January 2003 - Zope - Zope lists

zope on netcraft - server survey
by Raphael Arlitt 17 Jan '03

17 Jan '03

Ok, zope may not be viewable in the graph, but I wonder if it wouldn't be of interest to tell the netcraft people to also check for zope servers by allowing to include other port number than 80. raphael

3 4

Newbiesh question: time script
by Pino Silvestre 17 Jan '03

17 Jan '03

I apologize for my English. I'd like to create a script that starts every period of time. How can I do this? Could you please indicate me some sites with examples? Thank you for your help, Daniele _________________________________________________________________ MSN Foto: condividi, ritocca e stampa le tue foto online http://photos.msn.it

4 3

re: Length of results set
by Ken 17 Jan '03

17 Jan '03

>> How do you get the length of results for a <dtml-if> inside a <dtml-in> ? Dieter Maurer wrote: > You do *NOT* do this in DTML! > > In Python, you simple count all positive hits in a loop: > > i= 0 > for o in context.objectValues(): > if ...: i+= 1 > return i > > You see, how easy it is in Python? Dieter, you make it *look* easy! If DTML is considered scripting and Python programming, why do some say that DTML is harder than Python? I am comfortable with the verbosity - some call it ugliness - of DTML. Of course the expression above is more elegant than its equivalent in DTML, could someone give me an idea of the 'cost differential' between this and the solution below proposed by Dylan Reinhardt? > <dtml-call "REQUEST.set('my_result', [])"> > <dtml-in objectValues> > <dtml-if "id==something"> > <dtml-call "my_result.append(something)"> > </dtml-if> > </dtml-in> Maybe I persist with DTML and overlook its 'ugliness' because I find DTML embedding convenient as opposed to the combination of Script (Python) + ZPT. I promise to advance with Python, but I vote to keep DTML! Ken

3 2

Ampersands (&'s) in URLs
by Sungmook Kim 17 Jan '03

17 Jan '03

Hi, maybe you guys have experienced this. I was validating(www.w3.org) my site recently and bumped into this problem. zope could not transform the url correctly(returned the standard error site) once i changed the Ampersands into & within the following link. <a href="/forum/topic_html?forumid=1&id=&dtml-id;"> other links worked fine with the change. does anyone know why this might happen to this url? cheers, sungmook --------------------------------- Gesendet von http://mail.yahoo.de. Bis zu 100 MB Speicher bei http://premiummail.yahoo.de.

3 5

Re: [Zope] Zope bug?!
by Rares Vernica 17 Jan '03

17 Jan '03

No, no. There is no name conflict because the my method exists, can be edited and I can work with it from the Zope Management Interface (console). I can load it with FTP in my editor but I cannot save it (it don't report any error, just don't save), in rest the method is OK, it exists and can be used. Regards, Rares >From: "Stefan H. Holek" <stefan(a)epy.co.at> >To: Rares Vernica <verni0(a)hotmail.com> >CC: zope(a)zope.org >Subject: Re: [Zope] Zope bug?! >Date: Fri, 17 Jan 2003 11:35:05 +0100 > >Not a bug but a collison with an already existing name. >"manage_page_header" is used by the ZMI management screens. You will have >to rename your method. > >HTH, >Stefan > > >--On Freitag, 17. Jänner 2003 11:56 +0200 Rares Vernica ><verni0(a)hotmail.com> wrote: > >>I work in zope with FTP (from am external editor - EditPlus). >>I have a Product with ZClasses and inside a class a method >>"manage_page_header". If I open this method in my editor, modify >>something and save, the changes aren't saved. The problem is not from my >>editor because other files work OK, so I'm convinced that the problem is >>from Zope. Maybe a bug?! > >-- >Those who write software only for pay should go hurt some other field. >/Erik Naggum/ _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

1 0

RE: Zope memory leak
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 17 Jan '03

17 Jan '03

Chris, Well, it's nice to know I'm not alone :) I have yet to find a way to fix it: http://atlas.gc.ca/cgi-bin/zopegraph Those are 1 hour samples. I applied the cAccessControl patch, removed my usage of REQUEST.set as much as possible, and even unset all my PythonScript variables as one had suggested. This has changed nothing. I'm also 99% sure I don't have any circling/cyclic refrences (I'll try to go back again and check even more thoroughly, but I doubt it, I don't write Python that fancy just yet :) I have one Pyton/C external module that is "non standard", and checked it for leaks, nothing came up. But, if we're suffering from the same issue, then this obviously wouldn't be it (You don't use the Python interface to PROJ.4 do you ? :) I definitely know that the leakage is proportional to usage (The leaking slows down, or even stops, overnight), but I'm not closer to figuring out where it comes from. I've kept an eye on refcounts, but I have yet to see a single refcount that grows out of control (Even the AccessControl ones, but applied the patch anyway, just in case), which suggests the leak is NOT related to object instances, object caching, or anything like that. I'm getting really desperate here ... The funny thing is when the memory grows too large, it seems one of the processes/threads dies with a SIG11, and Zope restarts itself, clean memory! I'm currently using Zope 2.5.1 with CMF 1.1 (2 instances) and the latest Psycopg 1.0.13, and I also allow the importing of some extra modules into Zope (urllib is one, my custom Python/C module is the other). Maybe if we find what we have in common, we can try tracking down what's going on here? I've been thinking fo filing a bug, but I wouldn't even be sure what to say in it!!! PS: I copied to the list, the more eyes the better :) Let me know what you find out, if anything! Cheers, J.F. -----Original Message----- From: Chris Muldrow [mailto:cmuldrow@fredericksburg.com] Sent: Friday, January 17, 2003 10:50 AM To: Jean-Francois.Doyon(a)ccrs.nrcan.gc.ca Subject: Zope memory leak Did you ever locate the source of your memory leak? We seem to be having similar problems, including very high deltas on DateTime (very very high!) and on BTrees._IOBTree.IOBucket. Did anything you did help out? Thanks! Chris muldrow(a)mac.com

2 1

Re: [Zope] Regular expressions insecurity?
by Tue Wennerberg 17 Jan '03

17 Jan '03

Mike Renfro wrote: > On Fri, Jan 17, 2003 at 02:04:57PM +0100, Tue Wennerberg wrote: > > >> I pretty much knew it was a FAQ (should have mentioned that). It >> came up on our local user group list twice this week. But.. I've >> googled, I've searched Zope.org and I've checked the archives for >> this mailing list, but never found an actual explanation. > > > > http://zope.nipltd.com/public/lists/zope-archive.nsf/ByKey/B2A709748C869DA5 > > Basic summary: easy denial of service possibility if you have > untrusted users. Thank you very much. I did read that mail, but apparently not thoroughly enough. But... If it's only a question of Denial of Service, how are regular expressions any different from python scripts. Surely, a site developer can simply make an infinite loop in his python script. On that basis, I claim that either regular expressions should be allowed, or python scripts should be banned! What am I missing? -- Mvh. Tue Wennerberg Civilingeniør og Freelance Udvikler http://tuewennerberg.dk/ - tue(a)wennerberg.dk - (+45) 4043 6735

2 1

Re: [Zope] Regular expressions insecurity?
by Tue Wennerberg 17 Jan '03

17 Jan '03

Toby Dickenson wrote: > On Friday 17 January 2003 12:11 pm, Tue Wennerberg wrote: > >> Hi >> >> Could someone please explain to me why regular expressions have been >> deemed insecure in ZMI development? > > > > Check the list archives. this is a FAQ. I've searched. Still no answer. I pretty much knew it was a FAQ (should have mentioned that). It came up on our local user group list twice this week. But.. I've googled, I've searched Zope.org and I've checked the archives for this mailing list, but never found an actual explanation. I know how to get around the problem (use external method or allow 're' library). What I want to know is, what specific parts of regular expressions are insecure? I want to be able to convince people that it's actually a good thing that they're not allowed. -- Mvh. Tue Wennerberg Civilingeniør og Freelance Udvikler http://tuewennerberg.dk/ - tue(a)wennerberg.dk - (+45) 4043 6735 -- Mvh. Tue Wennerberg Civilingeniør og Freelance Udvikler http://tuewennerberg.dk/ - tue(a)wennerberg.dk - (+45) 4043 6735

2 1

Sixth ZOPE 3 Newsletter
by Gary Poster 17 Jan '03

17 Jan '03

WELCOME TO THE ZOPE 3 NEWSLETTER: ISSUE 6 (16 JAN 2003) Welcome to the sixth Zope 3 newsletter. Information about Zope 3 and newsletter contributions and suggestions can be found at the bottom of this newsletter. GLOSSARY FOR THE UNINITIATED Encounter a term in this newsletter you don't know? Try this glossary: http://dev.zope.org/Zope3/NewsletterGlossary NEWS SNIPPETS: - Hopefully you noticed the first Zope 3 alpha release on December 31, 2002! Congratulations to the people who worked long and hard hours to make it happen. http://dev.zope.org/Zope3/Downloads - Tres Seaver implemented the core behavior for some of the relationship types discussed in http://dev.zope.org/Zope3/RelationshipService These will hopefully find their way into the Zope 3 CVS soonish. :-) - Jim Fulton wrote a "science fiction" proposal of how through-the-web site development is planned to work. It brought forth a flood of responses on the Zope 3 list; for one thing, as far as I can tell, if you use ZClasses, we want to pick your brain. :-) See http://dev.zope.org/Zope3/ThroughTheWebSiteDevelopment and then if you are really intrigued start slogging through the mailing list archives (you have your work cut out for you!) http://lists.zope.org/pipermail/zope3-dev/2003-January/004921.html STEPHAN RICHTER: Locale Support and On-line Help Locale Support Over Christmas I finished the implementation of the Locale Support Proposal: http://dev.zope.org/Zope3/I18nFormatLocaleSupport While it was overshadowed by some license problems (that are now resolved) and some grief with time.strptime() on Windows, the zope.i18n.locales is a powerful package to localize everything around number and datetime objects. Since I utilized the ICU project's XML-based locale information, we have now full support of all locales that ICU supports! At the heart of the locale support lies the zope.i18n.format module, which can be used independently of the locales package. It can read number and date/time format patterns. It then uses these binary patterns to parse for example date/time strings into datetime objects or convert datetime objects to strings. All of the code is accompanied by over 450 tests. Some of the ToDo-items include documentation, integration into ZPT and the Translation Service, and maybe restructuring the Translation Service to use Locales instead of Message Catalogs. On-line Help I also implemented http://dev.zope.org/Zope3/OnlineHelp The On-line Help is supposed to be incredibly similar to Zope 2's Help. Since currently we do not have STX or ReST implemented in Zope 3, I was able to implement the proposal only for plain text files. You can access the On-line help from everywhere adding ++help++ to the URL, like in http://localhost:8080/++help++ Furthermore, if you want to see the OnlineHelp in action, you should create a File and click on Upload; look at the right column of the screen and you will see an 'online help' box. We urgently need people to write documentation for the on-line help, documenting the various screens and functionality! JAN SMITH and GUS GOLLING: Calling all designers!! Zope 3 development is not for experienced python coders only. People with graphic skills, user interface layout skills and tutorial skills are also strongly needed. In preparation for graphic and user interface design work to be done as part of the upcoming Australian Zope 3 Sprint (Melbourne, date TBA), members of OzZope, the Australian Zope Interest Group, have chatted with members of the Zope 3 Dev team on IRC. Gus Golling and I decided to volunteer. We have been helping with some graphics for the UI, and also have started a Design Style Guide. The guide gathers suggestions and images about the possible directions for the 'style' of the Zope 3 User Interface, beyond the exciting developments resulting from the Rotterdam Sprint work. Areas under discussion are the Zope 3 logo, Zope 3 object icons, buttons, skin switcher (in conjunction with Zope 3 dev team work), typographic style guide and color schemes. http://www.ozzope.org/OzSprintWiki/StyleGuideZope3 We have also had a couple of collaborative international efforts on IRC - they have been fun and productive. Please send an email to zope3-dev(a)zope.org if you would like to help out too! R. DAVID MURRAY: Authentication Service optimization and polish Based on Jim's instructions, I rewrote the the auth service (zope/app/services/auth.py) to speed up user lookup by dropping the BTreeContainer mixin, switching to using two BTrees for the data (principal id and username), and implementing the rest of IContainer directly on the auth class. I then altered IPrincipal to include a getRoles attribute, implemented it on the PrincipalBase class, and altered the zopepolicy security policy to grab the Authentication service and use the getRoles method of the principal to compute the base roles instead of using only anonymous, as it did before. STEVE ALEXANDER: Coding and Helping Here's what I can remember of what I've been up to recently: * Various things for the Zope 3 alpha, including work on the event service with Gary Poster, and renaming the ObjectHub service to the HubIds service, upon discussion with Gary and Casey Duncan. * At Alexander Limi's request, converted the form generation code to use div elements rather than table rows:: <div class="row"> <div class="label">Form label</div> <div class="field"><input ..... ></div> </div> This will make CSS-based layout much easier. * Helped Albert from Codeworks with his work on exposing named adapters in the local adapters service, and making the local utilities service (still a work in progress). Albert has done most of the work on these, though. * Still working on the query service. * With Albert from Codeworks, preparing further work on the schemagen project. This is the work that Martijn Faassen and I started at the sprint in Vilnius and can be summarised as "zclasses done right for zope 3". CONTRIBUTING Please send Zope 3 news, and newsletter suggestions and requests, to zope-news(a)zope.org, with "Zope 3" somewhere in the subject line. As you can see, casual and quick news items are acceptable and even desirable. MORE INFORMATION ON ZOPE 3 The central place to find Zope 3 information is currently http://dev.zope.org/Zope3 The Zope 3 mailing list is archived and managed at http://lists.zope.org/mailman/listinfo/zope3-dev The Zope 3 development IRC channel, #zope3-dev at irc.openprojects.net is (strictly) for discussion of Zope 3 development issues. Newsletters are archived at http://dev.zope.org/Zope3/Zope3Newsletter

1 0

Regular expressions insecurity?
by Tue Wennerberg 17 Jan '03

17 Jan '03

Hi Could someone please explain to me why regular expressions have been deemed insecure in ZMI development? Which part of them is not secure? Regards, Tue Wennerberg

2 1