June 2003 - Zope - Zope lists

Re: why this link is not working properly?
by Josef Meile 04 Jun '03

04 Jun '03

> > This is probably a browser problem, not a Zope problem. I don't think it's neither a browser nor a zope problem, I tried to open the link with netscape v7.02 and it didn't work either, I got a time out error. I also downloaded it with flashget and tried to open it locally. It took a long time to Acrobat reader v5.0 to show it and the right margin hide some text. I guess the problem resides in the PDF File itself; perhaps you could try to generate it again. Regards, Josef

1 0

Best Zope book for Developers?
by Jeff Childers 04 Jun '03

04 Jun '03

Hi, What's the best commercial Zope book that is designed for intermediate Python developers who don't know squat about Zope? I just committed to my first project, and I know I want to do it in Zope, so now I've got to put the petal down. Thanks in advance, Jeff

10 10

Delivery Status Notification (Failure)
by postmaster＠gigabitoptics.com 04 Jun '03

04 Jun '03

This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. edsell(a)gigabitoptics.com

1 0

issues of trust, why security via mod_rewrite fails
by Jamie Heilman 03 Jun '03

03 Jun '03

Since February I've been railing on about the importance of protecting your Zope installations and their Products with rewrite rules and URI filters. Well, unfortunately I was overlooking something rather obvious--Zope's built in magical type coercion gets around most URI matches entirely. The rewrite rules I've suggested in the past aren't enough. If this style of filtering is to be continued it must be augmented with filters that are capable of examining the request resource, the query parameters, and basically anything that can externally control Zope's traversal stack. Couple of brief examples; whereas before you may have desired to filter access to the HelpSys mechanism (a notorious leak of information[1] about what products your zope service has installed as well as a potential vector for other badness) by doing something like RewriteCond %{REQUEST_URI} /(Control_Panel|HelpSys)(/|$) RewriteRule .* - [F] in your Apache configuration, now I realize its not enough. Getting around that restriction is as easy as http://examplehost/?HelpSys:method= The type coercion hooks, :method, :action, :default_method, etc. evidently alter the traversal stack. Even stuff like http://examplehost/?_vh_foo:method= will work, bypassing the URI filters I've been extolling[2] for protecting Virtual Host Monsters. Dylan had good reason to voice suspicion about type coercion back in March[3], but the issue was skirted and ended up focusing on tainting application data (which, of course, is also important). So where do we go from here? Its becoming evident to me that while I can probably finagle a rewrite rule that looks for certain tainted names in the GET and POST query variables, Zope has more avenues of control than your typical web application. There's still things like WebDAV, XML-RPC, etc. to worry about, any of which may contain additional hooks which allow frobbing the traversal stack. Writing filters for all those is going to be seriously trying. I'll postulate that the path of least resistance is simply giving up any hope of filtering requests for sanity, and instead focusing on replacing the problem Products and establishing new, secure, paths of configuration. HelpSys should not allow non-authenticated access. VirtualHostMonsters should not obtain their rewriting information from the traversal stack, indeed the traversal stack should not be viewed as a source of trusted information, much like the the request URIs can't be viewed as trusted[4]. ... and so on. This should be fun. -- Jamie Heilman http://audible.transient.net/~jamie/ "We must be born with an intuition of mortality. Before we know the words for it, before we know there are words, out we come bloodied and squalling with the knowledge that for all the compasses in the world, there's only one direction, and time is its only measure." -Rosencrantz [1] http://marc.theaimsgroup.com/?l=zope-dev&m=103893600209090&w=2 [2] http://marc.theaimsgroup.com/?l=zope&m=104426779414836&w=2 [3] http://marc.theaimsgroup.com/?l=zope&m=104718222616059&w=2 [4] http://collector.zope.org/Zope/813 I should point out the VHM workarounds for bug 813 I mentioned are made moot by this latest realization, the only sane thing to do now is to patch, patch, and patch some more.

2 4

Function Reduce() Does Not Work in Python Scripts
by Edward Pollard 03 Jun '03

03 Jun '03

And it hasn't for a very long time: http://mail.zope.org/pipermail/zope-dev/2001-December/014461.html Any idea why? We're running 2.6/2.6.1 Ed

2 1

LDAPUserFolder configuration
by Anthony Busnel 03 Jun '03

03 Jun '03

Hello. Sorry if it's hard to read me, but I'm a french student, so ... Here's my problem : I have installed LDAPUserFolder product without too many difficulties. I can connect to the LDAP server, and read what is inside. But I can't add new users, maybe because of the rights. Into the configure panel of the acl_users directory (/Control_Panel/Products/LDAPUserFolder/acl_users), there's a 'Manager DN Usage' field with 3 choices : Never, Always, For login data lookup only. If I set 'Always' and Apply, Zope doesn't like and display something like that : Zope Error Zope has encountered an error while publishing this resource. Error Type: INVALID_DN_SYNTAX Error Value: {'desc': 'Invalid DN syntax', 'info': 'invalid DN'} What's the problem ? I'm learning how to use Ldap, so I'm a bit lost. Just for information, I'm working under Linux-Debian. Thanks a lot for your assistance. Anthony [One love, One peace] |Keep it real| _________________________________________________________________ MSN Messenger : dialoguez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

2 1

AttributeError __getslice__ from Zope Construction Kit book
by hpinson＠indepthl.com 03 Jun '03

03 Jun '03

Hello. I've been through the Zope "Web Application Construction Kit" book tutorial, chapter 5, "Building a Portal and Adding Serices" "Creating a Type with ZClasses", twice now. Each time, when attempting to add the new ZClass object in a user folder, this error is generated: Error Type AttributeError Error Value __getslice__ Does anyone have any sense of what this means and how to fix it? My Zope is 2.6.0 running on Redhat 8. Thanks. Harlow Pinson Indepth Learning Email: hpinson(a)indepthl.com Web: http://www.indepthl.com Voice: 505-994-2135 FAX: 208-475-7678

2 2

<dtml-var> and double quotes in variable name
by Derek Basch 03 Jun '03

03 Jun '03

Hello all, I am wondering if there is any way to include double quotes in a <dtml-var> name? For instance: <dtml-var /"Date/"> assuming / escapes the double quote. I ask because the variable is referencing an SQL field name that is also a Interbase/Firebird keyword. (Date, Time, etc...). Interbase requires a pair of double quotes in such a situation. Thanks Everyone, Derek Basch __________________________________ Do you Yahoo!? Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com

2 1

why this link is not working properly?
by Jianping Zhu 03 Jun '03

03 Jun '03

I have redhat 7.1 box with zope on it. I have a link to a microsoft .pdf file, http://coopunit.forestry.uga.edu/unit_homepage/Conroy/projects/pnwr_arm/new… in the lower part links: 2000 1999 1998 1997 1996 link 2000 works fine but when i click 1999 (WebBouser), the pdf file does not appear. how can i settle this problem? Thanks

2 1

Navision C/ODBC
by Alexandré Soumbatov 03 Jun '03

03 Jun '03

Hi *, Is anybody have successfuly access Navision from ZOPE via C/ODBC? By me it's working only if Navision installed localy. If I try to access Navision server via TCP allways came error: Invalid connection string I have tried Z ODBC DA (ZODBCDA-3.1.0b2-win32-py21.tgz) Thank you, _____________________________________ Internal Applications Dipl.-Inf. Alexandré Soumbatov Tel +49 30 55115-339 Fax +49 30 55115-143 alexandre.soumbatov(a)spmtechnologies.com SPM Technologies Deutschland GmbH An den Treptowers 1 12435 Berlin, Germany www.spmtechnologies.com

1 0