January 2004 - Zope - Zope lists

Re: [Zope] 2.7.0-b4 problem - unable to rename items
by travismiller-lists＠cox.net 15 Jan '04

15 Jan '04

hi, http://zope.org/Collectors/Zope/1169 this patch worked for me...thanks to dirk > > From: "Nesbitt, Steve" <snesbitt(a)cobaltgroup.com> > Date: 2004/01/14 Wed PM 07:54:25 EST > To: zope(a)tmiller25.endjunk.com > Subject: [Zope] 2.7.0-b4 problem - unable to rename items > > All: > > I am getting an AttributeError, ErrorValue: max whenever I try to rename an > item > using 3.7.0-b4. I do not see any other information in the logs. > > System is: > Zope: 2.7.0-b4 > os: linux2 > Python: Python 2.3.3, > Plone: CMFPlone-2.0-RC3 > CMF: 1.4.2. > > Thanks in adavance for any help. > > -steve > > > Stephen Nesbitt > Senior Configuration Management Engineer > The Cobalt Group > snesbitt(a)cobaltgroup.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope-dev ) >

1 0

Zope 2.7, Py 2.3.3 Problem with <dtml-var "[x for x in ['list', 'comprehension']]">
by Gfeller Martin 15 Jan '04

15 Jan '04

Dear all, the following DTML worked fine in Zope 2.6.2/Py 2.1.3: <dtml-var "[x for x in ['a','b']]"> Under Zope 2.7.0-b4 (python 2.3.3, win32), it fails with a NameError name '_getiter_' is not defined. The example is a variation of some actual code, stripped down to just expose the actual problem - in reality, we do something sensible with 'x' :-). Any idea about the cause? Best regards, Martin Gfeller _______________________ COMIT Gruppe Risk Management Systems Pflanzschulstrasse 7 CH-8004 Zürich Telefon +41 (0) 1 298 92 84 http://www.comit.ch http://www.quantax.com - Quantax Trading and Risk System

1 0

Recall: Zope 2.7, Py 2.3.3 Problem with
by Gfeller Martin 15 Jan '04

15 Jan '04

Gfeller Martin would like to recall the message, "Zope 2.7, Py 2.3.3 Problem with ".

1 0

Monkey patching and inheritance
by Dennis Allison 15 Jan '04

15 Jan '04

I am using monkey patches to modify Zope. I modify UserFolder.py by providing replacements for a number of methods. These methods are simply defined in an __init__.py in a module in the product folder, MyUserFolder. The UserFolder class is imported, the new overriding methods defined, and, at the end, InitializeClass is imported from Globals, and the patched procedure names assigned to their correspondiong names in Userfolder namespace, and InitializeClass() called on the UserFolder. The new code is fairly cautious about persistence. Use is made of PersistentMapping and PersistentList for mutable structures. I've been having occasional crashes of the Zope system with a diagnostic AttributeError: Surrogate instance has no attribute '_p_oid' which I have finally traced to the UserFolder modifications! Apparently I have somehow broken the persistence mechanism in my monkeypatching. Advise on what the problem might be and how to repair it would be very helpful. -dra

2 1

how to set the mailhost
by blinkya 15 Jan '04

15 Jan '04

I can not send a mai successfully in my web created bu zope. Because I don know how to set the mailhost. Can you give me an example. thankyou

5 5

Converting a web site
by John Poltorak 15 Jan '04

15 Jan '04

I woulde be interested in converting an existing web site with numerous fairly static pages into one managed by Zope. How would I go about doing this? It seems pretty tedious having to upload each file individually, which is the only way I have found of doing it so far. -- John

3 2

Re: [Zope] Zope Patterns
by Lennart Regebro 15 Jan '04

15 Jan '04

Second one... Douwe Osinga wrote: > Do other people recognize this pattern? Other solutions? With DTML this is indeed the way to go. The other solution with be to use ZPT.

1 0

Re: [Zope] Converting a web site
by Lennart Regebro 15 Jan '04

15 Jan '04

Sorry, sent these answers to the wrong list. Trying again. John Poltorak wrote: > I woulde be interested in converting an existing web site with numerous > fairly static pages into one managed by Zope. > > How would I go about doing this? > > It seems pretty tedious having to upload each file individually, which is > the only way I have found of doing it so far. In all cases but one where I have been involved in converting one site to a Zope managed site, the people have scrapped the old site completely, and made a new one from scratch, with a new, improved structure and layout. It involves a lot of copy/pasting text from the old site, sure, but the end result is better. If you are just to have a bunch of static files, you can just as well just use Apache anyhow. :) And if you don't, there are products that let you store the files on the harddisk, where they are now, accessing them through Zope, but not needing to import them. LocalFS is the most common one, I think.

1 0

ANNOUNCE: Zope 2.6.3 Release and Security Update
by Brian Lloyd 15 Jan '04

15 Jan '04

Zope 2.6.3 Release and Security Update Zope 2.6.3 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.6.3 from Zope.org: http://www.zope.org/Products/Zope/2.6.3/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.6.3 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.6.3 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.6.3 in the near future. Also note that there are binary code changes in the 2.6.3 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation. Zope 2.6.3 provides fixes for all of these issues. A description of each issue, who is affected and issue status is included below. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.6.3/CHANGES.txt - http://www.zope.org/Products/Zope/2.6.3/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html ISSUES RESOLVED BY Zope 2.6.3: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher.

15 25

Re: FieldedTextIndex weighting implemented
by Casey Duncan 15 Jan '04

15 Jan '04

[CC'd the list in case anybody else is interested] On Mon, 12 Jan 2004 17:44:52 -0500 Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote: > Casey, > > I created the Index, and that works fine, using the only ZCLexicon I > have which is the same I use for ZCTextIndexes ... > > Now if I try to view the management page for the Index by clicking on > it in the ZMI, I get : > > Traceback (innermost last): > > Module ZPublisher.Publish, line 89, in publish > Module ZPublisher.BaseRequest, line 299, in traverse > Module Products.ZCatalog.ZCatalogIndexes, line 109, in > __bobo_traverse__ AttributeError: _catalog Hmm, I'm not sure how the index could be causing that. Pretty weird. > After navigating the portal_catalog interface a bit (This is in CMF > BTW), the problem seems to go away ... > > Once I've reached this point, I can go ahead and index content. > > I'd suggest adding to the ZMI interface of the index the name of the > attribute/method being indexed, it's always handy. Good point. I thought I'd done that. I definitely will. > I'll let you know how the actual searching goes ! > > Some thought's I'm having: It'd be nice if I could store default > weights into the index, that it would use transparently, unless > specific weights are provided with the query itself. Also it provides > an easy to use interface to set weights, instead of having to change > code (Possibly often, when one tweaks this stuff). AND, because (In > my case at least) 99% of searches are on ALL fields anyways, it > prevents me from having to supply a list of fields and weights each > and everytime. Yes that makes sense. I'll need to implement weighting when searching all fields which should be straightforward and useful. > The current setup is good for advanced searching and so on, but for > basic"enter text/hit search" queries, it's more work. Yes, that makes sense. > Not a big deal, but an idea for 1.0 I guess ? :) I'll probably shoot for 0.3... > Also, and this is muddy in my mind also, but would having different > weights per object type make some kind of sense ? Since Okapi's > scoring is sensitive to the proportion of terms vs total number of > words, the weighing might need to change based on the type of object, > and whether one attribute's textual content is "wordier" than another. > I don't know if that > makes sense ? It could be done, but it would require changing the data structures since the weights would be applied at query time but would need to be stored at index time. Actually being able to weight objects arbitrary might be pretty interesting. It would allow you to pull tricks like Google and make certain results always rate high for certain queries. I'm not sure if that's what you were thinking but it could be a pretty cool trick. > Oh, and I'm noticing FieldedTextIndex uses Okapi ONLY ? That's fine > for me at least, but might want to document that, for those that might > use the other algorithm ? For simplicity sake I chose to do Okapi only. Doing both would be pretty complex and I didn't think it was worth the effort since I always use Okapi myself. I'm going to call YAGNI on this for now. > Phew, sorry, I'm babbling ... No, the input is always appreciated. -Casey > -----Original Message----- > From: Casey Duncan [mailto:casey@zope.com] > Sent: Monday, January 12, 2004 1:15 AM > To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca > Cc: zope(a)zope.org > Subject: FieldedTextIndex weighting implemented > > > I have an initial implementation of the per-field weighting checked > into cvs. I haven't released 0.2 yet, but I expect to sometime in the > next week or so. The new feature is unit-tested and documented in the > README, so feel free to check it out in the mean time. > > You can download it directly from CVS at: > > http://cvs.zope.org/Products/FieldedTextIndex/ > > There is a link to generate a tarball at the bottom, or you can check > in out using anonymous cvs if you want to track changes. > > Let me know what you think. > > -Casey

1 0