October 2011 - Zope - Zope lists

Hotfix for security vulnerability
by Tres Seaver 25 Oct '11

25 Oct '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Zope security response team, I would like to announce the availability of a hotfix for a vulnerability inadvertently published earlier today. 'Products.Zope_Hotfix_20111024' README ====================================== Overview - -------- This hotfix addresses a serious vulnerability in the Zope2 application server. Affected versions of Zope2 include: - - 2.12.x <= 2.12.20 - - 2.13.x <= 2.13.6 Older releases (2.11.x, 2.10.x, etc.) are not vulnerable. The Zope2 security response team recommends that all users of these releases upgrade to an unaffected release (2.12.21 or 2.13.11) as soon as they become available. Until that upgrade is feasible, deploying this hotfix also mitigates the vulnerability. Installing the Hotfix: Via 'easy_install' - ------------------------------------------- If the Python which runs your Zope instance has 'setuptools' installed (or is a 'virtualenv'), you can install the hotfix directly from PyPI:: $ /prefix/bin/easy_install Products.Zope_Hotfix_20111024 and then restart the Zope instance, e.g.: $ /path/to/instance/bin/zopectl restart Installing the Hotfix: Via 'zc.buildout' - ----------------------------------------- If your Zope instance is managed via 'zc.buildout', you can install the hotfix directly from PyPI. Edit the 'buildout.cfg' file, adding "Products.Zope_Hotfix_20111024" to the "eggs" section of the instance. E.g.:: [instance] recipe = plone.recipe.zope2instance #... eggs = ${buildout:eggs} Products.Zope_Hotfix_20111024 Next, re-run the buildout:: $ /path/to/buildout/bin/buildout and then restart the Zope instance, e.g.: $ /path/to/buildout/bin/instance restart Installing the Hotfix: Manual Installation - ------------------------------------------- You may also install this hotfix manually. Download the tarball from the PyPI page: http://pypi.python.org/pypi/Products.Zope_Hotfix_20111024 Unpack the tarball and add a 'products' key to the 'etc/zope.conf' of your instance. E.g.:: products /path/to/Products.Zope_Hotfix_20111024/Products and restart. Verifying the Installation - -------------------------- After restarting the Zope instance, check the 'Control_Panel/Products' folder in the Zope Management Interface, e.g.: http://localhost:8080/Control_Panel/Products/manage_main You should see the 'Zope_Hotfix_20111024' product folder there. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6l3pQACgkQ+gerLs4ltQ66AgCfT1cd94LXzBtdzNiBqKXnGBIF 7dwAoISO0AkuvERn+cw4W0cPo82c5r+D =xRBY -----END PGP SIGNATURE-----

4 5

Re: [Zope] serious security hole in manage users / Manage users permissions?
by Niels Dettenbach 25 Oct '11

25 Oct '11

Am Montag, 24. Oktober 2011, 17:03:52 schrieben Sie: > Thanks for your info. Any idea if this affects pre 2.10 zope? We've been > running in production 2.9 no problems for a while. No, from my tests all versions in 2.12.20 and 2.13.10 was affected - earlier not - im just wondering why the sec advisory means <=2.13.6. Will investigate that further... > This hotfix addresses a serious vulnerability in the Zope2 > application server. Affected versions of Zope2 include: > > - 2.12.x <= 2.12.20 > > - 2.13.x <= 2.13.6 best regards, Niels. -- --- Niels Dettenbach Syndicat IT&Internet http://www.syndicat.com/

1 0

Manipulating images in Zope/Python
by Brian Sullivan 25 Oct '11

25 Oct '11

I am looking for strategy to programmatically create a customized printable certificate of completion for our Learning Delivery System courses (the system is Zope/Python based). My current plan is to use the Python Imaging Library to create the image (probably by overlaying some text on a stock image of a completion certificate to create a new image). The final image will then be emailed as an attachment to users. Is this a reasonable approach? Any others that anybody can suggest? Any samples of doing anything like this that anyone can point to?

3 2

serious security hole in manage users / Manage users permissions?
by Niels Dettenbach 24 Oct '11

24 Oct '11

Dear Zope 2.12/.13 (4.0) devels, as far as i can see i may have found a serious security hole within Zope 2.12 / 2.13 (4.0 not tested yet) - I'm still investigate here further... problem: ====== Even on fresh Installs of Zope and fresh created instances on it anonymous / remote users able to access acl_users/manage_users by the web WITHOUT AUTHENTICATION. They can edit / delete / create users and serving roles as they want. Other management screens (as manage_main or manage_access aso. are protected as usual). In manage_access Manage user is only allowed for Manager (as by default). I don't believe that is any new behaviour of newer Zope versions... I've tested this with (last public) 2.13.10 and last 2.12.20 with python2.6. If any of the devels want to have a test url pls contact me directly. Fresh installed zope instances was configured with defaults configs, except setting "user zope" (and/or port-base). Tried it with now owner or the admin user as owner of the acl_users too. Can anyone prove this here too? If so, any solution / security fix? many thanks, best regards. Niels. -- --- Niels Dettenbach Syndicat IT&Internet http://www.syndicat.com/

3 2

Urgent:utilsation of paybox with fora zope application
by Diana Lenar 20 Oct '11

20 Oct '11

Hello i am have created a zope application which needs to use paybox i have installed the paybox module in www/cgi-bin/ of the server where zope 2.9 is installed how do i acess the module from my application? pls respond me quickly its very urgent -- Diana.Lenar Analyste Programmeuse 01 41 13 14 48

3 2

Error migrating Zope Data.fs from 2.10 to 2.13: object.__new__(Args) is not safe
by Frank Kauff 14 Oct '11

14 Oct '11

Hi all, when trying to move from Zope 2.10 to 2.13, I ran into a problem. I successfully stripped versions out of my Data.fs (thanks to this mailing list). Now Zope starts up properly and displays the manage page, but when I try to access the various folders of the site, I get the error below. Any ideas about how to overcome this? Thanks, Frank Zope Error Zope has encountered an error while publishing this resource. *Error Type: TypeError* *Error Value: (', use Persistence.Persistent.__new__()', , ())* Traceback (innermost last): * Module ZPublisher.Publish, line 126, in publish * Module ZPublisher.mapply, line 77, in mapply * Module ZPublisher.Publish, line 46, in call_object * Module Shared.DC.Scripts.Bindings, line 322, in __call__ * Module Shared.DC.Scripts.Bindings, line 359, in _bindAndExec * Module App.special_dtml, line 185, in _exec * Module DocumentTemplate.DT_Let, line 77, in render * Module DocumentTemplate.DT_In, line 647, in renderwob * Module DocumentTemplate.DT_In, line 772, in sort_sequence * Module ZODB.Connection, line 860, in setstate * Module ZODB.Connection, line 914, in _setstate * Module ZODB.serialize, line 612, in setGhostState * Module ZODB.serialize, line 605, in getState * Module ZODB.broken, line 106, in __new__ TypeError: ('object.__new__(Args) is not safe, use Persistence.Persistent.__new__()', <class 'Shared.DC.ZRDB.Aqueduct.Args'>, ())

2 2

Urgend help needed: Error migrating Zope Data.fs from 2.10 to 2.13: object.__new__(Args) is not safe
by Frank Kauff 14 Oct '11

14 Oct '11

Sorry for the repost, but I'm lost, and really need to solve this problem... When trying to move Data.fs from Zope 2.10 to 2.13, I first ran into the "version problem", but I successfully stripped versions out of my Data.fs (thanks to this mailing list). Now Zope starts up properly and displays the manage page, but when I try to access the various folders of the site, I get the error below. Any ideas about how to overcome this? How have others convrted their data? Should I move Data.fs in small stepss from 2.10 to 2.11, then to 2.12, and then to 2.13? Is this a common compatibility issue, or some other error in Data.fs? Any help would be greatly appreciated! Thanks, Frank Zope Error Zope has encountered an error while publishing this resource. Error Type: TypeError Error Value: (', use Persistence.Persistent.__new__()', , ()) Traceback (innermost last): Module ZPublisher.Publish, line 126, in publish Module ZPublisher.mapply, line 77, in mapply Module ZPublisher.Publish, line 46, in call_object Module Shared.DC.Scripts.Bindings, line 322, in __call__ Module Shared.DC.Scripts.Bindings, line 359, in _bindAndExec Module App.special_dtml, line 185, in _exec Module DocumentTemplate.DT_Let, line 77, in render Module DocumentTemplate.DT_In, line 647, in renderwob Module DocumentTemplate.DT_In, line 772, in sort_sequence Module ZODB.Connection, line 860, in setstate Module ZODB.Connection, line 914, in _setstate Module ZODB.serialize, line 612, in setGhostState Module ZODB.serialize, line 605, in getState Module ZODB.broken, line 106, in __new__ TypeError: ('object.__new__(Args) is not safe, use Persistence.Persistent.__new__()', <class 'Shared.DC.ZRDB.Aqueduct.Args'>, ())

2 1

Conversion old.zope.org to static site
by Jens Vagelpohl 14 Oct '11

14 Oct '11

Hi all, Just as a heads-up: Jim Fulton and I have converted old.zope.org to a static website. This allows ZC to decommission the hardware and reduces the maintenance burden for everyone involved. We have tried to keep all URLs intact and the site navigation working at the same time, which required a little creative thinking. Some of you rely on resources from the old.zope.org site, such as release tarballs of older Zope versions and other products. Please test and ensure the files you need are still where you expect them. If you have problems, just contact me off-list and I'll take a look. jens

2 4

File upload again
by Jaroslav Lukesh 14 Oct '11

14 Oct '11

Hi all, I want upload csv file for direct processing into SQL only, not for save to ZODB nor LocalFS. Upload for LocalFS already worked for me. So I have form: <form method="POST" enctype="multipart/form-data"> <input type="file" name="fcsv" value="" size="50"><br> <input type="file" name="fcsv2" value="" size="50"><br> <input type="submit" name="fileupload" value="Upload"> </form> Diagnostic processing: <dtml-var "fcsv.filename">::<dtml-var "fcsv.headers['Content-Type'] ">::<dtml-var fcsv> And what it get: data_2011.CSV::application/vnd.ms-excel:: Su upload worked, but what I can access to data of the uploaded file? the dtml-in does not process anything, only displays NO DATA. <dtml-in "PyS_csvimport(fcsv)" prefix="pys"> <dtml-var pys_item><br> <dtml-else> NO DATA </dtml-in> PyS_csvimport parse CSV file by line and return array structure like this [['',''],['','']]. If I use TEXTAREA instead of file upload, dtml-in works. How to get CSV file content to processing? Many thanks, Jaroslav Lukesh PS: HTTP Request loks like that: http://myhost/csvimport/ POST /csvimport/ HTTP/1.1 Host: myhost (......) Content-Type: multipart/form-data; boundary=---------------------------30333176734664 Content-Length: 21822 -----------------------------30333176734664 Content-Disposition: form-data; name="fcsv"; filename="data_2011.CSV" Content-Type: application/vnd.ms-excel (....bulk od CSV data.....) -----------------------------30333176734664 Content-Disposition: form-data; name="fcsv2"; filename="data_2011_kd.CSV" Content-Type: application/vnd.ms-excel (....bulk od CSV data.....) -----------------------------30333176734664 Content-Disposition: form-data; name="fileupload" Upload -----------------------------30333176734664-- HTTP/1.1 200 OK Server: Zope/(Zope 2.10.13-final, python 2.4.6, linux2) ZServer/1.1 Date: Fri, 14 Oct 2011 09:21:48 GMT Content-Length: 2389 Content-Type: text/html; charset=cp1250

2 2

Error Migration Data.fs from Zope 2.10.4 to 2.13.8
by Frank Kauff 06 Oct '11

06 Oct '11

Hi all, I'm trying to update from Zope 2.10.4 to 2.13.8 and have problems to copy Data.fs. No matter whether I try to directly copy Data.fs or use repozo, both times zope gives me the error ValueError: Non-zero version length. Versions aren't supported. Searching the net, this seems to be a common problem. However, I couldn't find a solution for it. Is there a tool anywhere that can convert Data.fs from older to newer formats? Thanks, Frank

3 8