February 2003 - Zope

A new installation on Windows 2000
by Michael.Coll-Barth＠VerizonWireless.com 03 Feb '03

03 Feb '03

I just installed Zope 2.6.0 on a Windows 2000 desktop. I kicked off start.bat and it just sits there after the PCGI server is started. ----------------------------------- 2003-02-03T12:01:36 INFO(0) ZServer PCGI Server started at Mon Feb 03 12:01:36 2003 Inet socket port: 8090 ----------------------------------- When I fire up IE, 5.50.4807.2300CO, it can't find http://localhost:8080/manage. However, when I try the same with Opera, 6.05, it comes right up with a login prompt. Are these part of the same issue? Is the DOS box supposed to sit there like that? In the meantime, I am going through the tutorial included with Zope. Wich me luck! :) thanks, Michael

1 0

unprotected VHM usage may facilitate cache poisoning
by Jamie Heilman 03 Feb '03

03 Feb '03

With Virtual Host Monsters being all the rage these days, I'd like to point out something that I have yet to see addressed in any of the tutorials. Letting anonymous clients send tainted requests to a VHM enabled site is not a good idea, and should be guarded against. A tainted request in this case is one whose URI contains the substrings "/VirtualHostBase/", "/VirtualHostRoot/", or "/_vh_". For unprotected sites using VHMs, letting an anonymous client send URIs containing those substrings will result in the returned document rendered in the context of an appropriately mangled traversal request name stack. Usually if that mangling results in a bunch of broken URLs in the document its no big deal.[1] It is a big deal though, if you're using a cache, and that request results in a cache miss--then that broken document gets stored as the response for subsequent requests. Oops. I've verified this can be a problem when using RAM Caches, I haven't tried external caches, depending on how they key the content it may or may not be a problem. Now, this isn't so much a problem with the VHM product, but rather with sloppy configuration practices. Which, as it happens, pretty much every tutorial I've read demonstrates, with a uniformity otherwise rare to the HOW-TO library. As virtual host monsters may be used in a variety of ways, there's no one-size-fits-all approach to protecting your site. If you use Apache with mod_proxy's directives, for example, you can probably use any number of techniques ranging from LocationMatch directives to perhaps even abusing mod_alias. If you use Apache with mod_rewrite (+ mod_proxy for the [P] flag), then you can simply use RewriteCond patterns to ignore tainted URIs, letting them fall through to their fate, or you could even catch them and send 'em packing with a [F] flag or similar. An example[2] of the former is: RewriteEngine on RewriteCond %{REQUEST_URI} !/VirtualHostBase/ RewriteCond %{REQUEST_URI} !/VirtualHostRoot/ RewriteCond %{REQUEST_URI} !/_vh_ RewriteRule pattern substitution [P] If you use VHM mappings and ZServer's HTTP service on a raw wire, then you've probably already thrown out any notion of security, and this is the least of your worries. Fixing other front-end proxy server configurations (squid, etc.) is left as an exercise for the reader. I believe the 3 'magic' strings I've outlined here are the only ones which are used by the VHM product, and as such, are the only ones which need immediate attention for rectifying this particular problem. If somebody wants to double-check my interpretation of the VHM code I'd gladly welcome the peer review. My knowledge of exactly what is used as key in a RAM Cache is hazy at the moment - but it *may* be possible in some circumstances to exploit acquisition to poison a RAM Cache as well. I made a few half-hearted attempts at doing this, but I wasn't successful; something to think about though. If anyone has evidence of why this can or can't work I'd like to hear about it, if for no other reason than to set my mind at ease. -- Jamie Heilman http://audible.transient.net/~jamie/ "You came all this way, without saying squat, and now you're trying to tell me a '56 Chevy can beat a '47 Buick in a dead quarter mile? I liked you better when you weren't saying squat kid." -Buddy [1] Its no big deal with one huge proviso, that the resulting mangled URLs in the document returned are properly escaped for the context in which they appear so as to prevent cross-site scripting attacks and such. From my perusal of the VHM source, I'd say no escaping is done to path elements prefixed by "_vh_". Nevertheless, this is probably fine, as I'm guessing all escaping is left until later in the processing phase when the context of presentation is less of an unknown. Anyway, I think we're in the clear there, but if you're sufficiently paranoid (good for you!) and you have some spare time you may wanna investigate this further. [2] I hate giving examples of how to configure Apache, because people will inevitably blindly follow your advice without ever taking the time to RTFM and learn what the hell they are doing. I'll make an exception for (what I've perceived to be) the most common mode of usage though, in this case.

2 1

How to talk to ZODB?
by Pawel Lewicki 03 Feb '03

03 Feb '03

Hallo, I wanted to put some management of my CMF site to an external application. What is the most convinient way to access persistent objects and modify them? Should I integrate ZODB with my application or use any protocol to communicate (WebDAV, XML-RPC)? I suppose that the second way is better. Is there any howto? Maybe I should ask google, but about what? I think of using libxmlrpc with wxPython (thank you Phill), but maybe there are any other suggestions. Are there any out-of-the-box solutions? Pawel Lewicki

2 3

RE: [Zope] Newbie needs help
by Passin, Tom 03 Feb '03

03 Feb '03

[ Michel Combe] > What I want to do is display, from the result of an SQL > query, each first occurence of a supplier name . ie : I have > a query which returns for example "s1,s1,s1,s2,s2,s3,s3" and > I want to display "s1,s2,s3". > > This is what I wrote : > <dtml-let previous="''"> > <dtml-in SQL_SelectSupplier> > <dtml-if "SupplierName!=previous"> > Found First > <dtml-else> > Found Next > <dtml-let previous=SupplierName></dtml-let> > </dtml-if> > <dtml-in> > > It doesn't work and I can't find why... > Thanks for your help > You have gotten some solutions but they have not answered the part 'I can't find out why...'. The reason is that assignments made using dtml-let only exist within the scope of that dtml-let. IOW, they are not assigned to the whole page but only to that part of the code. Your second assignment to "previous" will not change the earlier definition of "previous". Cheers, Tom P

1 0

Re: [Zope] Deleted acl_user
by baiewola＠netscape.net 03 Feb '03

03 Feb '03

I'm sorry, Andreas. I was not clear in my first message. I do not want him to be able to access the site at all. I just want to know if I have to go through the site object by object deleting his local roles. Andreas Jung <lists(a)andreas-jung.com> wrote: >Have you tried to Undo the delete operation (Undo Tab). > >-aj > >--On Montag, 3. Februar 2003 11:30 -0500 baiewola(a)netscape.net wrote: > >> All of my users are defined at the root level. One of them did a lot of >> work on my site and has local roles and owned objects all over the place. >> I deleted him from the acl_users. >> >> My question is, can he still access everything for which he has a local >> role? Or does the act of removing him from acl_users make all his local >> roles irrelevant? >> >> __________________________________________________________________ >> The NEW Netscape 7.0 browser is now available. Upgrade now! >> http://channels.netscape.com/ns/browsers/download.jsp >> >> Get your own FREE, personal Netscape Mail account today at >> http://webmail.netscape.com/ >> >> _______________________________________________ >> Zope maillist - Zope(a)zope.org >> http://mail.zope.org/mailman/listinfo/zope >> ** No cross posts or HTML encoding! ** >> (Related lists - >> http://mail.zope.org/mailman/listinfo/zope-announce >> http://mail.zope.org/mailman/listinfo/zope-dev ) > > > > > --------------------------------------------------------------------- > - Andreas Jung http://www.andreas-jung.com - > - EMail: andreas at andreas-jung.com - > - "Life is too short to (re)write parsers" - > --------------------------------------------------------------------- > > __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

AdaptableStorageProduct: RuntimeError
by Elena Schulz 03 Feb '03

03 Feb '03

Hi Shane, in my ZMI there are two folders: pathA and pathB and I use your AdaptableStorageProduct for FileSystemStorage with the two mount_paths=/pathA/zptTexte; /pathB/zptTexte so that the zptTexte get mounted to these Folders in the ZMI. It works initially but when I try to copy anything in the pathA-Folder in the ZMI , I get a RuntimeError. Same happens as soon as I try to enter the folder pathA in the ZMI afterwards. Is there any solution for that? Or can use only one mount_path? -- many thanks for your replies, Elena Error Type: RuntimeError Error Value: Shouldn't load state for '(\x01\x00\x00\x00s\x18\x00\x00\x00/project_health/zptTexte' when the connection is closed Error error_tb: Traceback (innermost last): Module ZPublisher.Publish, line 98, in publish Module ZPublisher.mapply, line 88, in mapply Module ZPublisher.Publish, line 39, in call_object Module Shared.DC.Scripts.Bindings, line 252, in __call__ Module Shared.DC.Scripts.Bindings, line 283, in _bindAndExec Module App.special_dtml, line 174, in _exec Module DocumentTemplate.DT_In, line 705, in renderwob Module Products.AdaptableStorage.zodb.ASConnection, line 302, in setstate RuntimeError: Shouldn't load state for '(\x01\x00\x00\x00s\x18\x00\x00\x00/project_health/zptTexte' when the connection is closed

2 1

Hardware for Zope + ZEO
by Wankyu Choi 03 Feb '03

03 Feb '03

Dear all, I'm planning to rebuild one of my commercial portal sites using Zope with more than 300,000 users. The portal has been running on APM( apache + php + mysql ) without a glitch for three years. I've been worried about Zope's scalibility since I already have too many users with as much data. I came to a conclusion that ZEO might help with a bit more hardware thrown in. Here's my plan. (OS: Linux) 1. Get a rock-solid machine for ZEO server: Intel XEON dual cpus (SR2300 if you want to know this Intel server model) with 2G mem + six 73G segate SCA scsi hard disks + RAID5 for fault-tolerance (intel srcu32 dual channel raid controller) 2. Throw in at least three less-powerful machines for ZEO clients: 1 P3 tualatin + 1G mem + 1 36G hard disk with NO RAID. I plan to buy one No.1 machine plus one No.2 machine since I already have two machines, candidates for the other two ZEO clients. I came under the impression using Zope for the past year ( and from python/zope docs ) that python uses only one CPU no matter how many I have. One of the two machines I already have has four Xeon cpus but Zope on that machine runs way slower than one on my single P3 desktop with a bit more horsepower. Suppose you have 300,000 users with tons of data and expect they'd start adding tons more data once you open this portal based on Zope + heavily customized CMF/Plone. Would this setup seem reasonable? Or better still, how would you set your portal up if you got extra dough for hardware? Specifically I want to know... 1. Would the above setup seem reasonable? 2. Some say P3 tualatin is better for Python than P4 or even Xeon processors. Is that true? 3. I'm looking towards the Directory Storage over File Storate for tons of reasons, the reasons you might easily guess. I'll have six 73G disks with RAID5, which means I'd have to let go 73G for storing parity information. That leaves me about 365G. At least 300G will be allocated for ZODB. Would FileStorage maintain its integrity if the db grows to 300G? What I'm worried about most is that I can't make it versionless. Directory Storage has that option. Comments? 4. Would I really get no benefits from running Python on SMP machines? That is, would I better off with two 1 cpu machines than one dual cpu machine? If true, do I really have to buy Dual XEON intel server for ZEO central storage server? Why don't I just settle for a single CPU machine for that with more RAM? 5. Can I run a ZEO client on ZEO server? To sum up, I'd get a total of four machines: one ZEO server and three ZEO clients. I want to make it four clients. I assume I can also run a ZEO client on the ZEO server but I hunch that some would probably say no to that... . May I ask why? 6. You have the following machines. How would you set up your ZEO server and clients? Remember, you have 300,000 users eager to add data :-) Machine No.1 - 2 Xeon 2.0GHZ CPUs + 2G mem + six 73G disks + Intel high-end RAID controller Machine No.2 - 1 P3 tualatin CPU + 1G mem + 1 36G disk Machine No.3 - 2 Xeon CPUs (older model) + 1G mem + 3 36G disks (disks old, will be recycled for backup storage or something) Machine No.4 - 4 Xeon CPUs (older model) + 2G mem + 4 36G disks (disks old, will be recycled for backup storage or something) I'd appreciate any comments. Thanks in advance. Regards, Wankyu Choi --------------------------------------------------------------- To the dedicated staff at NeoQuest, language is not a problem to be dealt with, but an art waiting to be performed. --------------------------------------------------------------- Wankyou Choi CEO/President NeoQuest Communications, Inc. 3rd Floor, HMC Bldg., 730-14, Yoksam-dong, Kangnam-gu Seoul, Korea Tel: 82-2 - 501 - 7124 Fax: 82-2-501-7058 Corporate Home: http://www.neoqst.com Personal Home: http://www.zoper.net, http://www.neoboard.net e-mail: wankyu(a)neoqst.com ---------------------------------------------------------------

7 22

RE: [Zope] Newbie needs help
by Schmidt, Allen J. 03 Feb '03

03 Feb '03

SELECT DISTINCT supplier FROM supplier_table ORDER BY supplier -----Original Message----- From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of Michel Combe Sent: Monday, February 03, 2003 9:32 AM To: Zope(a)zope.org Subject: [Zope] Newbie needs help Hi, What I want to do is display, from the result of an SQL query, each first occurence of a supplier name . ie : I have a query which returns for example "s1,s1,s1,s2,s2,s3,s3" and I want to display "s1,s2,s3". This is what I wrote : <dtml-let previous="''"> <dtml-in SQL_SelectSupplier> <dtml-if "SupplierName!=previous"> Found First <dtml-else> Found Next <dtml-let previous=SupplierName></dtml-let> </dtml-if> <dtml-in> It doesn't work and I can't find why... Thanks for your help Michel Combe _______________________________________________ Zope maillist - Zope(a)zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )

2 1

TAL / Z SQL Method
by Arjan Huijzer 03 Feb '03

03 Feb '03

Hello, I am having a problem with calling multiple Z SQL Methods from within Page Templates. What I need to accomplish is calling a Z SQL Method using a parameter value from another Z SQL Method. My code looks like: CD Title <ul tal:repeat="song container/z_sql_methods/select_songs"> <li content="song/song_title">Song Tile</li> </ul> As you can see I have two Z SQL Methods, namely "select_cd" and "select_songs". For every CD that is in the database, the songs need to be retrieved. This is done by using the second Z SQL Method that takes one parameter, "cd_id". How can i pass this parameter "cd_id" in the TAL statement? I have looked through the available docs, but couldn't find the solution. Can someone please help me or point to a relevent piece of documentation? Thanks in advance!! Arjan Huijzer __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

3 2

Restrictions to domains, Logoff page
by Sven Jacobs 03 Feb '03

03 Feb '03

I have two questions: 1) Is it possible to restrict the Zope Server to special domains, rejecting requests from all other domains? 2) Where do I change the page loaded after logging of from the Zope management environment? Thanks in advance! -- Sven Jacobs TEDSoft GmbH jacobs(a)tedsoft.de www.tedsoft.de

2 2