November 2012 - Zope

Re: [Zope] Zope and security vulnerability: 20121106
by johannes raggam 14 Nov '12

14 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The affected versions go back a long time. I don't know it exactly, but people have used it successfully with Plone 2.1 (from ancient times) and I have patched Zope 2.8 instances too. On 11/11/2012 09:43 PM, Allen Schmidt wrote: > For which zope versions? > > On Nov 11, 2012 2:16 PM, "johannes raggam" <raggam-nl(a)adm.at > <mailto:raggam-nl@adm.at>> wrote: > > You can just apply the Plone hotfix for Zope only installations. > The Plone patches are not applied then. > > Johannes > > On 11/11/2012 06:32 PM, Marcus Schopen wrote: >> Hi, > >> is a standard Zope affected by this security vulnerability or >> only if Plone is installed: > > > http://plone.org/products/plone/security/advisories/20121106-announcement > > >> The patch is replacing some basic classes therefore it looks to >> me that Zope itself without any Plone is vulnerable too. If so >> is there a Hotfix for Zope or new Zope version which fixes these >> bugs? > >> Ciao Marcus > > >> _______________________________________________ Zope maillist - >> Zope(a)zope.org <mailto:Zope@zope.org> > https://mail.zope.org/mailman/listinfo/zope ** No >> cross posts or HTML encoding! ** (Related lists - >> https://mail.zope.org/mailman/listinfo/zope-announce >> https://mail.zope.org/mailman/listinfo/zope-dev ) > > > > _______________________________________________ Zope maillist - > Zope(a)zope.org <mailto:Zope@zope.org> > https://mail.zope.org/mailman/listinfo/zope ** No cross posts or > HTML encoding! ** (Related lists - > https://mail.zope.org/mailman/listinfo/zope-announce > https://mail.zope.org/mailman/listinfo/zope-dev ) > - -- programmatic web development di(fh) johannes raggam / thet python plone zope development mail: office(a)programmatic.pro web: http://programmatic.pro http://bluedynamics.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlCg5WkACgkQW4mNMQxDgAfsyACgvbuoNO8ocpordzJmbH3X0OA2 gCsAnAkFNozMy1TRGWTKQjaYQgzLIisM =DpGn -----END PGP SIGNATURE-----

7 9

path of a fileupload instance
by Kees de Brabander 14 Nov '12

14 Nov '12

Hiya I have a form with a field for a FileUpload object, which works ok. However, in my application I want to capture the path of that file, because I want to open still other files that I know by name from that very same directory. Any idea how to do that? The REQUEST simple contains the FileUpload instance.

3 5

Re: [Zope] Zope Digest, Vol 101, Issue 4
by Yuri 12 Nov '12

12 Nov '12

I think an "official" statement about this topic should appear somewhere, shouldn't? Il 12/11/2012 13:00, zope-request(a)zope.org ha scritto: > You can just apply the Plone hotfix for Zope only installations. The > Plone patches are not applied then. > > Johannes > > On 11/11/2012 06:32 PM, Marcus Schopen wrote: >> Hi, >> >> is a standard Zope affected by this security vulnerability or only >> if Plone is installed: >> >> http://plone.org/products/plone/security/advisories/20121106-announcement >> >> The patch is replacing some basic classes therefore it looks to me >> that Zope itself without any Plone is vulnerable too. If so is >> there a Hotfix for Zope or new Zope version which fixes these >> bugs? >> >> Ciao Marcus >> >> >> _______________________________________________ Zope maillist - >> Zope(a)zope.org https://mail.zope.org/mailman/listinfo/zope ** No >> cross posts or HTML encoding! ** (Related lists - >> https://mail.zope.org/mailman/listinfo/zope-announce >> https://mail.zope.org/mailman/listinfo/zope-dev ) >> > > - -- > programmatic web development > di(fh) johannes raggam / thet > python plone zope development > mail: office(a)programmatic.pro > web: http://programmatic.pro > http://bluedynamics.com > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ > > iEYEARECAAYFAlCf+YkACgkQW4mNMQxDgAfzewCg5VPyH+ADX/75eSBDxxy1BEWK > RaQAoIXSX+Mj8J+yrWd4KD6HKglDQHtu > =cxZJ > -----END PGP SIGNATURE----- > > > ------------------------------ > > _______________________________________________ > Zope maillist - Zope(a)zope.org > > > > End of Zope Digest, Vol 101, Issue 4 > ************************************

1 0

Zope and security vulnerability: 20121106
by Marcus Schopen 11 Nov '12

11 Nov '12

Hi, is a standard Zope affected by this security vulnerability or only if Plone is installed: http://plone.org/products/plone/security/advisories/20121106-announcement The patch is replacing some basic classes therefore it looks to me that Zope itself without any Plone is vulnerable too. If so is there a Hotfix for Zope or new Zope version which fixes these bugs? Ciao Marcus

2 1

TextIndexNG3 Problem: Links werden nicht indexiert
by Ruth Cordes 05 Nov '12

05 Nov '12

Hallo zusammen, ich hab zope 2.12.17 und möchte gerne den TextIndexNG3 nutzen. Eigentlich klappt alles prima. Aber nun fällt mir auf, daß Einträge nicht mehr angezeigt werden, die mit dem ZCTextIndex noch gefunden worden sind. Wenn ich die Catalogeinträge mit denen des ZCTextindex vergleiche, fällt mir auf, daß der TextIndexNG3 nicht alles erfasst: Beispiel: Suchbegriff 'his-hf' Eintrag ZCTextIndex: ['his', 'hf', 'logo', 'farbig', 'mit', 'text', ...] TextIndexNG3: {'PrincipiaSearchSource': [u'dtml-var', u'standardhtmlheader', u'h2dtml-var', ..... u'classsmallhis-hf', u'logo', u'farbig', u'mit', u'textbr' ...} Der TextIndexNG3 nimmt auch sämtliche HTML-und dtml-Elemente auf, was dazu führt, daß das DTML-Dokument bei Eingabe des Suchbegriffs "his-hf" nicht gefunden wird, weil er das 'Wort' 'classsmallhis-hf' indexiert hat. ich könnt jetzt natürlich mit *his-hf* suchen, aber damit würde ich ja (bei anderen Suchbegriffen) viel Mist angezeigt bekommen... Kann ich an den TextIndexNG3-Parametern noch etwas schrauben, damit auch DTML-Dokumente erfasst werden, in denen der Suchbegriff "nur" als Link vorkommt? Danke für Eure Hilfe und schöne Grüße aus Hannover, Ruth Cordes

3 4