConflict() I'd really appreciate any enlightenment anyone could give about these errors, and how to fix them. cheers tim

2 4

Zope-2.5.0 randomly restarting?
by Sven Rudolph 18 Feb '02

18 Feb '02

Hello Zope users! I have a pretty confusing problem. After several weeks of develpoment we finally kicked out our old (commercial, closed source, low support) CMS and went online with our webpage, now driven by zope. Everything works fine, the performance is great and for us programmers it's just heaven :-) But... The zope server is restarting several times a day (intervalls between 1/2 hour to 6 hours) and I can't find out how or why. We have a developement server here at the office, which is a complete mirror of our live server, and which is used for save developement of new products. This development server behaves well and restarts only if click on "Restart" on the "Control_Panel". But traffic on our dev. server is not existant (our tests only), whereas our live server produces about 12-15 megs of logfiles per day (about 60000 to 70000 requests). The only reason I can imaging is system memory. Our live server only has 512 megs RAM for 266742objects/260megsData.fs. We already ordered another GByte, but they won't arrive until next week. So I tuned down the caching parameters to "Target Size=1100" and "Target max time between accesses=60", with no effect. The server keeps restarting. Then I had a look at "top". It told me that the server never consumed more than 50% of system memory (usually only 20%, cpu load never goes beyond 20%). Sometimes the server restarts at only 10% memory. This is our configuration: Zope-2.5.0 RedHat 7.0 (with unknown modifications by our provider) 512megs RAM (waiting for another Gig) Disc space - enough cron jobs - none manager accounts - Me and my colleague (programmers) only Is this a known bug? Has zope a buildin restart function that is called on certain errors? Has zope a special error log (not Z2.log)? Has anyone the same problem? Thanks in advance for your help! Greetings Sven Rudolph

4 7

how is this in zpt?
by Daniel Meier 18 Feb '02

18 Feb '02

hi there how does this look in zpt? i couldn't figure it out? <dtml-in "objectValues('Folder')"> <IMG BORDER="0" SRC="<dtml-var icon>"> <dtml-var id> </dtml-in> best regards daniel

2 2

zope-Data.fs is growing with out adding content
by Dhanu 18 Feb '02

18 Feb '02

Hi, I installed zope and zope site on an ISP.I had provided an interface for adding and managing content for the client with out going through ZMI. The problem is site is growing even with out adding any new content to the site.It is growing almost 30 mb per day with out adding content. zope version-2.3.3 pcgi Does any one has similar problem? Please guide me if you know any answers.Thanks for your help. regards, Dhanu

2 1

Zope Syndication
by Ot Ratsaphong 18 Feb '02

18 Feb '02

Hi, I'm new to the list and new to the topic of syndication. I am interested displaying the zope news.rss on my internal zope setup. I have search through some the archives on how to render the xml file into html. Would someone point me to some information on how to display news.rss on web page. TIA, Ot

1 0

Re: [Zope] recursion in pythonscripts
by Frank Tegtmeyer 18 Feb '02

18 Feb '02

Joachim Schmitz <js(a)aixtraware.de> writes: > are there any restrictions in using recursive function calls in python > scripts ? It doesn' seem so - during development we had an endless recursion in a python script and it wasn't stopped by Zope. I had to kill the server to get out. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany Besuchen Sie uns auf der CeBIT: Halle 6, Stand F68 / 595

1 0

Re: [Zope] newbie question: restart zope remotely?
by Frank Tegtmeyer 18 Feb '02

18 Feb '02

Chris Withers <chrisw(a)nipltd.com> writes: > But tunelling it over SSH is encrypted ;-) Yes, but not easy to set up for the average Windows user. And it's not optimal - see http://sites.inka.de/sites/bigred/devel/tcp-tcp.html I admit that using a Unix system would be not easy for the avarage Windows user too :) But the effort put into finding solutions for Windows could be put into learning Unix. Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany Besuchen Sie uns auf der CeBIT: Halle 6, Stand F68 / 595

1 0

recursion in pythonscripts
by Joachim Schmitz 18 Feb '02

18 Feb '02

Hi, are there any restrictions in using recursive function calls in python scripts ? Mit freundlichen Grüßen Joachim Schmitz -------------------------------------------------------------------- AixtraWare Ingenieurbüro für Internetanwendungen Hüsgenstr. 33a, D-52457 Aldenhoven Telefon: +49-2464-8851, FAX: +49-2464-905163 -------------------------------------------------------------------- Key fingerprint = DA10 CC82 62F8 1DBB 39A1 1EDC 725B 3317 A8D7 C3A6 Keyserver: http://germany.keyserver.net/en/

1 0

Re: [Zope] Newbie URL problem
by Frank Tegtmeyer 18 Feb '02

18 Feb '02

Hardy Beltran Monasterios <hardy(a)acm.org> writes: > 1 click -> http://www/cgi-bin/Zope/mysite/event/past.html > 2 click -> http://www/cgi-bin/Zope/mysite/event/event/past.html > 3 click -> http://www/cgi-bin/Zope/mysite/event/event/past.html > Can any body explain me what´s the problem ? You are using relative links in your pages. You may fix them with the absolute_url() method of the referenced objects. Example: <a href="<dtml-var expr="_['past.html'].absolute_url()">"> (not tested - I don't use names with dots inside). Regards, Frank -- CTO fte(a)Lightwerk.com http://www.Lightwerk.com/ Fax: +49-2434-80 07 94 Phone: +49-2434-80 07 81 Lightwerk GmbH * An der Kull 11 * 41844 Wegberg * Germany Besuchen Sie uns auf der CeBIT: Halle 6, Stand F68 / 595

1 0