- Zope - Zope lists

RE: [Zope] Major security flaw in Zope 2.3.2
by sean.upton＠uniontrib.com 11 Jun '01

11 Jun '01

You can just use a squid external redirector (jesred, pyredir, squirm, or custom) to get the same kind of thing out of Squid as you would expect from mod_rewrite; then, that means you are using the same mechanism for Zope virtual hosts as you are for URL rewriting. I'm not sure if Apache buys one anything more in the rewrite dept. The one catch is you likely have to use a custom redirector (or tweak the Python code in pyredir) if you want POST methods to be supported, but this is not too big of a deal. The 2 squid caches in my setup are peers, sharing ICP connections over a dedicated network; I am working on setting up the second peer today. The boxes are balanced by a layer 4 switch (Intel 7140), which is set up for "OPR" mode, which sends incoming packets through the L4 switch, but outgoing packets directly out from the Squid boxes, bypassing the load-balancer. I'm trying to scale this whole infrastructure without creating a lot of latency... The nice thing about this, is that it seems to be very clean conceptually for my company's infrastructure because, as a media company, we publish a lot of material out to the web - from several places: static files, Zope, CF, and PHP stuff. In order to support all that and have caching site wide (not just for Zope), it makes sense in my case to put Squid on the outside of the setup, closest to the user downloading content. Sean -----Original Message----- From: Toby Dickenson [mailto:tdickenson@devmail.geminidataloggers.co.uk] Sent: Thursday, June 07, 2001 3:49 AM To: sean.upton(a)uniontrib.com Cc: zope(a)zope.org Subject: Re: [Zope] Major security flaw in Zope 2.3.2 On Wed, 06 Jun 2001 14:05:06 -0700, sean.upton(a)uniontrib.com wrote: >I've never heard of putting squid _between_ apache and ZServer, but why not >put squid on the outside of your system as to not create extra latency? Ive measured latency at moderate loads... for cache misses the difference is negligible, largely because Zope has a relatively high latency. If you have some pages that are: * uncacheable, and * latency-critical then you could use mod_rewrite to send them directly to Zope (not via squid). The advantages (for me) of putting Apache on the outside are virtual hosting, and using mod_rewrite to pull other back-end servers into Zope's URL namespace. >I think squid is much more advanced than mod_proxy in terms of caching >options and raw speed. I am currently setting up a ZEO cluster with nodes >running ZServer sitting behind a pair of load-balanced squid caches Interesting. Are you planning these two Squid's to be independant, or peers? Toby Dickenson tdickenson(a)geminidataloggers.com

2 1

R�f. : [Zope] dtml-if problem
by Francois-regis Chalaoux 11 Jun '01

11 Jun '01

May be <dtml-if expr="id == warez"> should be <dtml-if expr="id == 'warez'"> (simple quoted) ? FR sajt(a)amon.hu%internet le 11/06/2001 10:26:45 Pour : zope@zope.org%internet@WTFR cc : Objet : [Zope] dtml-if problem X-Accept-Language: en Errors-To: zope-admin(a)zope.org X-BeenThere: zope(a)zope.org X-Mailman-Version: 2.0.5 (101270) Precedence: bulk List-Help: <mailto:zope-request@zope.org?subject=help> List-Post: <mailto:zope@zope.org> List-Subscribe: <http://lists.zope.org/mailman/listinfo/zope>, <mailto:zope-request@zope.org?subject=subscribe> List-Id: Users of the Z Object Publishing Environment <zope.zope.org> List-Unsubscribe: <http://lists.zope.org/mailman/listinfo/zope>, <mailto:zope-request@zope.org?subject=unsubscribe> List-Archive: <http://lists.zope.org/pipermail/zope/> Hello, I have a little problem, but I don't find the solution for it. Here is the code: ----- <form name='ware'> <select name="warez" onChange="document.ware.submit()"> <dtml-if warez> <dtml-in wares> <dtml-if expr="id == warez"> <OPTION VALUE=<dtml-var id> DEFAULT><dtml-var sname> <dtml-else> <OPTION VALUE=<dtml-var id>><dtml-var sname> </dtml-if> </dtml-in> <dtml-else> <dtml-in wares> <OPTION VALUE=<dtml-var id>><dtml-var sname> </dtml-in> </dtml-if> </select> </form> ----- But the <dtml-if expr="id == warez"> is never true. Why it is possible? Thanks for your help. -- Amon Tamas sajt(a)amon.hu _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Transactions
by Daniel Fairs 11 Jun '01

11 Jun '01

Hi, Reading some of the recent emails on Zope's transaction engine, something popped into my head which isn't mentioned in the book. How visible are Zope's transactions? I'm talking about the difference between read committed, read uncommitted and serializable transactions that you get in relational databases. I'm guessing that objects in Zope which participate in transactions can see changes made during that transaction? Is it possible to change this, so other transactions can read uncommitted data? Clearly, this isn't so important on smaller sites - but what happens when you start using Zope in high-transaction-volume sites? I'm just curious... ;) Cheers, Dan _________________________________________________________________ Daniel Fairs | daniel.fairs(a)spiderplant.net | www.spiderplant.net

2 1

ZSql Method with like.
by After Dark 11 Jun '01

11 Jun '01

How should I do to use 'like' with ZSql Method? Similar to the example: Ex.: SELECT field1 FROM table WHERE field2 LIKE '%test%' I tryed this: --> arq is an argument select field1 from table where field2 like '%<dtml-sqlvar arg type=string>%' Then I get this: select field1 from table where field2 like '%'agx'%' I need to put the char '%' with the var. Thanks. -- --Ricardo Kohler Costa ________________________________________________ Don't E-Mail, ZipMail! http://www.zipmail.com/

3 2

ZCatalog eliminate duplicate
by Andreas Muenster 11 Jun '01

11 Jun '01

Hi everybody ! I just have 2 simple questions: How do I avoid getting duplicate Results in a ZCatalog query like this <dtml-let res="Catalog(body=search_text)+Catalog(PrincipiaSearchSource=search_text)+Ca talog(title=search_text)+Catalog(id=search_text)"> and how can i filter out unauthorized documents: e.g.: <dtml-in res size=50 start=query_start skip_unauthorized> doesnt work if i filter it out with dtml code in the <dtml-in res ...> statement how can I then change the counter ? Otherwise if 49 documents are unauthorized just one will show up. Thx in Advance Andreas Muenster

1 0

DTML abc?
by Arjan de Knegt 10 Jun '01

10 Jun '01

All, I just have a tiny little DTML question that I can't seem to solve: Some of my object ID's contain dot's, e.g. "NicePicture.jpg". Yes, I do know Zope doesn't need (or want?) the use of extension like "jpg" in object ID's , but I have my reasons to do so. Now I simply would like to render this object with dtml-var. Al DTML syntaxes I can think of result in Zope errors, propably because Zope thinks the ".jpg" part is an object method instead of part of the object ID? Can anyone point me in the right direction? Regards, Arjan.

3 3

Re: [Zope] Unique IDs
by Tres Seaver 10 Jun '01

10 Jun '01

> "Daniel Fairs" <daniel.fairs(a)spiderplant.net> >> And additionally - instead of using hashes - >> just to use a timestamp? > > > The key thing I need is unpredictability - hence my originally wanting to > use md5 as the last step in the generation. The 'usual' way to do this is to > seed the random number generator with the current time, pull a number out of > that and then do an md5 on it. I've got a number of options now, I'll look > at them > > However, this doesn't answer the first part of my original question - why is > Zope asking me for further credentials when I try to use the md5 module? I'm > guessing md5 is in the security sin bin along with re and other stuff... but > why md5? It isn't a "sin bin"; TTW-scripting (PythonScripts, and, in 2.4, DTML) have a "deny by default" access policy for Python modules; you can "bless" the md5 module using a "patch-style" product, as described in the PythonScript product's README ('lib/python/Products/PythonScripts/README.txt'). You can use an ExternalMethod, if you prefer not to go this route. Tres. -- =============================================================== Tres Seaver tseaver(a)digicool.com Digital Creations "Zope Dealers" http://www.zope.org

1 0

Re: [Zope] Bug tracking product
by Tres Seaver 10 Jun '01

10 Jun '01

Gitte Wange <gitte(a)mmmanager.org> wrote > I am looking for a bug tracking product for Zope that also can contain > feature requests. Everybody should be able to enter bugs and/or feature > requests. > > Does suck a product exists ? http://www.zope.org/Members/klm/TrackerWiki/FrontPage Tres. -- =============================================================== Tres Seaver tseaver(a)digicool.com Digital Creations "Zope Dealers" http://www.zope.org

1 0

transaction control from Zope to Postgresql?
by Reinoud van Leeuwen 10 Jun '01

10 Jun '01

Hello world, I am in need for a way to explicitely contral transaction behaviour for a group of inserts in a postgresql database. The DTML script I use first inserts a header record and after that some detail records. The postgresql function that does the inserts might return an errorstring. So I tried the following code (simplified for readability) <dtml-try> <dtml-call "sql_to_insert_head_record (some_parameters)"> <dtml-in "a_loop_over_detail_lines"> <dtml-if "check_detail_line"> <dtml-raise required_attribute_missing> errormessage </dtml-raise> </dtml-if> <dtml-call "sql_to_insert_detail_line"> <dtml-if "check_returncode"> <dtml-raise inserterror> error inserting! </dtml-raise> </dtml-if> </dtml-in> <dtml-except> insert failed (error: <dtml-var error_value>) <dtml-else> object added to database </dtml-try> What I would like to do is that all the SQL executed between dtml-try and dtml-except is rolled back when the exception is raised. I tried sending "begin" and "rollback" to the database, but that does not work because Zope sends some transaction control by itself. I tried getting get_transaction().begin() and get_transaction().abort() to work, but I cannot reach that function from dtml not python script. Anyone has some clues to spare? Have a nice weekend, Reinoud

2 1

RE: [Zope] Sharing Database connections and/or methods between Zo pes?
by Schmidt, Allen J. 10 Jun '01

10 Jun '01

Well, with my limited Python, that is easier said than done. Something to shoot for though. Thanks Andy!!! Allen -----Original Message----- From: Andy McKay [mailto:andym@ActiveState.com] Sent: Tuesday, June 05, 2001 1:19 PM To: Schmidt, Allen J.; zope(a)zope.org Subject: Re: [Zope] Sharing Database connections and/or methods between Zopes? Here's how I would do it: Write a python script that calls your SQL and transfer the results into a list of dicts and returns that. You can then call the python script through xml-rpc and can hence parse the results. Cheers. -- Andy McKay. ----- Original Message ----- From: "Schmidt, Allen J." <aschmidt(a)nv.cc.va.us> To: "'Andy McKay'" <andym(a)ActiveState.com>; "Schmidt, Allen J." <aschmidt(a)nv.cc.va.us>; <zope(a)zope.org> Sent: Tuesday, June 05, 2001 10:05 AM Subject: RE: [Zope] Sharing Database connections and/or methods between Zopes? > Don't even care about slow at this point! Just the functionality.... > > So I can assume then that remote access of ZSQL methods is not possible?? > > > Seems like ZEO is the answer for everything! <8^) > > If anyone can think of a reason why this would not work, please drop a note. > If this is considered OT then jsut email me directly. > > -----Original Message----- > From: Andy McKay [mailto:andym@ActiveState.com] > Sent: Tuesday, June 05, 2001 1:09 PM > To: Schmidt, Allen J.; zope(a)zope.org > Subject: Re: [Zope] Sharing Database connections and/or methods between > Zopes? > > > Ah well thats the point of a database of course, is you can share it. You > could concont some other solution with other stuff but you might find it > slow. > > This sound like a perfect job for ZEO. > > Cheers. > -- > Andy McKay. > _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

2 1