January 2005 - Zope - Zope lists

[Security advisory] Zope 2.7 + 2.8
by Andreas Jung 12 Jan '05

12 Jan '05

Synopsis: Due to an error in the cAccessControl module of Zope it is possible to bring down a complete Zope site as documented in http://mail.zope.org/pipermail/zope-dev/2004-December/024087.html This exploit causes a segmentation fault of the Python interpreter. Vulnerable for this exploit are at least all Zope installations that allow untrusted users to edit ZPTs (possibly DTML as well) either through the ZMI or through the file system. Affected versions: Zope 2.7.X, Zope 2.8.X Recommended solution: Turn off cAccessControl and enable the Python AccessControl implementation in etc/zope.conf (this line is commented in the default configuration): security-policy-implemenation python A fixed implementation of cAccessControl will be included in the upcoming Zope 2.7.4 beta 2 release. ---- Andreas Jung Zope 2 Release Manager

3 5

Re: [Zope] GPL question
by Alan Snyder 12 Jan '05

12 Jan '05

I guess I'm still unsure about what the phrase "based on" and "derived from" means in the context of writing content and building a site based on plone and zope. My stuff wouldn't be able to work directly without plone and zope, but on the other hand, it's not an extension of plone and is not derived from it either. I'll have to keep poking around. On Mon, 6 Dec 2004 13:28:23 +1300, Phillip Hutchings <sitharus(a)gmail.com> wrote: > On Sat, 4 Dec 2004 14:16:32 -0500, Alan Snyder <alan8373(a)gmail.com> wrote: > > > > Hi everyone. I have a sort-of off-topic question about zope, plone and > > the GPL. If I write an application that sits on top of plone by using > > the CMF and the plone components and such, how must my portions be > > licensed? I've not written anything yet but just to be sure, if i > > write plone stuff that calls plone and cmf and zope functions and > > objects, must that also be GPL'd. I was under the assumption that > > calling GPL software didn't required making your stuff GPL but if you > > were to write code inside a module that is already gpl'd - like > > expanding it, then you'd obviously have to gpl it because you're > > modifying code - not writing new code. Also, I know the zope license > > is ZPL and more commercially friendly than the gpl, but plone is gpl > > so obviously there is a boundary there that is being enforced > > correctly. > > > > TIA > > From the last time I got involved with this, anything that is based on > or derived from (this, iirc, includes any product that relies on a GPL > product to function) must be released under the GPL. > > Of course, the GPL only states that anyone who obtains a copy of the > software must also have the source code available at a cost no more > than the media required to send them the source ($5 tops more or > less). You don't actually have to give the source away, and you are > allowed to charge for the software. > > -- > Phillip Hutchings > http://www.sitharus.com/ > sitharus(a)gmail.com / sitharus(a)sitharus.com >

3 5

RE: [Zope] ZEO-Client
by Arenz, Ralph 12 Jan '05

12 Jan '05

-----Ursprüngliche Nachricht----- Von: Tino Wildenhain [mailto:tino@wildenhain.de] Gesendet: Mittwoch, 12. Januar 2005 11:34 An: Arenz, Ralph Cc: 'zope(a)zope.org' Betreff: Re: [Zope] ZEO-Client On Wed, 2005-01-12 at 11:16 +0100, Arenz, Ralph wrote: > Hi, > > i' am using Zope-2.7.3 and i wan't my client-storages to be connected at > zope-startup. > In Zope-2.6.3 i used "open_at_startup" in DBTab but this option seems not to > be included > in release 2.7.3, however i can't find it in component.xml. If i add it to > zope.conf anyway i get > an exception. >What do you mean by "open_at_startup"? >If you configured the storages in zope.conf, >you go to ZMI and add a DBTab Mount point, >check all storages you want to mount >and add. From now on the clients are connected >each time zope starts. >HTH >Tino The option "open_at_startup" means that the client-databases are opened at zope-initialization (not when zope is already up). If this fails zope won't come up. That feature is useful if Zope shouldn't run without an paticular storage.

2 1

Re: [Zope-CMF] sluggish images in CMF?
by Ausum Studio 12 Jan '05

12 Jan '05

I had similar problems when I used to login to my local Zope installation having CookieCrumbler in-between. Ausum ----- Original Message ----- From: "Chris Withers" <chris(a)simplistix.co.uk> To: "Dieter Maurer" <dieter(a)handshake.de> Cc: <zope-cmf(a)zope.org> Sent: Friday, December 03, 2004 9:18 AM Subject: Re: [Zope-CMF] sluggish images in CMF? > Dieter Maurer wrote: > >>A CMF 1.5 site I'm working on seems to be suffering from sluggish images > >>(and maybe overall sluggish performanc :-S) > > > > Maybe the still not fixed problem on Windows with > > "debug-mode on"? > > > > You know we had a lengthy discussion about a year ago. > > This problem should have been fixed ages ago! > > Are there any open collector issues for this? > > I think the stuff we were talking about has been resolved, since there's > only one use of os.platform now, and I'm pretty sure it needs to be there... > > > If the image is small, sending the "not modified" response > > takes as much time than delivering the image itself. > > It should be in the order of a few ms. > > Indeed. I made things a lot better by turning the security policy back > to the C implementation. I've also noticed that the real slowness only > comes when I hit the reload button on IE or Mozilla, without any Ctrl or > Alt modifiers. Why would this cause all the images to reload? > > I feel like I'm missing something simple that I should sort out before I > start profiling... > > Chris > > -- > Simplistix - Content Management, Zope & Python Consulting > - http://www.simplistix.co.uk > _______________________________________________ > Zope-CMF maillist - Zope-CMF(a)lists.zope.org > http://mail.zope.org/mailman/listinfo/zope-cmf > > See http://collector.zope.org/CMF for bug reports and feature requests >

2 1

ZEO-Client
by Arenz, Ralph 12 Jan '05

12 Jan '05

Hi, i' am using Zope-2.7.3 and i wan't my client-storages to be connected at zope-startup. In Zope-2.6.3 i used "open_at_startup" in DBTab but this option seems not to be included in release 2.7.3, however i can't find it in component.xml. If i add it to zope.conf anyway i get an exception. Any suggestions? Ralph

2 1

Fancy selection with checkboxes
by Florian Reiser 11 Jan '05

11 Jan '05

Hello Zopistas, I have an hierarchical structure (e.g. folders). With this structure I want to generate a tree in Zope, where each item has a checkmark. If I select one checker, then all items below it should be selected, too. If I then uncheck one checker, then the checker above that, should appear gray. Maybe you know this tree from graphical tape backup applications. Is there a product for zope, which helps me generating such a tree? Regards Florian Reiser -- +++ GMX - die erste Adresse f�r Mail, Message, More +++ 1 GB Mailbox bereits in GMX FreeMail http://www.gmx.net/de/go/mail

4 4

dreamwaeaver, zope, and webdav
by Doug Reiland 11 Jan '05

11 Jan '05

I can't figure out the magic needed to get dreamweaver mx 2004 and zope configured. I am sorry if this information is been already discussed, but I can only find old or disjointed information. I am using the latest 2.7.x zope. and Dreamweaver MX 2004. I have configured Dreamweaver's webdav access to my site without problems. What is the story on accessing zope's file (for example index_html) in dreamweaver? Is there other setup issues needed for Dreamweaver to handle zope's file/tags? Are there better options for external editors for zope? I see some talk about put_factory configuration from years past, but it is not clear to me what that is or if it still is needed. Again, I am sorry if this is rehash, but I would think there would be cookier cutter setup steps somewhere. Thanks in advance

11 21

Authenticated SMTP.
by Fernando Lujan 11 Jan '05

11 Jan '05

Hi everyone, That's a simples question... Are there some product that send e-mail messages like maildrophost and support authenticated smtp? Thanks in advance. Fernando Lujan

3 4

Generating Short (unique) IDs
by Jeff Rodriguez 10 Jan '05

10 Jan '05

I'm currently running a Zope CMF/Plone site, here's my situation: I have a folder that contains several of a custom content type I created called an "EscalationDoc". What I plan on doing is creating another folder to store another custom content type called "EscalationID", each EscalationID will be linked to an EscalationDoc. The reasoning for this is I need to be able to swing what EscalationDoc an EscalationID points to. My problem is that Zope generates very long IDs, like "escalationdoc.2005-01-07.0744968113". These IDs will need to be remembered and entered by humans so I need a short, sequential, unique IDs. If I could use some sort of mutex in Zope I could probably figure this out, but I'm not aware of any such mechanism. Any suggestions? -- Jeffrey Alan Rodriguez Jeffrey.Rodriguez(a)gmail.com

1 0

RE: [Bug] TemporaryStorage memory leak (was: RE: [Zope] Zope 2.7.3 Memory Leaks)
by Andy Yates 10 Jan '05

10 Jan '05

Many Thanks! When I run my test Zope seem to reuse the memory now. I still don't understand why it is never released all together, but I can certainly live with reuse. Thanks again for your help. Andy > -----Original Message----- > From: Dieter Maurer [mailto:dieter@handshake.de] > Sent: Friday, January 07, 2005 3:39 PM > To: Andy Yates > Cc: zope(a)zope.org; andreas.jung(a)haufe.de > Subject: [Bug] TemporaryStorage memory leak (was: RE: [Zope] Zope 2.7.3 Memory Leaks) > > Andy Yates wrote at 2005-1-6 16:19 -0600: > > ... > >Can anybody else reproduce these results? > > You have been right. > > The leak is caused by a bug in > "tempstorage.TemporaryStorage.TemporaryStorage._takeOutGarbage" > > It performs the zero refcount check for a child of a deleted > object *before* it has decremented the refcount. As a > consequence, it does not release children of a deleted object. > > I attach a script that reproduces the problem in an easier way. > Calling it with "bin/zopectl run" will consume about 200 MB of RAM > for about 5 min. > > I also attach a patch. > > > I will file a bug report. > > -- > Dieter

2 1