August 2008 - Zope - Zope lists

python split
by Garry Saddington 17 Aug '08

17 Aug '08

Is it possible to split a string at the first occurence of a non-digit character using a python script in zope, or does this need an external method for security purposes? regards garry

3 2

uncataloging
by Darryl Caldwell 17 Aug '08

17 Aug '08

Hey folks, I have looked at the source of Catalog.py but am still confused about what parameters I need to uncatalog an object. Is the uid the same as the object id? That which is returned from obj.getId(), or is it the same as the object Identifier listed on the Catalog tab within the catalog? Thanks in advance. Code samples welcome. -d

5 5

Script (Python) insecure ?
by M.-A. Lemburg 16 Aug '08

16 Aug '08

Hello, after Chris Withers lightning talk at EPC 2008 I had a closer look at the implementation of Python Scripts in Zope 2.11. While I have not yet been able to break out of the restricted environment without help from installed products, there are a few denial-of-service attacks which can easily be deployed on sites allowing adding Python Scripts to a user folder: 1. Attack: Put this into a "Script (Python)" object and run it: return 'kaboom'.encode('test.testall') This results in a denial-of-service, since Zope will hang running the Python test suite. The reason for this is a problem in the way the encoding search function works in Python 2.4. This was changed in 2.5 to no longer allow searching for codecs outside the encodings package. 2. Attack: Put this into a "Script (Python)" object and run it: raise SystemExit This shuts down Zope. The Python Script environment should obviously catch such exceptions and not let them propagate up the call stack. I found the second attack rather surprising, as it doesn't require deep knowledge about Python's interna. Regards, -- Marc-Andre Lemburg eGenix.com Professional Python Services directly from the Source (#1, Aug 12 2008) >>> Python/Zope Consulting and Support ... http://www.egenix.com/ >>> mxODBC.Zope.Database.Adapter ... http://zope.egenix.com/ >>> mxODBC, mxDateTime, mxTextTools ... http://python.egenix.com/ ________________________________________________________________________ :::: Try mxODBC.Zope.DA for Windows,Linux,Solaris,MacOSX for free ! :::: eGenix.com Software, Skills and Services GmbH Pastor-Loeh-Str.48 D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg Registered at Amtsgericht Duesseldorf: HRB 46611

8 18

PROXISOFT Info Service
by info＠proxisoft.de 16 Aug '08

16 Aug '08

Sehr geehrte Damen und Herren, Sie haben eine Email an die Adresse info(a)proxisoft.de gesendet. Wegen massiven Spam Atacken wird diese Adresse nicht mehr betrieben. Um Kontakt mit PROXISOFT auftzunehmen, rufen Sie bitte unsere Homepage www.proxisoft.de in Ihrem Browser auf. Viele Grüße - Ihr PROXISOFT-TEAM. Diese Nachricht wurde als automatische Antwort auf Ihre Email erstellt

1 0

Searching for a range or a value
by Andrea Ratto 16 Aug '08

16 Aug '08

Hi list! I am trying to search for items with an attribute (a price) in a defined range, but I also need to match those which have None in that attribute. The index is a FieldIndex, Zope is at version 2.10 Is there any way to do that without doing two separated queries or installing specific Products? Thank you. Andrea Ratto

3 2

ZEO clusters on a single box
by Jean Jordaan 16 Aug '08

16 Aug '08

Hi there We have a server running many ZEO clusters (many more than the number of CPUs, of course). Each cluster consists of a master and two clients. Would it make sense to run both clients and spread requests across them? Or would it be better to just increase the number of threads of a single client, and only use the second client for './bin/zopectl debug', and for failover if the first client needs to be restarted? Would it ever make sense to have *more* than 2 clients per master, in this scenario (many more processes than CPUs)? So far, I've had the following response to my questions: """ [...] at every zope/plone conference there are people who claim that adding more threads makes no difference and that you should rather add more zeo clients, but my CS background says more threads can share memory and perform better. But for zope it seems that each threads maintains it's own cache anyway, so there is little memory sharing going on. You may as well run 10 clients with one thread each rather than one client with 10 threads, it would make little difference other than the overhead for the extra process, which is less than 100MB. I'm a little disappointed in zope's memory usage patterns. It doesn't really matter how much memory you have or what sorts of limits you impose, it seems zope always uses more and more until it consumes about 1GB of swap and starts killing the box. So you need to monitor RAM usage with nagios or something and restart the instance every so often. On some of our managed machines we restart zope about once an hour because of this. That just doesn't make good sense, you kill your cache every time. """ RTFM with pointers most appreciated. -- jean . .. .... //\\\oo///\\

3 2

Persistent Mapping error with TinyTablePlus.
by Ignacio Valdes 16 Aug '08

16 Aug '08

Hi Chris, When I try to change a Squishdot rightbox_items title or even not change anything and try to save it out I get this error thrown: Site Error An error was encountered while publishing this resource. NameError Sorry, a site error occurred. Traceback (innermost last): * Module ZPublisher.Publish, line 194, in publish_module_standard * Module Products.PlacelessTranslationService.PatchStringIO, line 34, in new_publish * Module ZPublisher.Publish, line 146, in publish * Module Zope2.App.startup, line 222, in zpublisher_exception_hook * Module ZPublisher.Publish, line 115, in publish * Module ZPublisher.mapply, line 88, in mapply * Module ZPublisher.Publish, line 41, in call_object * Module Products.TinyTablePlus.TinyTablePlus, line 446, in manage_editData * Module Products.TinyTablePlus.TinyTablePlus, line 509, in _GenerateIndex NameError: global name 'PersistentMapping' is not defined (Also, the following error occurred while attempting to render the standard error message, please see the event log for full details: 'standard_html_header')

2 1

Zope capacity planning
by Ricardo Bánffy 13 Aug '08

13 Aug '08

Hi folks. I was giving a class on Zope/Plone administration and one of the students asked about an "official" guide on Zope capacity planning. I searched zope.org, asked all mighty Google and wandered through both the darkest and lightest sites that say things about Zope with no success. Is there such a thing? Is there any reference these students can point to when they say they need half-a-ton of servers to serve their requests?

2 1

Re: [Zope] Script (Python) insecure ?
by Garito 12 Aug '08

12 Aug '08

The same question again and again As a Zope user I prefer to know as soon as possible if Zope has security problems like those Perhaps the correct way will be to send the problem to the zope people and 2 weeks later then make it public I think 2 weeks is a very correct period to solve a problem if not, I want to try to solve the problem for myself But I shout my mouth, sorry Andreas ;) 2008/8/12 Andreas Jung <lists(a)zopyx.com> > *sigh* > > I wished that both exploits were reported to the Zope bugtracker in order > to work on solutions before making the exploits public. > > > --On 12. August 2008 13:41:04 +0200 "M.-A. Lemburg" <mal(a)egenix.com> > wrote: > > Hello, >> > > > > >> 1. Attack: >> >> Put this into a "Script (Python)" object and run it: >> >> return 'kaboom'.encode('test.testall') >> >> This results in a denial-of-service, since Zope will hang >> running the Python test suite. >> >> The reason for this is a problem in the way the encoding search >> function works in Python 2.4. This was changed in 2.5 to no longer >> allow searching for codecs outside the encodings package. >> > > That's pretty obscure behavior of Python 2.4...anyway. > > > >> >> 2. Attack: >> >> Put this into a "Script (Python)" object and run it: >> >> raise SystemExit >> >> This shuts down Zope. >> >> The Python Script environment should obviously catch such exceptions >> and not let them propagate up the call stack. >> >> > See the followup on > > <https://bugs.launchpad.net/zope2/+bug/257269> > > There is a patch available that solves the problem. > > Andreas > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope-dev ) > > -- Mis Cosas http://blogs.sistes.net/Garito Zope Smart Manager http://blogs.sistes.net/Garito/670

5 4

Re: [Zope] Page Template help
by Garito 12 Aug '08

12 Aug '08

Use: /path/to/the/object/with/${some/magic/variables}/to/solve/some/paths/in/a/simplest/way You could do that converting the path above to python: path(path('string:' + '/path/to/the/object/with/${some/magic/variables}/to/solve/some/paths/in/a/simplest/way')) or in a generic way: python: path(path('string:' + expr)) No more than 5 o 6 lines changed and a lot of code saved 2008/8/11 Andreas Jung <lists(a)zopyx.com> > > > --On 11. August 2008 15:48:21 +0200 Garito <garito(a)sistes.net> wrote: > > Hi Philipp! >> Thank you so much for your response but in this lines is were the engine >> loads the possibilities but not were evaluate the current expression >> >> I would like to evaluate some condition before to load the class who >> resolves the expression (and witch is loaded in the code you point me) >> >> > Sounds strange to me. Usecase? > > -aj -- Mis Cosas http://blogs.sistes.net/Garito Zope Smart Manager http://blogs.sistes.net/Garito/670

3 9