- Zope - Zope lists

Fw: Zope insecure handling on XML-RPC will reveal information about the server's physical paths.
by Rossen Raykov 19 Apr '02

19 Apr '02

----- Original Message ----- From: "Rossen Raykov" <raikovr(a)yahoo.com> To: <webmaster(a)zope.org>; <webmaster(a)zope.com> Cc: <sacure(a)zope.org>; <secure(a)zope.com> Sent: Thursday, April 18, 2002 10:41 PM Subject: Zope insecure handling on XML-RPC will reveal information about the server's physical paths. > A request like the quoted below will cause Zope to reveal information about > physical paths on the server and about the local servers on which it is > relaying (the last one may be miss configuration, sorry I'm not so familiar > with the platform). > > > > As fare, as I know this problem is present on all currently released Zope > versions including 2.5.0. > > Running the server without -D option wouldn't help. > > > > The last version from CVS seems to handle this correct. > > Thanks to Chris Withers and Shane Hathaway I was able to test in on the > build from 15/04/02 and it worked just fine. > > > > I'm interested to know if there is any other way to fix that bug. > > > > BW when the next release will be available? > > > > Regards, > > Rossen > > > > > -------- CUT HERE --------- > > POST /Foo/Bar/MyFolder HTTP/1.0 > Content-Type: text/xml > Content-length: 95 > > <?xml version="1.0"?> > <methodCall> > <methodName>objectIds</methodName> > <params/> > </methodCall> > > > > _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

ParsedXML tree-widget
by Dennis Allison 19 Apr '02

19 Apr '02

I now have gotten a version of tpValues that seems to do the job and allows display of the DOM in tree form without the noise of the inserted DOM nodes -- necessary if the display is to make sense from the XML source. The fix was to simply detect node types with special names (I did not match against the legal ones, only against the leading character ('#'), so this is a quick workaround not a solution. The problem I have is that to get it all to work I needed to do it by brain surgery, actually modify the Product sources. None of the usual mechanisms has the right namespaces, or so it appears. This has the disadvantage that it effects everything that uses the tree widget on the DOM, including the management screens. I've not checked yet as to what I did there. :-| The change is pretty simple -- in ManageableDOM.py: def tpValues(self): """Return a list of immediate subobjects. Used by the dtml-tree tag. If it's a system inserted tag (e.g., #<something> ) just add the children in instead. This should always be unary.. -dra """ retList = [] # dtml-tree wants to own this for i in self.childNodes: if( i.nodeName[0] == '#'): kids= i.childNodes for k in kids: retList.append(k) else: retList.append(i) return retList

1 0

RE: Authentication Problem
by Dianne Van Dulken 19 Apr '02

19 Apr '02

"Roel Van den Bergh" wrote: > Encountered a similar problem and fixed it > > Have you checked your user roles? > Be sure to ad member AND any other role you want them to have. > > I set manager roles for some users and forgot to ad member > roles and got > redirected to the login page every time too. > > Check also the security tabs for your site :-) Hi Roel, Thanks for that! I had absolutely no idea that the users needed to be members as well. Especially as they certainly aren't on my development site. Very very odd. Cheers Di

1 0

Zope magazine
by Heimo Laukkanen 18 Apr '02

18 Apr '02

Hi Mark ( and everyone on the c:d zope-mailinglist), just stumbled into Zopemag-site and saw what you at behiive have been up to (http://zopemag.com/Issue001/index.html) My first thougth was that what a nice idea, untill I realized that it isn't that great idea - since the magazine is based on paid subscriptions. I do know that people need to get paid for their work, but that also raises the question about what people are getting for the money they pay. For example judging by the first issue ( it is not fair to judge by the covers, I know ) , there isn't much to pay for yet. I am all up to educating people more about zope and canonical documents like good howto's reports, articles and books are propably the best guidance -- and after that people need technical documentation. Zopemag now raises a couple of questions: 1) What is editorial policy: - who can and will contribute - what do you will pay for the contributors 2) Openess policy - how much content will be open in the future for example would something like making the previous numbers free be out of the question? - what open services will be developed? If the world would be ideal place, I would like to see something like zopemag as a completely open system, or partly paid and for example archive as open content. I feel that magazine like content is really good to tie thing together and get people to find products and other howto's that migth interst them. Of course my point of view is only about educating people and myself, since I do not make money out of selling Zope-knowledge, even though I make money out of creating services and applications with Zope. Please answer and start discussion about what community could do to support something like zopemag and vice versa. I feel that if made well, something like zopemag could be really good -- like the really active personal zope-portals have sofar been. By the way - the idea of zope in intranet's is really well. I am just finishing my thesis to a polytechnic about building intranet to support implementation of strategy -- and supprise supprise as a case example I present an intranet built with Zope and CMF. -huima

13 24

RE: [Zope] Tasking System
by Schmidt, Allen J. 18 Apr '02

18 Apr '02

We are looking for an issue tracking system. Will take any and all suggestions!! Looking for something that anonymous users can add issues to for resolution. Admins would delegate tasks to those on our staff. Registered users could add/modify/delete tasks or assign to others with a trail documenting the process. Upon completion of an issue, an email would be generated to the user initiating it. Sounds like more of a helpdesk package now. The URL link to the product from the link below does not work. Wanted to take a look, but.... Has anyone looked at Amphora light groupware yet? Looks sharp... Just curious. Thanks --Allen -----Original Message----- From: abg(a)comco-inc.com [mailto:abg@comco-inc.com] Sent: Tuesday, April 16, 2002 3:23 PM To: zope(a)zope.org Subject: RE: [Zope] Tasking System ZShrink (http://www.zope.org/Members/codestackers/ZShrink) might fit the bill. > -----Original Message----- > From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On > Behalf Of Todd > Loomis, DMSO (SAIC) > Sent: Tuesday, April 16, 2002 2:12 PM > To: zope(a)zope.org > Subject: [Zope] Tasking System > > > All: > > Does anybody know of a system that can be used within zope to > keep track of > task. > > Thanks, > Todd > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

5 4

odd behavior when External Method calls DTML Method
by Brian Withun 18 Apr '02

18 Apr '02

I am experiencing some kind of acquisition problem when calling DTML Methods from External Methods In a nutshell, I have a dtml method: ---------------------(test1_dtml)--- <dtml-var URL> ------------------------------------ ...which renders fine when I view it using a web browser. When I test an external method which calls this DTML method, however, I get this traceback: Traceback (innermost last): File /usr/local/Zope-2.5.0-linux2-x86/lib/python/ZPublisher/Publish.py, line 150, in publish_module File /usr/local/Zope-2.5.0-linux2-x86/lib/python/ZPublisher/Publish.py, line 114, in publish File /usr/local/Zope-2.5.0-linux2-x86/lib/python/Zope/__init__.py, line 158, in zpublisher_exception_hook (Object: Test) File /usr/local/Zope-2.5.0-linux2-x86/lib/python/ZPublisher/Publish.py, line 98, in publish File /usr/local/Zope-2.5.0-linux2-x86/lib/python/ZPublisher/mapply.py, line 88, in mapply (Object: test1) File /usr/local/Zope-2.5.0-linux2-x86/lib/python/ZPublisher/Publish.py, line 39, in call_object (Object: test1) File /usr/local/Zope-2.5.0-linux2-x86/lib/python/Products/ExternalMethod/External Method.py, line 202, in __call__ (Object: test1) (Info: ((<Folder instance at 89f8ac8>,), {}, None)) File /home/zope/2-5-0/lib/python/Products/Model/Extensions/XmlRpc.py, line 66, in Test_test1 (Object: Test) File /usr/local/Zope-2.5.0-linux2-x86/lib/python/OFS/DTMLMethod.py, line 127, in __call__ (Object: test1_dtml) File /usr/local/Zope-2.5.0-linux2-x86/lib/python/DocumentTemplate/DT_String.py, line 473, in __call__ (Object: test1_dtml) KeyError: URL This is the module containing the function for my External Method: --------------------(myModule.py)--- def test1( self ): return self.Test.test1_dtml( self ) ------------------------------------ Curiously, though my DTML Method '''<dtml-var URL>''' does not work, if I change it to '''<dtml-var "REQUEST.get('URL')">''' it works fine. ????? Thanks to any Acquisition Gurus who can explain this. Brian Withun ------------

3 5

Getting a handle on the results of constructors
by Dennis Allison 18 Apr '02

18 Apr '02

In an External Method (that is, unrestricted python), for example, when you create a Folder one writes: self.manage_addProduct['OFSP'].manage_addFolder( id,title="folder") one would think that it would return the object it just constructed so it would be easy to use the new product to, say, create another folder or a file inside. But that appears not to be the case. (In my example, the folder was successfully created but the code handle = self.manage_addProduct... returned None. That made what I thought was the obvious way to handle things, namely applying the constructor to the new folder using handle = self.manage_addProduct... fails as the constructor returns None. So, how do you get a reference to the newly created object?

3 3

concatenate
by Horvath Adam 18 Apr '02

18 Apr '02

I have a problem with concatenating. There are two dtml method. One with a form with three select variable: year, month and day The other dtml method process the form and call a zsql method in a loop again and again when the "next or previous x hit" link is clicked. In the zsql method: select * from table <dtml-sqlgroup where> <dtml-sqltest concatenateddate column=date type=int op=like> </dtml-sqlgroup> So the problem: If I concatenate the date in zsql method. (three arguments: year,month,day) Only the first 10 hit are find with the specified date and at the next 10 and more hits the date term is ignored. But, if I concatenate the three form variables in the processing dtml method before calling the zsql-loop and REQUEST.set ('concatenateddate' , .... and call zsql method in loop(It has only one argument now.) The result is the same. Only the first 10 hit are find with the specified date and at the next 10 and more hits the date term is ignored. And I don't like the date term to be ignored from the second loop. How can I do this job? (I've been thinking about it for three days :) ) An another questions: I'd like to build multi-language website. I imagined that there is a dictionary text file with all the words and sentences of the program in several languages. And the program is displayed in the selected language. Are there any documentations in that topic and example programs? Thanks Halinux

3 2

using manage_addProduct from a unit test ????
by Robert Rottermann 18 Apr '02

18 Apr '02

I would like to use manage_addProduct from a unit test running outside of zope. How can I do that. Are there examples someplace ?? thanks Robert www.redcor.ch

2 1

How to retrieve a previous object's version without undoing it?
by Ausum Studio 18 Apr '02

18 Apr '02

I need to get rendered one object's previous versions without undoing it, in order to make comparisons between those versions, a task usually required by reviewers. I've taken a quick look to the API documentation and it seems there's nothing about it (yet). Has anyone tried a snipet for this? :) Thanks in advance, Ausum

2 1