- Zope - Zope lists

MailingLogger 3.6.0 Released!
by Chris Withers 25 Nov '11

25 Nov '11

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested The only change for this release is to allow summaries sent by SummarisingLogger to contain messages logged at a lower level than those which triggered the summary to be emailed. Full docs can be found here: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

Python Script Security
by Richard Harley 19 Nov '11

19 Nov '11

Hello all I have a dtml method which builds a page from various different python scripts. How can I stop the python scripts from being called and passed variables independently of the main dtml method? I've tried some research on proxy roles but couldn't pin it down. ZSQL methods are not callable independently and I would like Python Scripts to behave the same. TIA Rich

5 4

force the output encoding to utf-8 in page templates
by Yuri 15 Nov '11

15 Nov '11

Hi all! I've a Zope2 application with Postgresql. All is ok and utf-8 but page templates. This means that non utf-8 data is sent to the database, and the database complain with: *Error Type: DataError* *Error Value: invalid byte sequence for encoding "UTF8": 0xe82527 HINT: This error can also happen if the byte sequence does not match the encoding expected by the server, which is controlled by "client_encoding". *This does not happen if I manually switch the browser encoding (Firefox -> View -> character encoding -> Unicode (UTF-8)) and submit a form. So my question is: how do I tell to page templates to output utf-8 instead of iso8859-15? The output_encoding property does anything. Obviously, changing default-zpublisher-encoding to utf-8 works, but other legacy applications will have problems on characted encoding. Any idea? **

3 5

Importing Unauthorized?
by Brian R Brinegar 11 Nov '11

11 Nov '11

We're in the process of migrating from Zope 2.11 to Zope 2.13, we have scripts which raise string exceptions, which is no longer allowed by the version of python. In particular, we have scripts which: raise "Unauthorized" However, we don't seem to be able to import the Unauthorized exception from AccessControl or zExceptions. What is the new way to raise an Unauthorized exception from within a Zope Python Script? Thanks, Brian Brinegar Web Services Coordinator Engineering Computer Network

2 1

Database Authentication
by John Harrow 02 Nov '11

02 Nov '11

Hi all What's the best way to authenticate against a database in Zope 2 these days? SUF and XUF are the two I've briefly looked at. I'm coming back to an old project so bit out of the Zope loop! Cheers John

2 3

Hotfix for security vulnerability
by Tres Seaver 25 Oct '11

25 Oct '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Zope security response team, I would like to announce the availability of a hotfix for a vulnerability inadvertently published earlier today. 'Products.Zope_Hotfix_20111024' README ====================================== Overview - -------- This hotfix addresses a serious vulnerability in the Zope2 application server. Affected versions of Zope2 include: - - 2.12.x <= 2.12.20 - - 2.13.x <= 2.13.6 Older releases (2.11.x, 2.10.x, etc.) are not vulnerable. The Zope2 security response team recommends that all users of these releases upgrade to an unaffected release (2.12.21 or 2.13.11) as soon as they become available. Until that upgrade is feasible, deploying this hotfix also mitigates the vulnerability. Installing the Hotfix: Via 'easy_install' - ------------------------------------------- If the Python which runs your Zope instance has 'setuptools' installed (or is a 'virtualenv'), you can install the hotfix directly from PyPI:: $ /prefix/bin/easy_install Products.Zope_Hotfix_20111024 and then restart the Zope instance, e.g.: $ /path/to/instance/bin/zopectl restart Installing the Hotfix: Via 'zc.buildout' - ----------------------------------------- If your Zope instance is managed via 'zc.buildout', you can install the hotfix directly from PyPI. Edit the 'buildout.cfg' file, adding "Products.Zope_Hotfix_20111024" to the "eggs" section of the instance. E.g.:: [instance] recipe = plone.recipe.zope2instance #... eggs = ${buildout:eggs} Products.Zope_Hotfix_20111024 Next, re-run the buildout:: $ /path/to/buildout/bin/buildout and then restart the Zope instance, e.g.: $ /path/to/buildout/bin/instance restart Installing the Hotfix: Manual Installation - ------------------------------------------- You may also install this hotfix manually. Download the tarball from the PyPI page: http://pypi.python.org/pypi/Products.Zope_Hotfix_20111024 Unpack the tarball and add a 'products' key to the 'etc/zope.conf' of your instance. E.g.:: products /path/to/Products.Zope_Hotfix_20111024/Products and restart. Verifying the Installation - -------------------------- After restarting the Zope instance, check the 'Control_Panel/Products' folder in the Zope Management Interface, e.g.: http://localhost:8080/Control_Panel/Products/manage_main You should see the 'Zope_Hotfix_20111024' product folder there. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6l3pQACgkQ+gerLs4ltQ66AgCfT1cd94LXzBtdzNiBqKXnGBIF 7dwAoISO0AkuvERn+cw4W0cPo82c5r+D =xRBY -----END PGP SIGNATURE-----

4 5

Re: [Zope] serious security hole in manage users / Manage users permissions?
by Niels Dettenbach 25 Oct '11

25 Oct '11

Am Montag, 24. Oktober 2011, 17:03:52 schrieben Sie: > Thanks for your info. Any idea if this affects pre 2.10 zope? We've been > running in production 2.9 no problems for a while. No, from my tests all versions in 2.12.20 and 2.13.10 was affected - earlier not - im just wondering why the sec advisory means <=2.13.6. Will investigate that further... > This hotfix addresses a serious vulnerability in the Zope2 > application server. Affected versions of Zope2 include: > > - 2.12.x <= 2.12.20 > > - 2.13.x <= 2.13.6 best regards, Niels. -- --- Niels Dettenbach Syndicat IT&Internet http://www.syndicat.com/

1 0

Manipulating images in Zope/Python
by Brian Sullivan 25 Oct '11

25 Oct '11

I am looking for strategy to programmatically create a customized printable certificate of completion for our Learning Delivery System courses (the system is Zope/Python based). My current plan is to use the Python Imaging Library to create the image (probably by overlaying some text on a stock image of a completion certificate to create a new image). The final image will then be emailed as an attachment to users. Is this a reasonable approach? Any others that anybody can suggest? Any samples of doing anything like this that anyone can point to?

3 2

serious security hole in manage users / Manage users permissions?
by Niels Dettenbach 24 Oct '11

24 Oct '11

Dear Zope 2.12/.13 (4.0) devels, as far as i can see i may have found a serious security hole within Zope 2.12 / 2.13 (4.0 not tested yet) - I'm still investigate here further... problem: ====== Even on fresh Installs of Zope and fresh created instances on it anonymous / remote users able to access acl_users/manage_users by the web WITHOUT AUTHENTICATION. They can edit / delete / create users and serving roles as they want. Other management screens (as manage_main or manage_access aso. are protected as usual). In manage_access Manage user is only allowed for Manager (as by default). I don't believe that is any new behaviour of newer Zope versions... I've tested this with (last public) 2.13.10 and last 2.12.20 with python2.6. If any of the devels want to have a test url pls contact me directly. Fresh installed zope instances was configured with defaults configs, except setting "user zope" (and/or port-base). Tried it with now owner or the admin user as owner of the acl_users too. Can anyone prove this here too? If so, any solution / security fix? many thanks, best regards. Niels. -- --- Niels Dettenbach Syndicat IT&Internet http://www.syndicat.com/

3 2

Urgent:utilsation of paybox with fora zope application
by Diana Lenar 20 Oct '11

20 Oct '11

Hello i am have created a zope application which needs to use paybox i have installed the paybox module in www/cgi-bin/ of the server where zope 2.9 is installed how do i acess the module from my application? pls respond me quickly its very urgent -- Diana.Lenar Analyste Programmeuse 01 41 13 14 48

3 2