December 2006 - Zope

[Warning] ZODB use risky in forked processes
by Dieter Maurer 20 Dec '06

20 Dec '06

Crosspost. Reply-To set to "zodb-dev". Yesterday, I spent a day chasing a mysterious ZEO ClientCache corruption bug: A ZEO client implementing a kind of server by forking to process new requests suddenly started to observe ClientCache corruptions (after it had run for several years without problem). The observed corruption was slightly non-deterministic but quite easily reproducible. The analysis revealed that the user object that was logged in by the server (it takes its requests from the ZODB) has been accessed in the forked process (probably during the login in the forked process). This access caused the apparent corruptions. The ClientCache was not really corrupted but the server read the wrong data, probably because the shared file descriptor was moved asynchronously in the forked child. This new observation together with hacks I had to introduce earlier (to prevent the forked child to process invalidation messages destined for the server) indicates that it is highly risky to fork when a ZEO connection has been opened and the forked process uses the ZODB as well (even when it uses its own storages and ZODB databases). -- Dieter

1 0

Zope deadlocks with AttachmentField versions prior to 1.3.11
by Matthew X. Economou 19 Dec '06

19 Dec '06

All, As others have reported (e.g., http://www.nabble.com/AttachmentField-1.3.6,-PloneExFile-3.2.4-and-Plone -2.5-rc3-t1805380.html), Zope hangs in AttachmentField/PortalTransformsAttachment.py when accessing a PloneExFile object (see the attached thread traceback dump). One reported fix is to elide a call to AttachmentHandler.registerHandler(PortalTransformsAttachment) in PortalTransformsAttachment.py. In my case, I upgraded from AttachmentField version 1.3.10 to 1.3.11, which was sufficient to correct the deadlock. I'm currently running PloneExFile 3.2.4, AttachmentField 1.3.11 (was 1.3.10), Plone 2.5.1, CMF 1.6.2, Zope 2.9.6, Five 1.3.7, and Python 2.4.3 on FreeBSD/i386 6.1-RELEASE-p6, in case any of that is relevant. Best wishes, Matthew -- Every time Bruce Schneier smiles, an amateur cryptographer dies. (http://geekz.co.uk/schneierfacts/fact/55)

1 0

Re: Python script, urllib2
by Jonathan 19 Dec '06

19 Dec '06

----- Original Message ----- From: "Mihamina Rakotomandimby" <mihamina.rakotomandimby(a)etu.univ-orleans.fr> To: "Jonathan" <dev101(a)magma.ca> Sent: Monday, December 18, 2006 1:34 PM Subject: Python script, urllib2 > Hi, > I want to fetch at least the <head></head> part of an html static page > from a python script (added through the ZMI). > Here is the content of the python script: > > import urllib2 > t="http://www.asso-polyvalente.fr/" > req=urllib2.Request(t) > h=urllib2.urlopen(req) > the_page=h.read() > print the_page > printed > > Then I get a: > "You are not allowed to access 'Request' in this context" > > Ok. I remember in some ML I subscribe, I could allow some action/module > by listing the allowed actions/modules somewhere. > Unfortunately, I cant remember where/wht to do. > Would you help me? I would recommend using urllib in an external method, not a python script. If you want to use a python script to access the contents of a static page (static page created via the ZMI), why don't you do something like: staticPage = context.restrictedTraverse('/path/to/the/static/page/staticPage.html') The variable staticPage will then hold the contents of the static page and you can process it as you require. Jonathan ps. pls keep your posts on the list so that others can help and so that future generations can find/follow the thread!

3 2

add a File type via a form
by Mihamina Rakotomandimby 18 Dec '06

18 Dec '06

Hi, I have a very simple "index_html". It s a form in which I ask for an "Id" <form action="addFile" method="post"> <div>Id</div> <input type="text" name="id" size="40" /> <input type="submit" name="submit" value="Add File" /> </form> what I want is when the visitor fill the form and then submit it, a "File" object is created inside the same container. I added a Python script named "addFile" in the same container, and tried some things... but always failed. How to create a "File" then? Thank you. PS: I know the danger if an anonymous can do such things as creating an object into a container, but it's just for learnig prupose at the moment.

2 3

Zope, setlocale(), requests and traversal
by Doyon, Jean-Francois 18 Dec '06

18 Dec '06

Hello, I know there is a locale setting in etc/zope.conf, and I make use of it. The problem now, is that I have a multilingual site that I would like to have support multiple locales, per request: One request could be for the french site and content, using the fr_CA locale in my case, but another could be for english, and en_CA ... Localization is done through a traversal hook. So right now I call setlocale() on a per request basis, and it works fine in development. So I'm wondering: - I see the docs mention setlocale might not be threadsafe, since Zope is threaded, anyone know the implications? - If I call setlocale() during traversal, could that setting affect other threads/requests? - If the above 2 are indeed problems, is there some nice way to do set per-request locales, short of completely implementing a custom way of doing it? Thanks! Jean-François Doyon Internet Service Development and Systems Support / Spécialiste de dèveloppements internet et soutien technique Canada Centre for Remote Sensing/Centre Canadien de télédétection Natural Resources Canada/Ressources Naturelles Canada http://atlas.gc.ca Tel./Tél.: (613) 992-4902 Fax: (613) 947-2410

3 5

Building a Zope based site
by John Poltorak 18 Dec '06

18 Dec '06

How much do people charge for building a Zope based site? I've given up on trying to understand Zope myself as it's just too difficult, but suspect it can provide more functionality than other CMS systems. -- John

5 9

Questions about demostorage
by Duncan Booth 18 Dec '06

18 Dec '06

Can someone explain to me what is and is not safe to do with demostorage? Say I have a zope setup involving a zeo server and clients, and I create another zope instance with <demostorage> wrapped around both <zeoclient> mounts (the catalogs are mounted separately from the rest of the content). The main zope setup remains active while I'm using the demostorage setup, so content will be added/edited or deleted in the zeo zodb. A bit of experimenting seems to indicate if I edit an object in the main system, the demostorage version picks up the changes until such time as I edit the same object in the demostorage instance. (So in other words, the connection from the demostorage front-end to the zeo-client isn't frozen at the point when the storage is opened which might have been a plausible alternative). What I'm a little worried about is the catalog. I'd guess that there is no guarantee that the demostorage instance gets a catalog which is consistent with the rest of the data (so I could easily get site errors in the demostorage instance), but there should be no danger that any changes I make can affect the live site and restarting the demo instance would get it back into a consistent state, at least for a while. Is that a reasonable interpretation? What I'm hoping to achieve is a way of testing upgrades on our live system in an environment as close as possible to the real live environment, but without actually affecting the live system in any way. Demostorage seems to offer that as an option.

3 4

[Warning] Danger from Zope caching, especially the CMF Caching Policy Manager
by Dieter Maurer 17 Dec '06

17 Dec '06

Crosspost: 'Reply-To' set to 'zope-cmf'. We nearly escaped a catastrophy: a page with sensitive personal information ended in a shared cache and was delivered to arbitrary people. This happened despite the fact that the template generating the page contained a "response.setHeader('Cache-Control', 'no-cache')" (and related headers for non HTTP/1.1 clients). The analysis quickly revealed broken design in the CMF Caching Policy Manager (CPM) as the cause: * it has applied its general policy depite the fact that the template itself has provided more adequate decisions with respect to caching * the caching policy manager action affects the complete response. Therefore, only the top level object, the object that controls the response content, should influence the CPM decisions. In the concrete case, the primary template did not trigger the CPM but the call of a secondary template responsible only for a tiny part of the response. The same problem also affects Zope's HTMLCacheManager. The description indicates in what direction the CPM should get fixed: * If the response already provides cache control, the CPM should not override it, as it is likely that the specific information available to the response generating process is more trustworthy then the general CPM policies. This is arguable, especially as it changes the current behaviour. Maybe, it should be controlled by an additional configuration option. * The CPM (and Zope's HTTP Cache Manager) must set cache headers only based on the object that generated the (complete) response entity and not based on other objects called during the request (and probably only responsible for part of the entity). -- Dieter

1 0

Login track
by stefan83 17 Dec '06

17 Dec '06

Hello, I have my own information system on Zope. I would like to enable users to login and do acts, what they can do (according to security settings). But I cannot track already logged users. I redirect them into login page, when they want to login. After passing the credentials, they are succesfuly logged. But if they click on the other site on my system, it shows me, that there is not logged user, but Anonymous user. Please, could you help me how to retain information who is currently logged until his logout? I would be very glad, thank you. Domco

3 2

Preserving Context
by Javier Subervi 17 Dec '06

17 Dec '06

Hi; I have a page template which I use to catch and customize 404 errors. In that page, I call a script that offers site navigation. Since I have several sites within a portal, I decided to move all common elements (such as this page) to a central "root" location from which all sites could draw. However, when I did that, this page returned the navigation of that "root" dir! That's not what I want, of course. How do I preserve context for the called script, such that when the page is called, it passes the context from where it was called to the script in question? TIA, Javier ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

3 4