November 2005 - Zope

init.d script and out of place instances
by Fernando Martins 24 Nov '05

24 Nov '05

Thanks for all the replies! I got quite a good picture of the situation. Final solution was to symlink zopectl into init.d and run update-rc.d. In the meanwhile, I've also come across two relevant links which might be useful for someone else: similar problem: http://plone.org/documentation/how-to/helpcenterhowto.2005-10-24.6883487858/ talkback/1130736742/discussionitem_view Debian zope/plone package web page: http://pkg-zope.alioth.debian.org/ Regards, Fernando

1 0

Calling a SQL method from python and storing the results
by Mike Jakowlew 24 Nov '05

24 Nov '05

Here is what I need to accomplish: I need to call a Z-SQL method from within python and store the result in a variable in python. I know this could probably be done easier with ZPT's or DTML, however the program that I've written does many things and depends on this particular variable for the majority of the program. My overall program: Uploads a File (Working) Write an entry to a MS SQL DB (Working) Send an Email to alert user of upload (Working) in this particular case all I need is the id of the last row in the db before the e-mail is sent out. The e-mail itself sends a link that calls another SQL method with ID as the parameter passed. I've tried to use the container.id method, but that just returns the name of the Z-SQL method. Thanks in advance, mjakowlew

2 2

When is access.log written?
by Eddie Butcher 24 Nov '05

24 Nov '05

Can someone please clarify for me.. At what exact stage during accepting and responding to an HTTP request does ZOPE write to it's access.log? When the request is initially received and before it is processed? When ZOPE has finished creating the response and serves the completed page out? I'm trying to determine if apparently poor server performance is caused by a slow web proxy on our network. -- Eddie Butcher Road Tech Computer Systems Ltd. http://www.roadrunner.uk.com 01923 338033

4 7

init.d script and out of place instances
by Fernando Martins 24 Nov '05

24 Nov '05

Hi, As far as I can see and tried, the zope2.8 script only deals with instances which are created in the default instance directory, /var/lib/zope2.8/instance/. I would prefer to keep a specific instance of zope in a different directory, together with other related directories, e.g. files from LocalFS. That is, I prefer to have all directories of the application, zope or not, under a common directory. Is there anything wrong with this approach?? I tried to symlink into the instance into /var/lib/zope2.8/instance but the start script fails. BTW, where are the messages logged? (I'm running Ubuntu) Is there any solution? Is this specific to the distribution? Regards, Fernando

5 4

standard_error_message as PageTemplate?
by Jürgen Herrmann 24 Nov '05

24 Nov '05

hi there! is it possible to replace the standard_error_message dtml method by a page template? has anybody done this? seems like i don't get error_type, error_tb etc... regards, juergen herrmann _______________________________________________________________________ >> XLhost.de - eXperts in Linux hosting << Jürgen Herrmann Bruderwöhrdstraße 15b, DE-93051 Regensburg Fon: +49 (0)700 XLHOSTDE [0700 95467833] Fax: +49 (0)721 151 463027 WEB: http://www.XLhost.de

3 2

Does ZWiki compromise Win2003 security behind a firewall?
by Bill Bell 24 Nov '05

24 Nov '05

Yes or no. OK, I know it's not that simple. I am working in an agency that employs a third party to manage our network. The third party is reluctant to install Zope and ZWiki for me, claiming that this will open "the system" to "potential attacks". The wiki would be for use by agency personnel only and be available on a non-routable address, behind a firewall. Could someone tell me how this could be a security risk? Thanks for any ideas. Bill

2 1

External Methods, Proxy Roles, and Executable Security
by George Lee 23 Nov '05

23 Nov '05

In CMFCore 1.5.4: If a low-security-clearance user calls an external method that pastes an object from a PortalFolder, he gets an error because the following line in CMFCore.PortalFolder fails: if not sm.checkPermission(DeleteObjects, parent): raise AccessControl_Unauthorized This is even the case if "sm.checkPermission" is changed to "_checkPermission", which takes into account proxy roles. The external method does not allow proxy roles attached, so I can't just add a "Manager" proxy role. Because I called the pasting in an external method, I expected it to go through without security problems! Is this a right expectation / and a bug, or a wrong expectation? Peace, George On 11/18/05, George Lee <georgeleejr(a)gmail.com> wrote: > I forget if I submitted a collector issue about this before, but I > didn't see it. I just posted one at > <http://www.zope.org/Collectors/CMF/396>: > > Title: PortalFolder.py _verifyObjectPaste ignores executable security > > Version info: CMF 1.5.4 but also in trunk > > _verifyObjectPaste calls "sm.checkPermission(permission_name,self)" > rather than "_checkPermission(permission_name,self)" > > This makes it ignore executable security. So, if _verifyObjectPaste is > in an external method or in a script with sufficient proxy roles, it > raises an Unauthorized error for users when the external method / > proxy role security should suffice. > > > > On 9/9/05, Dieter Maurer <dieter(a)handshake.de> wrote: > > George Lee wrote at 2005-9-8 23:57 -0400: > > > ... > > >Is it okay to just replace sm.checkPermission with _checkPermission > > >from CMFCore.utils or is that not okay? > > > > Yes. But, please file a bug report as well. > > > > >Also Dieter I noticed that Alan Runyan and you briefly discussed this > > >issue back in 2002: > > >http://mail.zope.org/pipermail/zope-cmf/2002-September/015350.html > > > > Any internal use should always take executable security (i.e. > > executable ownership and proxy roles) into account. > > Not doing so is a but, as things expected to be possible are not > > and (maybe even worse) things expected to be impossible may > > be possible. > > > > There may be a need for application code to check the permissions > > of the user with proxy roles not taken into account. > > > > E.g. a script that must use a "Manager" roles to do one > > thing but does not want to do another unless the current > > user has specific permissions. > > > > For this case, there also should be a method checking > > permissions with proxy roles not taken into account. > > > > -- > > Dieter > > >

4 9

HTML to PDF.
by Fernando Lujan 23 Nov '05

23 Nov '05

Does Anyone has this product in a production environment? It's easy to configure and stuff? We currently are working with the reportlab, but it's painful to change the document... :( I need a product which generates a PDF file on the fly. Any other application or suggestion will be welcome. Thanks, Fernando Lujan

8 19

Zope-2.8.1, LocalFS, and the importance of _p_jar
by John Ziniti 23 Nov '05

23 Nov '05

I've encountered the issue described here: http://mail.zope.org/pipermail/zope/2005-August/161120.html on a recently upgraded Zope using LocalFS. I have tracked down the issue to the fact that the object that LocalFS "hands" to ZODB is a WrapperObject, and this object does not have an oid. This raises an AssertionError during the _commit method of ZODB.Connection. I have traced the code a little bit and I see that this block of code will be avoided for these objects if the objects do not appear in self._registered_objects, which I can achieve by making sure that the object has no _p_jar attribute. If I comment out the line in the LocalFS object where the wrapper object's _p_jar is set to the parent object's _p_jar, everything works fine, with no (apparent) problems. [ I tried also setting obj._p_oid = self._p_oid, but then Zope has pickling problems trying to pickle instances of the wrapper class ]. The problem I have with my "solution" is that I have no clue what _p_jar is. What is _p_jar used for within the Zope model? What are the implications of having an object with self._p_jar=None? What are the implications of a transient object (not stored in the ZODB but on the local filesystem), with self._p_jar=None? Thanks in advance for any information, John Ziniti

3 2

Hard-coded "Content-type:text/xml" as xmlrpc in Zope (2.8.1)
by John Ziniti 22 Nov '05

22 Nov '05

Back in June 2004, I had the following problem: http://mail.zope.org/pipermail/zope/2004-June/151436.html http://mail.zope.org/pipermail/zope/2004-June/151492.html http://mail.zope.org/pipermail/zope/2004-June/151497.html http://mail.zope.org/pipermail/zope/2004-June/151498.html which came about because HTTPRequest.py was hard-coded to assume that any request with a Content-type of "text/xml" is an xmplrpc call and handles the request as such. I resolved this issue with the help of brian(a)zope.org, who gave me the XmlFix product, which monkey-patches the HTTPRequest.processInputs method to respond a bit more appropriately. We noted in the thread that although Zope's behavior is broken, it is unlikely to change for historical reasons. I am fine with this and felt comfortable with the simplicity and supportability of the monkey-patch. This monkey-patch was no longer effective recently when I upgraded our Zope instances to 2.8.1. Zope-2.8.1 now additionally has the zope.app.publication. HTTPPublicationRequestFactory class, which also assumes that "text/xml" means xmlrpc (in fact, it assumes that anything that startswith('text/xml') is an xmlrpc call). Not fixing old code which acts in strange hard-coded ways is something I understand, but adding new code that also acts that way seems like it is getting further away from "good" :) Can anything be done to change the behavior in the HTTPPublicationRequestFactory so that it is not so obtuse? My monkey-patch now has to munge two methods to make xml uploads work and I am less happy with it than I was before. Thanks for your time, John Ziniti

3 2