- Zope - Zope lists

Upgrade from 2.6.1 to 2.6.2
by Paolo Dina 25 Sep '03

25 Sep '03

Hi! Some days ago i posted to the mailing list a request of help about upgrade or dont upgrade my zope server! First of all, thanks to the people that gave me an input. Your suggestion was to go for upgrade, so i performed this tasks: 1) zope installation; 2) copy /Zope-2.6.1-linux2-x86/var/Data.* in /Zope-2.6.2-linux2-x86/var/ 3) copy /Zope-2.6.1-linux2-x86/lib/python/Products in /Zope-2.6.2-linux2-x86/lib/python/Products Well, i started Zope and all went ok. Is this the correct way to migrate from 2.6.1 to 2.6.2? In particular, is zodb shipped with 2.6.1 100% compatible with zodb in 2.6.2? Thanks once again! Paolo Dina

3 2

first-variables in a simple loop on a list
by Smith, Neil (Worcester) 25 Sep '03

25 Sep '03

I have a dtml-in loop over a simple list like: <dtml-set mylist="[1,2,3,4]"> <dtml-in mylist> <dtml-var sequence-item> </dtml-in> It's actually within a Z-SQL method, and the list is returned from a form but I don't want to over complicate the example. Now I really only want the unique values from the list. I figured the best way would be to sort the list then use the first- grouping variables. I can do this just fine if the dtml-in is on something returning named variables, but my problem is that I can't figure out first-what when it's just looping on a simple list. I've tried first-sequence-item which didn't work. I tried setting a prefix="ml" and first-ml_item or first_ml_item but that didn't work either. Can I use first- in this scenario? Is there an easier way of getting unique values from a list? Any ideas? Thanks -- Neil Smith ********************************************************************** The information contained in this e-mail is confidential and intended only for the use of the addressee. If the reader of this message is not the addressee, you are hereby notified that you have received this e-mail in error and you must not copy, disseminate, distribute, use or take any action as a result of the information contained in it. If you have received this e-mail in error, please notify postmaster(a)npower.com (UK 01384 275454) and delete it immediately from your system. Neither Npower nor any of the other companies in the Innogy group from whom this e-mail originates accept any responsibility for losses or damage as a result of any viruses and it is your responsibility to check attachments (if any) for viruses. Npower Limited Registered office: Windmill Hill Business Park, Whitehill Way, Swindon SN5 6PB. Registered in England and Wales: number 3653277. This e-mail may be sent on behalf of a member of the Innogy group of companies. **********************************************************************

2 1

Calling Scripts with arguments from ZPT and XML-RPC
by darkness 25 Sep '03

25 Sep '03

Just started playing with Zope, so apologies if this is covered in the documentation somewhere. I have to say that Zope is really cool. I'm trying to post variables to a ZPT, and have that ZPT call a script which might do something with the form variables. Normally, if I were to call my script from a URL I could use 'http://zopeserver/MyScript?theArg=foo', and assuming the Script named MyScript had an argument named theArg, everything would work. However, if I have a ZPT called myZPT.html, I call it with a URL such as 'http://zopeserver/myZPT.html?theArg=foo', and myZPT.html contains something like '<span tal:replace="here/MyScript" />', the parameter theArg is not correctly passed to MyScript, and MyScript fails to execute because it was called with too few arguments. I'm aware I can declare MyScript to take no arguments and just access them as context.REQUEST.theArg, but then MyScript isn't very useful if you try to use it via XML-RPC. I kind of want to be able to call MyScript using either XML-RPC or internally from ZPT. I can't declare the argument for MyScript as 'theArg=context.REQUEST.get("theArg", None)' because it complains that 'context' doesn't exist at that point. I could do something like declaring MyScript to have argument list 'theArg=None', and then do something like 'if not theArg: theArg = context.REQUEST.get("theArg", None)' but that's ugly. Presumably I could do something like 'tal:replace="python: here.MyScript(theArg=request.theArg)"' but that seems ugly too: to include a 'python:' TALES Python expression where (it seems to me) a TALES path expression should do just fine. Is there some clean way around this? One might consider that when a call is made to an object from ZPT, and that object has a known argument list, ZPT/Zope should attempt to fill in the arguments to that object just as if it were called from XML-RPC (or directly via a URL). TIA, darkness --

3 4

RE: [Zope] Urgent: Severe problem
by Passin, Tom 24 Sep '03

24 Sep '03

Sorry, my last post get sent by mistake just when I started to write it. It does sound like a DoS situation. The large number of coordinated machines all sending the same peculiar request would fit in perfectly. You say the attack started Sept. 15, but the log extract I included in my earlier post happened in August. I would say that a new wave of machines got infected, and they were given the signal to wake up and do this attack You have been contacting a mailing list, BTW. Cheers, Tom P [Juan Lorenzana ] Tom, So do you think this is a DoS attack? I have seen DoS attacks before but I have never seen one that uses over 2,000 machines. I do not think that the packets are spoffed, because 1) I can ping them, 2) They appear to primarily originate from about 8 different countries only, 3) If I stop the server (I did that for one full day), they keep going even after a day- most DoS attacks stop when the system crashes or stops responding. Anyway, if it not related to zope, what do you think this flood is related to? And why from all over the world. The attack started September 15 and the customer has no idea why they would single out his site. Pretty low volume site. This system is on a shared hosting machine, and the attacks are only focused on this one customer and not the whole machine. Any thoughts? We thought that there might be a database in a CMF servers and all of sudden, someone put this customers site down as one of them and all zope users started trying to access it. We do not use CMF and I had never heard of it before so please excuse my ignorance as to what it actually does. Like you mentioned,it probably has nothing to do with CMF. The only reference in google that we could fine was to zope, so we thought there might be a link. I am thinking about calling CERT to see if this is from a virus, but wanted to make sure I understood the cause more before notifying CERT. P.S. If zope(a)zope.org is a mailling list,please let me know so that I do not bore everyone with our problem. Thanks. Juan "Passin, Tom" wrote: [ Juan Lorenzana] > My name is Juan Lorenzana and I am a system administrator for > an ISP in > Brazil. They offer virtual servers and virtual hosting. The reason I > am sending you this email is that one of our virtual hosting > customer's > web site is being flooded with requests that appear to be related to > zope. An excerpt of the log files appear below: > > > Access Log file: > 168.226.70.160 - - [24/Sep/2003:11:34:50 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.1" 404 285 > 216.244.197.250 - - [24/Sep/2003:11:35:55 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 > 200.63.144.150 - - [24/Sep/2003:11:36:10 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 The same thing has also been seen in a php context, so it is probably nothing to do with Zope - "The server farm is being hit by about 30,000 of these per minute along with all of your valid requests : from http://forum.mydomain.com/viewtopic.php?t=2241 <http://forum.mydomain.com/viewtopic.php?t=2241&start=15> &start=15 - -- begin log snip -- 4.35.208.254 [27/Aug/2003:14:13:46 -0700] "\x87\x92\xdc\xecf\xaa\xb8,i\x99?\xd7\xe1\xff\xe3\xabi\x9a\xb9tl\xba\"#\ xe7\ xf5\xaa\x1fp\x1b0\xe0xmH\xb9\xcd\t\xdd\xf5b\xa9\x1b&S\x8d\x8b\xba$\xb6\x 80\xcfJU\xb3I\xec\x83*!\xea2^\xff\x1fd\x9c\x0c\xe3\x9b\xac\x01\xd4\x90\x b1\x8\xd7'P\xb5Y\xa3\x14\x04\xdb\x16\x11E\xad\x1c\xc8\x06\xf9\xc9K \x04\xe0\xa2\x8c\xb1FlxG\xb6\xc9\x9as\xb5x\xc5\x91\xc9=\xba'\xe6\x86@\xb 2)Mw\xa6\xc9@i" 400 371 200.67.219.5 www.Gustavo.com [27/Aug/2003:14:13:46 -0700] "GET http://www.instituto.com.br/attackDoS.php?ver=01 <http://www.instituto.com.br/attackDoS.php?ver=01&task=newzad&first=1> &task=newzad&first=1 HTTP/1.1" 404 5 -- end log snip -- " There are other php examples too. The Zope Hot Patch does not look like the query string. the only part that has a name starting with "z" is this - from zLOG import LOG, INFO I doubt that this has anything to do with zope per se, given the above. Anyone else know anything more concrete than speculation? Cheers, Tom P

1 0

RE: [Zope] Urgent: Severe problem
by Passin, Tom 24 Sep '03

24 Sep '03

[ Juan Lorenzana] > My name is Juan Lorenzana and I am a system administrator for > an ISP in > Brazil. They offer virtual servers and virtual hosting. The reason I > am sending you this email is that one of our virtual hosting > customer's > web site is being flooded with requests that appear to be related to > zope. An excerpt of the log files appear below: > > > Access Log file: > 168.226.70.160 - - [24/Sep/2003:11:34:50 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.1" 404 285 > 216.244.197.250 - - [24/Sep/2003:11:35:55 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 > 200.63.144.150 - - [24/Sep/2003:11:36:10 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 The same thing has also been seen in a php context, so it is probably nothing to do with Zope - "The server farm is being hit by about 30,000 of these per minute along with all of your valid requests : from http://forum.mydomain.com/viewtopic.php?t=2241&start=15 - -- begin log snip -- 4.35.208.254 [27/Aug/2003:14:13:46 -0700] "\x87\x92\xdc\xecf\xaa\xb8,i\x99?\xd7\xe1\xff\xe3\xabi\x9a\xb9tl\xba\"#\ xe7\ xf5\xaa\x1fp\x1b0\xe0xmH\xb9\xcd\t\xdd\xf5b\xa9\x1b&S\x8d\x8b\xba$\xb6\x 80\xcfJU\xb3I\xec\x83*!\xea2^\xff\x1fd\x9c\x0c\xe3\x9b\xac\x01\xd4\x90\x b1\x8\xd7'P\xb5Y\xa3\x14\x04\xdb\x16\x11E\xad\x1c\xc8\x06\xf9\xc9K \x04\xe0\xa2\x8c\xb1FlxG\xb6\xc9\x9as\xb5x\xc5\x91\xc9=\xba'\xe6\x86@\xb 2)Mw\xa6\xc9@i" 400 371 200.67.219.5 www.Gustavo.com [27/Aug/2003:14:13:46 -0700] "GET http://www.instituto.com.br/attackDoS.php?ver=01&task=newzad&first=1 HTTP/1.1" 404 5 -- end log snip -- " There are other php examples too. The Zope Hot Patch does not look like the query string. the only part that has a name starting with "z" is this - from zLOG import LOG, INFO I doubt that this has anything to do with zope per se, given the above. Anyone else know anything more concrete than speculation? Cheers, Tom P

4 3

RE: [Zope] Urgent: Severe problem
by Passin, Tom 24 Sep '03

24 Sep '03

[ Juan Lorenzana ] Tom, So do you think this is a DoS attack? I have seen DoS attacks before but I have never seen one that uses over 2,000 machines. I do not think that the packets are spoffed, because 1) I can ping them, 2) They appear to primarily originate from about 8 different countries only, 3) If I stop the server (I did that for one full day), they keep going even after a day- most DoS attacks stop when the system crashes or stops responding. Anyway, if it not related to zope, what do you think this flood is related to? And why from all over the world. The attack started September 15 and the customer has no idea why they would single out his site. Pretty low volume site. This system is on a shared hosting machine, and the attacks are only focused on this one customer and not the whole machine. Any thoughts? We thought that there might be a database in a CMF servers and all of sudden, someone put this customers site down as one of them and all zope users started trying to access it. We do not use CMF and I had never heard of it before so please excuse my ignorance as to what it actually does. Like you mentioned,it probably has nothing to do with CMF. The only reference in google that we could fine was to zope, so we thought there might be a link. I am thinking about calling CERT to see if this is from a virus, but wanted to make sure I understood the cause more before notifying CERT. P.S. If zope(a)zope.org is a mailling list,please let me know so that I do not bore everyone with our problem. Thanks. Juan "Passin, Tom" wrote: [ Juan Lorenzana] > My name is Juan Lorenzana and I am a system administrator for > an ISP in > Brazil. They offer virtual servers and virtual hosting. The reason I > am sending you this email is that one of our virtual hosting > customer's > web site is being flooded with requests that appear to be related to > zope. An excerpt of the log files appear below: > > > Access Log file: > 168.226.70.160 - - [24/Sep/2003:11:34:50 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.1" 404 285 > 216.244.197.250 - - [24/Sep/2003:11:35:55 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 > 200.63.144.150 - - [24/Sep/2003:11:36:10 -0600] "GET > /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 The same thing has also been seen in a php context, so it is probably nothing to do with Zope - "The server farm is being hit by about 30,000 of these per minute along with all of your valid requests : from http://forum.mydomain.com/viewtopic.php?t=2241 <http://forum.mydomain.com/viewtopic.php?t=2241&start=15> &start=15 - -- begin log snip -- 4.35.208.254 [27/Aug/2003:14:13:46 -0700] "\x87\x92\xdc\xecf\xaa\xb8,i\x99?\xd7\xe1\xff\xe3\xabi\x9a\xb9tl\xba\"#\ xe7\ xf5\xaa\x1fp\x1b0\xe0xmH\xb9\xcd\t\xdd\xf5b\xa9\x1b&S\x8d\x8b\xba$\xb6\x 80\xcfJU\xb3I\xec\x83*!\xea2^\xff\x1fd\x9c\x0c\xe3\x9b\xac\x01\xd4\x90\x b1\x8\xd7'P\xb5Y\xa3\x14\x04\xdb\x16\x11E\xad\x1c\xc8\x06\xf9\xc9K \x04\xe0\xa2\x8c\xb1FlxG\xb6\xc9\x9as\xb5x\xc5\x91\xc9=\xba'\xe6\x86@\xb 2)Mw\xa6\xc9@i" 400 371 200.67.219.5 www.Gustavo.com [27/Aug/2003:14:13:46 -0700] "GET http://www.instituto.com.br/attackDoS.php?ver=01 <http://www.instituto.com.br/attackDoS.php?ver=01&task=newzad&first=1> &task=newzad&first=1 HTTP/1.1" 404 5 -- end log snip -- " There are other php examples too. The Zope Hot Patch does not look like the query string. the only part that has a name starting with "z" is this - from zLOG import LOG, INFO I doubt that this has anything to do with zope per se, given the above. Anyone else know anything more concrete than speculation? Cheers, Tom P

1 0

Mailboxer: smtp2zope does not deliver mails
by Christoph Landwehr 24 Sep '03

24 Sep '03

Hi, I set up the mailboxer-produkt (ver 2.3.0 on Zope 2.6.1, python 2.1.3 with email-module) and added a mailboxer object . I realized that mails don’t get delivers to my mailboxer. To rule out any sendmail / alias problem I created file ‘my_mail’ containing a valid email (header and body) in my mailboxer-produkt folder. Than I called cat < my_mail | ./smtp2zope.py http://127.0.0.1:9080/some_folder/my_mailboxer_id/manage_mailboxer to deliver the mail via the smtp2zope-script to my mailboxer. File-permissions should be ok. I don’t’ get an error message but the mail does not get delivered to Zope either. Can someone give me a hint to where to look. Regards Christoph

1 0

Urgent: Severe problem
by Juan Lorenzana 24 Sep '03

24 Sep '03

To Zope, My name is Juan Lorenzana and I am a system administrator for an ISP in Brazil. They offer virtual servers and virtual hosting. The reason I am sending you this email is that one of our virtual hosting customer's web site is being flooded with requests that appear to be related to zope. An excerpt of the log files appear below: Access Log file: 168.226.70.160 - - [24/Sep/2003:11:34:50 -0600] "GET /put?ver=01&task=newzad&first=1 HTTP/1.1" 404 285 216.244.197.250 - - [24/Sep/2003:11:35:55 -0600] "GET /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 200.63.144.150 - - [24/Sep/2003:11:36:10 -0600] "GET /put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 Error Log file: [Wed Sep 24 11:34:50 2003] [error] [client 168.226.70.160] File does not exist: /httpd/htdocs/put [Wed Sep 24 11:35:55 2003] [error] [client 216.244.197.250] File does not exist: /httpd/htdocs/put [Wed Sep 24 11:36:10 2003] [error] [client 200.63.144.150] File does not exist: /httpd/htdocs/put As you can see, this box is being hit by thousands of machines requesting a put file with variables similiar to the ones that released in your patch "CMFHotfix_20030908" found on your website at http://cmf.zope.org/download/CMFHotfix_20030908/announce-CMFHotfix_20030908 With a little help from google, we were able to track an instance where someone started experiencing these same put request and the fix pointed to your website for the CMFHotFix_20030908. The problem is that this virtual host customer is being hit by thousands of machines all trying to execute put? with ver=01&task=newzad&first= as arguments. I only included a 20 second snap shot fromthe log files, but we are receiving thousands of requests per second. The server is being overloaded and I had to throttle the server to keep it up. We do not know exactly what is going on, but suspect that someone, thousands of machines that use Zope are making put requests to this client. Not sure why or how,but we suspect that it has to do with zope and wanted to contact someone to see if they could help us address the issue. Currently we wrote a program that blackhole's every ip trying to connect. However, we have already blocked over 2000 ip addresses and they just keep coming. The log files are over 4 Gigs, and had we not throttled the server, they would probably be a lot bigger. Anyway, who can we talk to about finding out what is really happening and why. The URL of the site that is being hit is www.revistaprofashional.com.br If you can direct me to someone that can help, I would really appreciate it. Thanks. Juan Lorenzana Techincal Support juan(a)itwest.net 602-738-3220

1 0

first-variables in a simple loop on a list
by nwingfield＠che-llp.com 24 Sep '03

24 Sep '03

To create a unique list, you could create and call a simple Python script, something like this: # ASSUMING A PARAMETER CALLED 'mylist' mydict = {} for value in mylist: mydict[value] = 1 mylist = mydict.keys() return mylist

1 0

Zope, FreeBSD and core dump :(
by Sergey Volobuev 24 Sep '03

24 Sep '03

Hi, I am moving a site from my server (linux, python 2.1.3, zope 2.6.1) to hoster's machine (FreeBSD 4.x, Python 2.2.2, Zope 2.6.1 (2.6.2 tested too)) Site is accessed through Apache using mod_rewrite and VHM (at port 80) and also directly at port 8082. When i access some pages at mysite.com:80, i get === ERROR(200) zdaemon Process xxx terminated by signal SIGSERV(11) (core dumped) === and server restarts. In the browser i get Proxy Error: zero-sized reply. It never happens when i access mysite:8082. Sometimes i can access mysite:80 if i open and re-save one or another zpt through ZMI (mysite:8082) - the site remains accesible for several minutes until it dumps core again. And i noticed that some pages of the site doesn't cause server restart, and other pages did it very often. My site uses following products: PageTemplates, PythonScripts, OrderedFolder, TextIndexNG and Epoz. No CMF or Plone or whatever. There are zope/var/python.core file, but i am unfamiliar with gdb and can't get any useful info with it What is the possible causes of this segfaults? What can i do to narrow the problem? Thanks

4 7