February 2004 - Zope

RE: [Zope] Persistent references to persistent objects ?!?!
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 08 Feb '04

08 Feb '04

Dieter, Once again, thanks for the good points. Obviously one wouldn't want to create a catalog index on an attribute that just stored references ... that'd be kind of silly, and I'm sure I'd know better :) Security is pretty obviously a concern. As for acquisition, I guess the traversal would happen from the actual object's (Being referenced) point in the tree, not the reference ? (Not that I'd rely on that, I'm just curious at this point). As for Zope 3, yeah well I keep on eye on the development there, but I'm pretty much planning for the worst and a complete review of my code for it anyways, taking full advantage of the new design philosophies in it. (Just planning for the worst mind you). Acquisition has great benefits I must admit. What's always left me ... second-guessing ? the concept, is the acquisition of attributes ... THAT can be quite offputting sometimes. Acquiring objects along the tree however is great, and simplifies incredibly the effort of reducing dupplication of logic or content. In fact, removal of acquisition alone will mean reviewing our site(s) because we depend on it to share content (Move shared content up the tree to the closest common denominator). All in all I'm pretty sure those that use it would like to keep it (At least in some form). I'd suggest since someone from Zope corp is reading, that this should be a feature that stays, but with manager control. The administrator could turn on or off global acquisition, select what gets acquired (instances vs attributes) and how, and so on ... Besides I vaguely recall reading that there will be *some* acquisition available, but much more restricted in nature ? I have to guess someone will eventualy add a context wrapper that DOES do it anyway, even as a third party ? Thanks, J.F. -----Original Message----- From: Dieter Maurer [mailto:dieter@handshake.de] Sent: Saturday, February 07, 2004 7:42 AM To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca Cc: zope(a)zope.org Subject: RE: [Zope] Persistent references to persistent objects ?!?! Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote at 2004-2-6 16:55 -0500: >Hmmm interesting point. I suppose a basic rule of thumb would be that the >reference should never be stored directly as an attribute of a folderish >type ? > >I can imagine many useful scenarios where keeping references to objects can >be very handy (Versioning, workflow, lists of objects, etc ...) ... Although >I have to admit the symlink think had never really even occured to me. I'd >imagine instead maintaining a list of references for instance, maybe stored >as an attribute of some other non-folderish type ... you know maybe build >some content-type class that, as part of it's functionality, keeps >references to objects ? This should make it safe from any unexpected >behavior like the one you describe, right ? I do not think so. You must be prepared that objects retrieved via persistent references maintained by yourself behave differently than those maintained by the "standard" references. Watch out for any situation where the acquisition context is relevant: e.g. indexing, security, locating of central resources (like "MailHost"), ... Taking enough care, you will probably be able to cope with the situation. Your type of usage may be affected by Zope 3. Zope 3 has abandonned acquisition (called "context wrapper"s in Zope 3 terms) (personally, I am sad about this; "acquisition" has been one of my major selling points for Zope). In Zope 3, objects contain a reference to their parent in the hierarchy. This means that objects know their place in the hierarchy which may make it easier to have references to them in various places. -- Dieter

2 1

Rewriting URLs - Call for precisions.
by andre 08 Feb '04

08 Feb '04

Hello, Following the example in the Zope Book, is did the following. Configuration : Windows XP Service Pack 1a (needed by apache 2.0.48) Apache 2.0.48 Zope 2.7.0RC2 No network connection Fresh install, no products added. Zope : A Folder with id 'demosite' added at Zope root and containing the autogenerated index_html object A VHM with id 'VHM' added at Zope root, a host created in Windows etc/hosts file 127.0.0.1 www.example.com Apache : Apache 2.0.48 httpd.conf configured with the following NameVirtualHost * <VirtualHost *> ServerName www.example.com RewriteEngine On RewriteRule ^/(.*) http://127.0.0.1:8080/VirtualHostBase/http/www.example.com/demosite/Virtual… </VirtualHost> when i try to access www.example.com, the index_html is called but the url appearing in the navigator's url box is : http://127.0.0.1:8080/VirtualHostBase/http/www.example.com/demosite/Virtual… How can i modify the url ? TIA André

3 6

Re: eval in DTML
by Gregory Dudek 08 Feb '04

08 Feb '04

To do an eval that's fairly safe, you could use an external method like def my_zope_eval(s,dict=None): '''evaluate *s* in *dict*.''' if dict is None: dict= {} dict['__builtins__']= None return eval(s,dict) This is an old solution due to Dieter. Note that there are still dangerous things that a malicious use could do with this. There are several alternatives. Using RestrictedPython may allow for other nice solutions. Greg

1 0

Proxy Authorization for Page Templates
by Edward Pollard 07 Feb '04

07 Feb '04

In regards to Proxy Authorization for Page Templates: 1) Is there a reason they don't have it out of the box? 2) Is there any way to modify them so they can have this? For most of my work, the python scripts are called from page templates. Being able to restrict the execution of those scripts to a specific page template via proxy authorization would be very desirable. I use this feature to prevent direct execution of the Z SQL Methods the scripts call, but cannot protect the scripts in a similar fashion which is somewhat frustrating. Edward

3 3

Code protection in Zope
by Celula Research 07 Feb '04

07 Feb '04

Now that the issue has come up... What would be a good way to protect code in Zope, both in straight Python code in the file system -Products/Extensions- and dtml/tal ? We have developed solutions which would like to install in customer's equipment, nevertheless, we can't or don't want to give out the source code and/or risk the products to be distributed without the appropriate permissions, therefore we are looking for some sort of safeguarding the code. I know this may look as against the "Open Source" model, but unfortunately, contracts, NDAs and all that stuff DO exist and therefore we are obliged to comply with them. Any comments are more than welcome. Edward > by the way, .pyc files don't protect your code very well, > if that's why you're shipping only them. > > -- > > Paul Winkler > http://www.slinkp.com > Look! Up in the sky! It's JONIC LIMP BIMBO! > (random hero from isometric.spaceninja.com) > >

5 4

Antigen found VIRUS= MyDoom.A@m (Norman, Sophos, CA(InoculateIT), CA(Vet)) worm
by Antigen_GGECLNODE1＠gemplus.com 07 Feb '04

07 Feb '04

Antigen for Exchange found data.pif infected with VIRUS= MyDoom.A@m (Norman,Sophos,CA(InoculateIT),CA(Vet)) worm. The message is currently Purged. The message, "Test", was sent from zope(a)zope.org and was discovered in SMTP Messages\Inbound located at GEMPLUS/First Administrative Group/GGECLNODE1.

1 0

Apache Rewrite Rules
by Tim Zegir 07 Feb '04

07 Feb '04

I have the following rewrite rule in my httpd.conf file. <VirtualHost *> ServerName dev.mydomain.com.au RewriteRule ^/(.*) http://localhost:8080/VirtualHostBase/http/dev.mydomain.com.au:80/mydomain/… [NC,L,P] </VirtualHost *> I am running Mandrake 9.2 with Apache 2 and zope 2.7rc2 When I go to dev.mydomain.com.au i get the standard apache frontpage not the redirected zope page. If i go to dev.mydomain.com.au:8080/mydomain i get the page i want. can anyone tell me what is wrong with my VirtualHost -- Tim Zegir <trzegir(a)ncable.net.au>

2 1

Re: eval in DTML
by Josef Meile 07 Feb '04

07 Feb '04

> You can't use 'eval' in either a DTML method or a python script. You have > to create an external method to use 'eval'. It's a bad idea. When I was a newie, I also figured out the same solution, but somebody said: "What if instead of a list, some bad user pass: rm -Rf?" So, it seems an useful command, but in fact it is dangerous. My suggestion for the thread author: if you can't send a list as somebody said, then remove the first and last square braces and do a split. Off couse this will only work if your list is very simple; on the contrary, if you use lists of lists, you will have to do some kind of recursive function. Regards, Josef

3 2

AntiVir ALERT [your mail: "*SPAM* Score: 07.54/06.50 - HELLO"]
by AvMailGate＠mailhost.dueihh.de 07 Feb '04

07 Feb '04

* * * * * * * * * * * * * * * AntiVir ALERT * * * * * * * * * * * * * * * This version of AntiVir is licensed and full featured. AntiVir has detected the following in a mail from your address: Worm/MyDoom.A2 virus The mail was not delivered. Please remove any potential malicious software from your computer before sending a new mail with attachments. Mail-Info: --8<-- Message-Id: <20040207130619.7D1DA123F3(a)mailhost.dueihh.de> From: zope(a)zope.org To: boers(a)duei.de Date: Sat, 7 Feb 2004 14:06:15 +0100 Subject: *SPAM* Score: 07.54/06.50 - HELLO --8<-- -- AntiVir for UNIX Copyright (C) 1994-2002 by H+BEDV Datentechnik GmbH. All rights reserved. For more information see http://www.antivir.de/ or http://www.hbedv.com/

1 0

RE: [Zope] Persistent references to persistent objects ?!?!
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 07 Feb '04

07 Feb '04

Dieter, Hmmm interesting point. I suppose a basic rule of thumb would be that the reference should never be stored directly as an attribute of a folderish type ? I can imagine many useful scenarios where keeping references to objects can be very handy (Versioning, workflow, lists of objects, etc ...) ... Although I have to admit the symlink think had never really even occured to me. I'd imagine instead maintaining a list of references for instance, maybe stored as an attribute of some other non-folderish type ... you know maybe build some content-type class that, as part of it's functionality, keeps references to objects ? This should make it safe from any unexpected behavior like the one you describe, right ? Thanks for the insight ... J.F. -----Original Message----- From: Dieter Maurer [mailto:dieter@handshake.de] Sent: Friday, February 06, 2004 3:57 PM To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca Cc: zope(a)zope.org Subject: Re: [Zope] Persistent references to persistent objects ?!?! Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote at 2004-2-5 16:38 -0500: >I was toying with a few ideas, and discovered that I can actually store in a >persistent manner references to other persistent objects !! > ... >This is nice because it allows to point to an object without using paths and >traversal (So it's quick and dirty), and the reference is maintained through >a rename. > >I can see some problems related to security, such as if traversal is not >used, then some security can be by-passed ... Effectively, the same object resides then at different places in the Zope hierarchy. This can be very confusing: We used Shane's "symlink" product that has similar properties. A colleague was able to delete the complete ZCatalog content by deleting an object containing a symlink. The deletion caused a recursive "manage_beforeDelete" which followed the symlink and unindexed all objects referenced from the link target. Similar things may happen with your "multi-place" objects (especially, "catalog"s and "acquisition" may work inconsistently, depending how you access your objects). -- Dieter

3 2