- Zope - Zope lists

Re Re: Regular expressions insecurity?
by Matt Young 21 Jan '03

21 Jan '03

> Re: Regular expressions insecurity? (Tue > Wennerberg) <educated_guess> I think xrange() is limited in Zope so that you can't use it to produce a huge auxillary d.s. (list of numbers to iterate over). A nasty re on the right data would probably produce some huge data structures too. Can't rewrite every package for Zope... </educated_guess> Pity because I love re. But of course you can probably get by with an external method. Matt __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

3 4

Large File Support (LFS) in Zope
by Josef Meile 21 Jan '03

21 Jan '03

Hi, last December my Zope crashed because of the large file support or that's what I found searching on the lists. I got the message: Aiieee! 2365 exited with error code: 25 In my previous message: http://groups.yahoo.com/group/zope/message/105508 I was told to install a new version of linux and to compile python with large file support, thing that I did in my original installation: Suse 7.3, Zope 2.5.1 I didn't install Suse 8 because, as I read, 7.3 comes already with large file support. (Am I wrong?) Anyway, I just want to know how the people with large databases is handling this. (I mean without using LocalFS or similars) Thanks in advanced, Josef

5 5

RE: [Zope] Zope and Apache
by Moore, Paul 21 Jan '03

21 Jan '03

From: Jan-Frode Myklebust [mailto:janfrode@parallab.no] >> I still get "Permission denied". Do I need something in >> Apache to say that the /Zope (virtual) directory is >> accessible to browsers? > No. > Who's giving you "Permission denied"? Zope or apache? Apache, as far as I can see. No indication of why, in any of the logs, though :-( Paul

1 0

Re: [Zope] Regular expressions insecurity?
by Tue Wennerberg 21 Jan '03

21 Jan '03

Mike Renfro wrote: > On Fri, Jan 17, 2003 at 03:36:25PM +0100, Tue Wennerberg wrote: > >> Mike Renfro wrote: > > > >>> Basic summary: easy denial of service possibility if you have >>> untrusted users. >> >> >> But... If it's only a question of Denial of Service, how are regular >> expressions any different from python scripts. Surely, a site >> developer can simply make an infinite loop in his python script. > > > > Here's my guess for the difference: whatever code is contained in the > script is the developer's sole responsibility. However, a common regex > usage would require input from an untrusted *user* (at least on a > public site), and the developer can't necessarily plan for all > possible inputs that a malicious user might stick in there. I use regular expressions a lot, and the way I see it, no regexps would behave like that. So it isn't a problem. Also, it's widespread to use regular expressions in web sites written in Perl, and I've never heard of such a scenario occuring. I'm still puzzled as to why regular expressions are banned. -- Mvh. Tue Wennerberg Civilingeniør og Freelance Udvikler http://tuewennerberg.dk/ - tue(a)wennerberg.dk - (+45) 4043 6735

4 6

Zope and ColdFusion question:
by Jim Lennox 21 Jan '03

21 Jan '03

We have a client that uses Coldfusion and we are pitching Zope to them for its workflow strengths. Here is what I think I know about Coldfusion: its java-based? and has a J2EE server. Am I correct. They might want to use coldfusion to continue to develop their content but would be amenable to a Zope server. Does anyone have any thoughts or experience here. thanks in advance Jim

2 1

Binary objects using psycopg postgresql adapter
by Andreas Tille 21 Jan '03

21 Jan '03

Hi, I want to store binary objects (JPEG, PDF) into a PostgreSQL database. I used to do this in plain Python via from psycopg import * ... binobj = Binary(file) query = "INSERT INTO Table (Id, binaryobject) VALUES (%d, %s)" curs.execute(query, (i, binobj)) If I want to do this in a python script I can not import psycopg explicitely. But if I use a Z Psycopg Database Connection 'ZPsyCon' I can issue database queries using context.ZPsyCon.manage_test(query, REQUEST=None) Is there any way to store binary objects via this method. The only alternative I could see are External Methods. Any hints how to do this right? Kind regards Andreas.

1 0

RE: [Zope] RE: Zope memory leak (Progess being made!)
by Jean-Francois.Doyon＠CCRS.NRCan.gc.ca 21 Jan '03

21 Jan '03

Hello, OK, I've made some progress thanks to LeakFinder! Looks like the problem in my case is definitely the DateTime.DateTime.DateTime class reference count. I need some help understanding this stuff though, cuz we're going a bit beyond my current python knowledge :) First of all, some strange things I noticed: - Since I installed leak finder, the refcount for said class grows much more rapidly (presumably because it's more accurate?) and reaches much higher levels than I have ever witnessed using the regular "top refcount" from the Debug section of the Control Panel. - The Top Refcount section of the debug panel now shows the same refcount as the LeakFinder does, instead of the kind of values I had gotten used to seeing previous to installing LeakFinder. - More interestingly though, since I installed LeakFinder, the leak has gotten worse! Memory usage grows to unmanageable levels in a matter of 2 or 3 days now, instead of a week or 2 as before. Is this normal? Is this a symptom of what might be causing the problem? In my limited knowledge of such python wizardry, I'm gussing it's because references that used to get "lost" no longer aren't ... does that make sense? I'm going to apply the "patch" very soon now. I tested this on my staging server, which is an exact copy, and didn't see anything weird in the report, so I'll try it on the live site. The main thing is, I don't think I've written a single line of code that uses that class anywhere. I have no Python Script or Products that do anything with that class, except maybe through sub-classing of other objects that may use it. The only usage of dates I do specifically (not within CMF internal workings) is for displaying only. More to come ... Thanks for everyone's patience and help in this matter! Cheers, J.F. -----Original Message----- From: Dieter Maurer [mailto:dieter@handshake.de] Sent: Friday, January 17, 2003 4:11 PM To: Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca Cc: cmuldrow(a)fredericksburg.com; zope(a)zope.org Subject: Re: [Zope] RE: Zope memory leak Jean-Francois.Doyon(a)CCRS.NRCan.gc.ca wrote at 2003-1-17 11:47 -0500: > I do have dtml-var's with Dates in them in there too (DublinCore dates), > maybe there's a problem with some of the methods or objects? You should use Shane's "LeakFinder" to find leaks caused by Zope objects. > I'm not sure what IOBuckets are FOR, I mean Input/Output, but not sure where > they're used ... Maybe figuring that out could help? There are an elementary structure to implement BTrees. They are use in the catalog, among others. Dieter

1 0

RE: [Zope] Zope and Apache
by Moore, Paul 21 Jan '03

21 Jan '03

From: Jan-Frode Myklebust [mailto:janfrode@parallab.no] > Create a VirtualHostMonster in the root of your zope > folder. Call it 'VirtualHostId' (or whatever). > Add these two lines to your httpd.conf: > > RewriteEngine On > RewriteRule ^/Zope/(.*) http://localhost:8080/VirtualHostBase/http/ukdcw5163:80/VirtualHostRoot/$1 [L,P] > > and 'apachectl restart'. I still get "Permission denied". Do I need something in Apache to say that the /Zope (virtual) directory is accessible to browsers? I tried a <Location /Zope> Order allow,deny Allow from all </Location> block, but that did no good... Paul.

3 2

access to passwords
by Eugen Nedelcu 21 Jan '03

21 Jan '03

Is there a way to access the password entered by the user, the same as with the user name itself (REQUEST['AUTHENTICATED_USER'])? -- ICQ: 165549179

4 3

Re: [Zope] Apache rewrite question
by AM 21 Jan '03

21 Jan '03

In this rewrite rule: RewriteRule ^/(.*) http://mov.aim23.com:9090/VirtualHostBase/http/www. nixonmcinnes.co.uk:80/VirtualHostRoot/$1 [L,P] this is what it means: ^/(.*) : this means match all urls with the servername www.nixonmcinnes.co.uk ie any url of the form www.nixonmcinnes.co.uk\.... http://mov.aim23.com:9090 : this is the url ( with port ) which gives you direct access to the zope part of the site. ( default is port 8080 but you are running at 9090 ) VirtualHostBase : this means apache should talk to the VHM in the zope instance. ( one is all you need ) http : the accessor which tells VHM what protocol apache is speaking ( this is only my take from the code - i dont know what else VHM can speak ) it is part of the url and should be considered as is. www.nixonmcinnes.co.uk:80 : this is what the VHM should rewrite as the base url so that port 8080 or in your case 9090 is not directly exposed VirtualHostRoot : this is the folder in Zope you want to publish. so for example if you are publishing a folder called my_site ( for eg http://your_domain:9090/my_site ) then this should be my_site. It can be a subfolder too ie if your main site is in the folder /my_site/main_site ( in the zope instance this should be my_site/main_site where your folder organization in your zope instance is such: Root Folder /my_site /main_site The easiest way to first check if your VHM works is to put this in the url: http://mov.aim23.com:9090/VirtualHostBase/http/www.nixonmcinnes.co.uk:80/my… if you see your site's main page, your VHM works perfectly and the virtual host + rewrite in apache should work. hth AM Tom Nixon wrote: >> I know this is a stupid suggestion but is the folder you are hosting >> at the root level (Zope root) and called: VirtualHostRoot ?? >> > > > I don't think so. I'm not entirely sure what you mean. > > T. > > > . > > > -- ================================================================== Aseem Mohanty Neurobehavioral Systems Inc, 828 San Pablo Ave, Albany, CA 94706 (R) 510 7696011 (M) 510 3014871 (O) 510 5279231 ================================================================== "I saw `cout' being shifted "Hello world" times to the left and stopped right there!!" -- Steve Gonedes ================================================================== Tom Nixon wrote: >>I know this is a stupid suggestion but is the folder you are >>hosting at >>the root level (Zope root) and called: VirtualHostRoot ?? >> >> > >I don't think so. I'm not entirely sure what you mean. > >T. > > >. > > > -- ================================================================== Aseem Mohanty Neurobehavioral Systems Inc, 828 San Pablo Ave, Albany, CA 94706 (R) 510 7696011 (M) 510 3014871 (O) 510 5279231 ================================================================== "I saw `cout' being shifted "Hello world" times to the left and stopped right there!!" -- Steve Gonedes ==================================================================

1 0