January 2004 - Zope - Zope lists

MGMT Interface
by SDA 11 Jan '04

11 Jan '04

Hello: Newbie here to Zope. I recently installed Zope on Debian (Sarge), and from the get go there were some issues. Namely the 'default' setup was missing, so I couldn't get it started. A little reading of the docs helped get that sorted. Now, I can't get into my Management interface. I have set the password, both my using the 'zopectl -a access' switch, and by issuing 'python zpasswd.py access'. However no dice, still can't login with the pwd/log setup with either/or methods above. Any suggestions? Thank-you. -- Stephen

2 3

Some installiation bug for zope-exuserfolder and related
by Federico Andrade 11 Jan '04

11 Jan '04

Hi, I dunno if this is the right place and if you already fixed this, and sorry if this is not the way to report a bug (I don't have the time to RTFM, I just want to do a quick install). Anyways, here's my two cents: I got this message when trying to install zope-exuserfolder (0.10.10-5), (and related stuff) using debian's dselect utlility on a debian 2.4.18-bf2.4 unstable: : Setting up zope-cmfplone (1.0.5.20030909-2) ... postinst cannot determine the version of python used in /usr/sbin/zope-z2 ... please file a bug report. dpkg: error processing zope-cmfplone (--configure): subprocess post-installation script returned error exit status 1 dpkg: dependency problems prevent configuration of plone: plone depends on zope-cmfplone (= 1.0.5.20030909-2); however: Package zope-cmfplone is not configured yet. dpkg: error processing plone (--configure): dependency problems - leaving unconfigured Setting up zope-exuserfolder (0.10.10-5) ... postinst cannot determine the version of python used in /usr/sbin/zope-z2 ... please file a bug report. dpkg: error processing zope-exuserfolder (--configure): subprocess post-installation script returned error exit status 1 Errors were encountered while processing: zope-cmfplone plone zope-exuserfolder E: Sub-process /usr/bin/dpkg returned an error code (1) Some errors occurred while unpacking. I'm going to configure the packages that were installed. This may result in duplicate errors or errors caused by missing dependencies. This is OK, only the errors above this message are important. Please fix them and run [I]nstall again Press enter to continue. : The problem seems to come from /usr/sbin/zope-z2 in this (only) line: exec python2.2 -O /usr/lib/zope/z2.py $@ should be: exec /usr/bin/python2.2 -O /usr/lib/zope/z2.py $@ based on the regular expression from postinst located at: /var/lib/dpkg/info/zope-exuserfolder.postinst After that it works fine. Regards, Federico.

1 0

zope2.6.3 and zclass+property sheets+catalog aware
by Bakhtiar A Hamid 11 Jan '04

11 Jan '04

hi just upgraded my zope 2.6.1 to zope2.6.3 and went thru hell :P the setup: i have a CatalogAware ZClass (sorry, this has been in existence since early 2000) that uses propertysheets to store properties. this has worked since zope2.0 till zope 2.6.1(well, actually the zope version is between zope 2.6.1 and zope2.6.2, from cvs) last night i upgraded to zope2.6.3, and everything looked ok. but when users tried adding in the zclass instance, or updating older instance, the propertysheets never got changed! that makes users mad. this zclass also works on zope2.7.0b3, that i can be sure. i haven;t yet tried this on zope2.7.0b4 i also tried another simple zclass and that b0rked too. i then created a new zclass, that subclass ZClass: objectManager, nad put in two properties of string and text. adding an instance shows the same problem. no tracebacks. everything adds fine. just nothing in the properties :P the question: what might have cause this trouble? CHANGES.txt mentioned some changes with PropertyManager. but the affected fileds/types used in my ZClass are mostly text and string thanks for any hints and help

1 0

Re: [Zope] Adding a ZPT when adding product instance
by Lee Harr 10 Jan '04

10 Jan '04

> >I use something like this to add a DTML Method inside of my folderish > >product: > > > > # Add default interface > > index_html = HTMLFile('dtml/index_html', globals()) > > text = index_html.read_raw() > > ob.manage_addDTMLMethod(id='index_html', title='') > > idx = ob.index_html > > idx.manage_edit(text, title='') > > > > > >the source for the index_html file is in the dtml folder in my product, > >and is called index_html.dtml > > > >Is this the correct Zope idiom? > >How can I do something similar for ZPT? > >It is similar for ZPT. > >ZPT use the "official" creation method (not an abbreviated form >like DTML). It looks like: > > ob.manage_addProduct['PageTemplates'].manage_addPageTemplate( > id, title, text) > >"PageTemplateFile" is the correspondence for "HTMLFile". >However, I would directly read the file content (with Python's >"open" followed by "read") and pass it as "text" to the >constructor. > Ok. That was actually my first thought, but how do I find the directory in which my product? This is how I have done it ... dirname = os.path.dirname(__file__) zpt = os.path.join(dirname, 'zpt') index_html = open(os.path.join(zpt, 'index_html.zpt')) text = index_html.read() ob.manage_addProduct['PageTemplates'].manage_addPageTemplate( 'index_html', '', text) I could not find PageTemplateFile from my script... it is not in Globals with HTMLFile. I also found package_home in Globals while looking through ZopePageTemplate.py but I am not quite sure how to use it. Thank you for your time. _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. http://join.msn.com/?page=features/virus

2 1

how to define a class for use in scripts
by Istvan Albert 10 Jan '04

10 Jan '04

Hello Folks, here is a problem that I was so far unable to make any notable progress. I want to be able to use a custom class in my python scripts. in python I would create a file say User.py and put in it: class User: set(self, user_id): self.user_id = user_id In my scripts I want to be able to do a: import User user = User.User() user.set(1) I do not need a product! I think I understood how do those work and I have made some simple products myself. But those need to be added individually. ZCLasses seem to be no good either. These also seem to be static objects that are instantiated once and then only their properties change. This user class needs to be created as an instance and multiple instances may be present if there are multiple users. I've read a lot of documentation and still have no clue whether it is possible to do this without tinkering with the internals of the system. I have full access to any part of Zope, what I'm hoping is to be able to put this file in a place that allows Zope to use it. Is there such a place? thanks for the help folks, Istvan.

2 1

OT:looking for info/ideas on "Open Source Business Models"
by robert 10 Jan '04

10 Jan '04

Hi all, I am going to give a speech on "Open Source Business Models" for which I am searching ideas and concepts. What I would like to show is why and where OSS provides a better base to make business than closed source. A main focus should not be how to provide "big" software packages like Zope/ Mysql/et al but on what business could be buildt around them. Any Ideas and pointers would be greatly appreciated. Robert

2 1

psyco and zope?
by Marc Lindahl 10 Jan '04

10 Jan '04

has anyone checked out psycho (http://psyco.sourceforge.net) for speeding up zope?

2 1

no upgrade binary?
by Stephan Goeldi 10 Jan '04

10 Jan '04

Is there no upgrade binary available for Zope 2.6.3?

2 1

RE: [Zope] Weighing catalog searches per index ?
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 10 Jan '04

10 Jan '04

Casey, Ahhh, so it just multiplies the score. Which also means the scoring is applied to each field, instead of merging the fields and THEN scoring. But doesn't that mean that even if not restricting the search to specific fields, the scrow coming out of one of our indexes could be different than a pure ZCTextIndex which scores on just one big "blob" of textual content, instead of several small ones ... At least with Okapi that would presumably make a difference sincepart of the cosring is based on the totoal number of words in the document ? But then that's not too big a deal, so long as whatever differences are explained/documented :) I can help with that if you'd like. As for the syntax of the querying, I'm really indifferent, so long as it works :) I guess your suggestion does have advantages over mine indeed though ! Thanks for getting this done ! Let me know as soon as you've got it and I'll gladly try it out. Since this can be made into a transparent extension of ZCTextIndex, I'd really suggest that if/when this is deemed mature enough, it replace the current ZCTextIndex. This searching fucntionalty is kind of invaluable and extremely powerful, and I'm sure would be of great use to many once they find out about it ! Thanks for the great help! J.F. -----Original Message----- From: Casey Duncan [mailto:casey@zope.com] Sent: Thursday, January 08, 2004 4:54 PM To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca Cc: zope(a)zope.org Subject: Re: [Zope] Weighing catalog searches per index ? On Thu, 8 Jan 2004 16:24:58 -0500 Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote: > Casey, > > Thanks for pointing out this product, I'll have to give it a try, as I > can foresee many useful applications for it ! Cool. Its new and I'm eager to get feedback from the field on it (no pun intended). [...] > > Your product seems to have a good base to start with. The problem > now, and one that stopped me in my tracks, is how to > define/calculate/configure this"weighing" concept. You suggest > there's some underlying functionality for weighing already, maybe it'd > just be a matter of taking advantage of it, and documenting how to use > it ? The big question would be what does a weight of"1" MEAN versus a > weight of "2" or "5" ? ZCTextIndex calculates document and word scores. When queries are performed these scores are combined as intermediate results are combined (using unions and intersections). The weighted versions of these commands allow you to weight one set differently than another. The weight multiplies the score by some factor as the set operation is performed. > The other is how it gets purely implemented. Does the weight need to > be known at indexing time, or can it be provided at search time ? My > hunch is the weighing should be applied at search time, so your > product could be modified to take as input the weights to apply to > each index that is being search through ? Could be done either way. Weighing at index time might be more efficient, but would not allow different weights to be applied for different queries. I doubt that query-time weighting would slow things down at all since it is already being done (only the weight factors are always 1). All of the set operations are implemented in C. > Something like: > > result = catalog(dc_fields={"query":"Some search string", > "fields":["Title","Description"]}) > > could become: > > result = catalog(dc_fields={"query":"Some search string", > "fields":["Title","Description"], "weights":[5,1]}) Sure or maybe: result = catalog(dc_fields={"query":"Some search string", "weighted_fields":{'title':5, 'description':1}) This might be slightly less error prone (otherwise you need to match up the lists}, if slightly less readable. :record marshalling for weighted_fields could also be supported for queries from web forms. Either spelling would work though and I'm open to input. > Meaning apply a weight of 5 to Title, and 1 to Description. Which I > would in turn interpret as meaning Title is 5 times more important > than Description (Not knowing any better right now). Yes, scores for words found in the title would get multiplied by 5. Scores for description would get multiplied by 1. > Personally I'm using the Okapi algorithm. When I started > investigating this, I came to the (admitedly uneducated) conclusion > that to do proper, fast weighing, then the Okapi implementation would > have to be modified to support this feature (Maybe it does already > ??), which is over my head, especially with the okascore module being > Python/C. Doing it in python would mean doing a second pass over the > results that have already been scored once, which is innefficient it > seems, and computationally intensive(Especially as I envision th efact > that really really nice weighing algorythms would need to have all > content in memory in order to do relational work between records). I don't think the scoring algorithm would be affected what you propose. I'd need to dig in a little deeper to be sure though. > Anyways, that's what I've been thinking about ... But the benefits of > having such a beast seem really tentalizing, so I thought I'd ask > anyways ... Besides maybe I'm way out to left field on this and it's > easier than I make it out to be ?! :) I think this is a very compelling addition to the product. I'm going to look at implementing it this weekend. Thanks for the idea! -Casey

2 1

Zope 2.7.0 beta 4 Release and Security Update
by Brian Lloyd 10 Jan '04

10 Jan '04

Zope 2.7.0 beta 4 Release and Security Update Zope 2.7.0 beta 4 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.7.0b4 from Zope.org: http://www.zope.org/Products/Zope/2.7.0b4/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.7.0b4 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.7.0b4 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.7.0b4 in the near future. Also note that there are binary code changes in the 2.7.0b4 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.7.0b4/CHANGES.txt - http://www.zope.org/Products/Zope/2.7.0b4/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

1 0