Zope January 2012

zope@zope.dev

9 participants
10 discussions

missing info on vulnerability
by Yuri 30 Jan '12

30 Jan '12

Hi all! the zope2.zope.org page miss any info about this vulnerability: http://permalink.gmane.org/gmane.comp.web.zope.announce/1513

1 0

Form issue with apache frontend
by Encolpe Degoute 29 Jan '12

29 Jan '12

Hello, I'm facing a strange bug between Apache and Zope. I'm suspecting Apache but I need to prove that Zope isn't at the origin of this mess. In the two files attached you have the request sent by firefox logged with livehttpheaders (request.orig.txt) and the request read in ZPublisher/Publisy.py=>publish with request.stdin.read(). You can see that a part of the request overload the start's of it. The size of file in the request is 6855 bits. I don't understand how this is possible. Two apache servers and one ZEO cluster composing the architecture : - the first Apache 2.1 is a FreeBSD gateway for external requests : it's using SSL with an homemade certificate and ProxyPass/ProxyPassReverse to redirect to the second server on the 8080 port - the second Apache 2.2 server is on Windows Server 2003 and listening on 80 and 8080. - the port 80 for all local requests with mod_auth_sspi to handle the SSO and redirect to a first ZEO client - the port 8080 for outside requests from the first Apache server without SSO and redirect to a second ZEO client There is a know bug with apache and SSL but only for requests above 128KB: here the request's weight is about 8KB. Is there something that modifies the incoming request before it comes in the publish module ? Regards, -- Encolpe Degoute <encolpe.degoute(a)quadra-informatique.fr>

1 0

Checking multiple variables existence
by Justin Dunsworth 24 Jan '12

24 Jan '12

Is there any way to check if multiple variables exist in the same if statement? Right now I am having to writing multiple nested if statements but can be quite cumbersome... so just looking for an easier way. Currently I'd have to write: <dtml-if var1> <dtml-if var2> <dtml-if var3> <dtml-else> </dtml-if> <dtml-else> </dtml-if> <dtml-else> </dtml-if> When it would be easier to do something like: <dtml-if "var1 and var2 and var3"> <dtml-else> </dtml-if> I've tried multiple different methods to accomplish this but haven't had any luck... so is there an easier way to check multiple variables existence in the same check? Thanks.

2 4

Re: [Zope] zope2.13.12 & ZMySQLDA
by Sascha Gottfried 24 Jan '12

24 Jan '12

Almost everything you need to know for a start is here - stop googling. To keep it easy use this installation method first. http://docs.zope.org/zope2/releases/2.13/INSTALL.html#id2 1) Install virtualenv 2) Create a virtualized Python environment using virtualenv named my_zope 3) optionally - active your virtualenv 4) install Zope2 egg with this command: (my_zope) d:\dev\my_zope>Scripts\easy_install.exe -i http://download.zope.org/Zope2/index/2.13.12 Zope2 5) install Products.ZSQLMethods (my_zope) d:\dev\my_zope>Scripts\easy_install.exe Products.ZSQLMethods 6) install Products.ZMySQLDA (my_zope) d:\dev\my_zope>Scripts\easy_install.exe Products.ZMySQLDA 7) create a Zope instance outside the virtualenv environment http://docs.zope.org/zope2/releases/2.13/INSTALL.html#creating-a-zope-insta… Using easy_install every egg package installs its dependencies. That means that package Products.ZMySQLDA installs mysql-python package for you. Use this power to get up and running quickly. Learn more about python packages here: http://guide.python-distribute.org/ Learn more about using buildout and recipes if you are comfortable with these topics above: http://www.buildout.org/docs/index.html http://pypi.python.org/pypi/plone.recipe.zope2instance Good luck! Am 23.01.2012 16:27, schrieb Giampiero Benvenuti: > Hello, > > > thank you for your help! > > I'm quite new with the eggs installation and I don't have any clue on > how to proceed. Could you please give me some tips or direction where > I can find a simple how to? > I did google it quite a lot, but I couldn't find a precise answer. > > Thanks a lot, > > Giampiero > > > On Jan 23, 2012, at 1:09 PM, Sascha Gottfried wrote: > >> Hi Giampiero, >> >> you need to provide "Products.ZSQLMethods" to your Zope instance. You >> get the egg package here: >> http://pypi.python.org/pypi/Products.ZSQLMethods >> >> Good luck, >> Sascha >> >> Am 23.01.2012 12:19, schrieb Giampiero Benvenuti: >>> Hello, >>> >>> I'm running zope2.13.12, python 2.7.1 and I'm trying to install >>> ZMySQLDA 3.1.1. >>> In the zope_event log I get this error: >>> >>> ------ >>> 2012-01-23T12:11:17 ERROR Application Couldn't install ZMySQLDA >>> Traceback (most recent call last): >>> File >>> "/home/giampiero4/webapps/zope/lib/python2.7/Zope2-2.13.12-py2.7.egg/OFS/Application.py", >>> line 658, in install_product >>> global_dict, global_dict, silly) >>> File >>> "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/__init__.py", >>> line 90, in <module> >>> import DA >>> File >>> "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/DA.py", >>> line 92, in <module> >>> from db import DBPool, DB >>> File >>> "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/db.py", >>> line 114, in <module> >>> from joinTM import joinTM >>> File >>> "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/joinTM.py", line >>> 3, in <module> >>> from Shared.DC.ZRDB.TM import TM >>> ImportError: No module named ZRDB.TM >>> ------ >>> >>> Can someone help me out with this issue? >>> >>> Thanks a lot, >>> >>> Giampiero >>> _______________________________________________ >>> Zope maillist - Zope(a)zope.org >>> https://mail.zope.org/mailman/listinfo/zope >>> ** No cross posts or HTML encoding! ** >>> (Related lists - >>> https://mail.zope.org/mailman/listinfo/zope-announce >>> https://mail.zope.org/mailman/listinfo/zope-dev ) >> >> _______________________________________________ >> Zope maillist - Zope(a)zope.org >> https://mail.zope.org/mailman/listinfo/zope >> ** No cross posts or HTML encoding! ** >> (Related lists - >> https://mail.zope.org/mailman/listinfo/zope-announce >> https://mail.zope.org/mailman/listinfo/zope-dev ) >

1 0

zope2.13.12 & ZMySQLDA
by Giampiero Benvenuti 23 Jan '12

23 Jan '12

Hello, I'm running zope2.13.12, python 2.7.1 and I'm trying to install ZMySQLDA 3.1.1. In the zope_event log I get this error: ------ 2012-01-23T12:11:17 ERROR Application Couldn't install ZMySQLDA Traceback (most recent call last): File "/home/giampiero4/webapps/zope/lib/python2.7/Zope2-2.13.12- py2.7.egg/OFS/Application.py", line 658, in install_product global_dict, global_dict, silly) File "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/ __init__.py", line 90, in <module> import DA File "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/ DA.py", line 92, in <module> from db import DBPool, DB File "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/ db.py", line 114, in <module> from joinTM import joinTM File "/home/giampiero4/webapps/zope/instance/Products/ZMySQLDA/ joinTM.py", line 3, in <module> from Shared.DC.ZRDB.TM import TM ImportError: No module named ZRDB.TM ------ Can someone help me out with this issue? Thanks a lot, Giampiero

2 1

Annoucment: CVE-2010-1104, hotfix, Zope 2.12.22 and 2.13.12 releases
by Tres Seaver 18 Jan '12

18 Jan '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Overview ======== In response to the cross-site scripting vulnerability in Zope2 reported as 'CVE 2010-1104'[1], the Zope security response team announces the availablility of a hotfix product (for Zope < 2.12), and new releases for the Zope 2.12 and 2.13 lines: Hotfix: http://pypi.python.org/pypi/Products.Zope_Hotfix_CVE_2010_1104 Zope 2.12.22: http://pypi.python.org/pypi/Zope2/2.12.22 Zope 2.13.12: http://pypi.python.org/pypi/Zope2/2.13.12 WARNING: Zope < 2.12 is no longer officially supported, and may have other unpatched vulnerabilities. You are encouraged to upgrade to a supported Zope 2. Installing the Hotfix ===================== The hotfix has been tested with Zope instances using Zope 2.8.x - 2.11.x. Users of Zope 2.12.x and 2.13.x should instead update to the latest corresponding minor revision, which already includes this fix. Download the tarball from the PyPI page: http://pypi.python.org/pypi/Products.Zope_Hotfix_CVE_2010_1104 Unpack the tarball and add a 'products' key to the 'etc/zope.conf' of your instance. E.g.:: products /path/to/Products.Zope_Hotfix_CVE_2010_1104/Products and restart. Alternatively, you may copy or symlink the 'Products' directory into the 'Products' subdirectory of your Zope instance. E.g.:: $ cp -r /path/to/Products.Zope_Hotfix_CVE_2010_1104/Products \ /path/to/instance/Products/ Verifying the Installation - -------------------------- After restarting the Zope instance, check the 'Control_Panel/Products' folder in the Zope Management Interface, e.g.: http://localhost:8080/Control_Panel/Products/manage_main You should see the 'Zope_Hotfix_CVE_2010_1104' product folder there. [1] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1104 Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk8XSAYACgkQ+gerLs4ltQ4hNgCeIuBeZz2deF95lglP+kiGg66I YCAAnjiaDBpuB5XD0wAK7WHicxPp1abS =MsHo -----END PGP SIGNATURE-----

1 0

MailingLogger 3.7.0 Released!
by Chris Withers 18 Jan '12

18 Jan '12

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested This release fixes a long standing bug that occurred when logging unicode messages. It also provides support for sending colourised HTML emails: http://packages.python.org/mailinglogger/html.html Full docs can be found here: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

Re: [Zope] Strange issues at string operations with request variables
by Jaroslav Lukesh 05 Jan '12

05 Jan '12

Hi, it make loop, not redirect to the new domain. ----- Puvodní zpráva ----- Od: "Giampiero Benvenuti" <giampiero.benvenuti(a)chiaroscuro.com> what about <dtml-call "RESPONSE.redirect(new_url, lock=1)">

1 0

Re: [Zope] Strange issues at string operations with request variables
by Jaroslav Lukesh 05 Jan '12

05 Jan '12

Hi, I was try the python script, but no success. The final cut (as Murphy law says): <dtml-call expr="RESPONSE.redirect('http://www.otherdomain.com/path/to/document', status=301)"> 1. At Zope 2.10.13 redirect to samedomain which cause loop, not to the otherdomain. 2. At Zope 2.7 this redirect is redirected to otherdomain which is expected. At Zope 2.7 I was not test redirect with PySript. So I use redirect to home page. ----- Puvodní zpráva ----- Od: William Heymann What I would do is do this with a python script instead of DTML. You will find this kind of stuff is much simpler with a python script you just call from DTML something like REQUEST['redirect_URL'] = 'http://www.otherdomain.com' + REQUEST.URLPATH0 2012/1/4 Jaroslav Lukesh <lukesh(a)seznam.cz> Hi all, I have discovered strange issues with all request variables. Here are examples only, but I was try all useable variables in the REQUEST. I want to use redirect to another server with same relative link, but different domain,some like that: <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com' + URLPATH0)"> <dtml-call expr="RESPONSE.redirect(_.str(redirect_URL), status=301)"> It does not work even if I make obstructions for request variables like _.str(), _[''] etc. In cases below variable 'redirect_URL' seems OK, but redirect goes into loop. <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com' + PATH_TRANSLATED)"> <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com' + _.str(_['URLPATH1']))"> <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com')"> In cases below variable 'redirect_URL' = 'h'. <dtml-call "REQUEST.set('redirect_URL', URL.replace(BASE0,'http://www.otherdomain.com')[0])"> <dtml-call "REQUEST.set('redirect_URL', URL.replace(_.string.split(HTTP_HOST,':')[0],'www.otherdomain.com')[0])"> I was try different (very old) Zope, but result is the same. It is possible my uncorrect handle with request variables, but how to handle correct with them? Many thanks, J. Lukesh

1 0

Strange issues at string operations with request variables
by Jaroslav Lukesh 05 Jan '12

05 Jan '12

Hi all, I have discovered strange issues with all request variables. Here are examples only, but I was try all useable variables in the REQUEST. I want to use redirect to another server with same relative link, but different domain,some like that: <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com' + URLPATH0)"> <dtml-call expr="RESPONSE.redirect(_.str(redirect_URL), status=301)"> It does not work even if I make obstructions for request variables like _.str(), _[''] etc. In cases below variable 'redirect_URL' seems OK, but redirect goes into loop. <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com' + PATH_TRANSLATED)"> <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com' + _.str(_['URLPATH1']))"> <dtml-call "REQUEST.set('redirect_URL', 'http://www.otherdomain.com')"> In cases below variable 'redirect_URL' = 'h'. <dtml-call "REQUEST.set('redirect_URL', URL.replace(BASE0,'http://www.otherdomain.com')[0])"> <dtml-call "REQUEST.set('redirect_URL', URL.replace(_.string.split(HTTP_HOST,':')[0],'www.otherdomain.com')[0])"> I was try different (very old) Zope, but result is the same. It is possible my uncorrect handle with request variables, but how to handle correct with them? Many thanks, J. Lukesh

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

Zope January 2012