- Zope - Zope lists

SECURITY alert and hotfix release...
by Brian Lloyd 23 Feb '01

23 Feb '01

Hello All, Casey Duncan uncovered a potential security issue today that necessitated a hotfix release. This hotfix addresses an important security issue that affects Zope versions up to and including Zope 2.3.1 b1. The issue is related to ZClasses in that a user with through-the-web scripting capabilities on a Zope site can view and assign class attributes to ZClasses, possibly allowing them to make inappropriate changes to ZClass instances. This patch also fixes problems in the ObjectManager, PropertyManager, and PropertySheet classes related to mutability of method return values which could be perceived as a security problem. We *highly* recommend that any Zope site running versions of Zope up to and including 2.3.1 b1 have this hotfix product installed to mitigate these issues if the site is accessible by untrusted users who have through-the-web scripting privileges. - http://www.zope.org/Products/Zope/Hotfix_2001-02-23/README.txt - http://www.zope.org/Products/Zope/Hotfix_2001-02-23/Hotfix_2001-02-23.tgz Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Timing under Zope
by Shahzad Saleem 23 Feb '01

23 Feb '01

Hi, Just wondered if anyone could help me solving a problem using Zope: I have a html <form> code within a DTML Document, is there anyone to send the data to my method after a defined time rather than when the user presses the submit button??? I would be grateful for any help and ideas, SS

3 2

re: Zope ODB Recovery questions
by Chris Beaumont 23 Feb '01

23 Feb '01

Hi, Please disregard my previous message, the problem is fixed now. Ours is a pretty heavily SQL-dependent site, and the problem turned out to be a network connectivity problem between our web server and our database. Its funny how a problem with the database, on another machine, seemed to almost make everything else in our Zope install grind to a halt as well. Thank you, Chris > Hello! > > I'm trying to recover a Zope installation that stopped working > yesterday, from the previous night's backed up copy of the ZODB, and I > have several questions. Hopefully someone can help? > > The management interface is coming up after authentication with the > frameset, but two blank frames on left and right..(no content) > > Should all the files be owned by the Zope owner, and is there anyplace > where I can find documentaion on the proper permissions for everything? > > The Zope owner (in my case www-data, because I'm on a Debian Linux > system) owns everything now, should www-data own *all* of the files? > > Can anyone think why a working DCOracle installation would suddenly stop > working? Along with everything else, suddenly, it is not functioning and > I'm getting in the sqlnet.log dump file an 'error 12545' which from what > I can gather, means that the DCOracle isnt making it to the network.. > Another Zope install I have is working fine..as far as I can see, they > are identical. > > This whole problem started yesterday with some corrupted data getting > through DCOracle into our Oracle 7.3.4 DB, causing all queries from apps > that returned the corrupted record to drop the connection. That glitch > seems to be what caused todays problem. Has anyone else ever seen this > wierd "domino theory" interaction? > > Any help anyone could offer would be very much appreciated. We are a > nonprofit that can't really afford the commercial content management > tools and we have come to depend on Zope quite a bit.

1 0

How do I use variable variables in pythonscript?
by Jason.Jones＠awl.com 23 Feb '01

23 Feb '01

I would like to do something like the following: <dtml-var "_[getform('do')]"> where getform('do') returns the name of the method that is then called, but I want to do it from a python script, that is, given a variable or a function, I would like to evaluate what it stands for, for instance: for action in things_to_do: context.action() where things_to_do is a list of names for method calls that I want to execute in the python script's context. Is there a way to do this? What about something like the python script equivalent of the dtml: <dtml-var "_[getform('do')+'_view']"> Thanks, Jason

2 1

Zope ODB Recovery questions
by Chris Beaumont 23 Feb '01

23 Feb '01

Hello! I'm trying to recover a Zope installation that stopped working yesterday, from the previous night's backed up copy of the ZODB, and I have several questions. Hopefully someone can help? The management interface is coming up after authentication with the frameset, but two blank frames on left and right..(no content) Should all the files be owned by the Zope owner, and is there anyplace where I can find documentaion on the proper permissions for everything? The Zope owner (in my case www-data, because I'm on a Debian Linux system) owns everything now, should www-data own *all* of the files? Can anyone think why a working DCOracle installation would suddenly stop working? Along with everything else, suddenly, it is not functioning and I'm getting in the sqlnet.log dump file an 'error 12545' which from what I can gather, means that the DCOracle isnt making it to the network.. Another Zope install I have is working fine..as far as I can see, they are identical. This whole problem started yesterday with some corrupted data getting through DCOracle into our Oracle 7.3.4 DB, causing all queries from apps that returned the corrupted record to drop the connection. That glitch seems to be what caused todays problem. Has anyone else ever seen this wierd "domino theory" interaction? Any help anyone could offer would be very much appreciated. We are a nonprofit that can't really afford the commercial content management tools and we have come to depend on Zope quite a bit. *Thank you!* Chris cbeaumon(a)msri.org

1 0

Re: [Zope] input a date in european style, get it saved as type date (Was: How do I get the first ten characters of a string?)
by Andrew Williams 23 Feb '01

23 Feb '01

>I like this fmt thing... I agree... > >I tried a few things. > >My actual problem now is: > >I've got a form, which returns a date string in the form dd.mm.YYYY via >REQUEST. > >Before this last line I have to change my dd.mm.YYYY into Zope's >YYYY/mm/dd. >i. e. s. th. like > ><dtml-call "REQUEST.set('datum',?????)"> > >I looked around in the How To's etc. but didn't find anything. > >Perhaps you could help me a last time for today. > Here are a couple of things: First, you can tell Zope that a value returned from a form is a specific type; ie: <INPUT TYPE="TEXT" NAME="somedate:date"> <INPUT TYPE="TEXT" NAME="someint:int"> Zope gets the request, and automagically casts somedate into a date object, and someint into an integer. Check out this HowTo regarding Form Variable Types: http://www.zope.org/Members/Zen/howto/FormVariableTypes Second, you can also convert a string into a date object by doing the following: <dtml-call "REQUEST.set('datevalue',_.DateTime(somedate)"> check out the Zope Quick Reference (ZQR) at http://www.zope.org/Members/ZQR for more info on the DateTime() function. One caution, make sure you have validated that the user has inputted a correct date before doing the above. Otherwise you will get error messages. Personally, I use javascript to validate date fields *before* the user submits the form; saves me a lot of headaches. Hope this helps, Andrew Williams _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

Overriding "title"
by Tim Moore 23 Feb '01

23 Feb '01

I have a ZClass with a DTML method called "title" which computes a title for an instance based on the value of another property. Almost everything seems to work fine...I can use the title attribute in my standard_html_header, the computed title shows up correctly on the management screen. But calling title_or_id on one of these instances raises a KeyError. Is this expected behavior or a bug? Zope 2.3.0 on Linux. thanks, -- Tim Moore

1 0

Re: [Zope] How do I get the first ten characters of a string?
by Lars Heber 23 Feb '01

23 Feb '01

Chris Withers schrieb: > Lars Heber wrote: > > > > <dtml-let myTest="'some really senseless blah'"> > > <dtml-var *first 10 characters of myTest*> > > </dtml-let> > > <dtml-var "myTest[:10]"> > > cheers, > > Chris I tested it out - didn't work. I wanted to do that with a date: <dtml-let datum="ZopeTime()+7"> <dtml-var "datum[:10]"> </dtml-let> "Date is unsliceable"... ??? What I want to get is just the date without the time! Any ideas? Some more questions: - I'd like to give my each instance of my ZClass a title, which is then shown in the folder window, just like documents for example. I tried to simply create a property "title" in my property sheet, but as expected, it of course didn't refer to that property to show it in the overview. - How can I get the source code of manage_main? I'd like to modify it a little within my ZClass. Thanks to you all!!! Lars

4 4

Re: [Zope] Re: Zope digest, Vol 1 #1209 - 45 msgs
by Andrew Williams 23 Feb '01

23 Feb '01

>From: "Peter Bengtsson" <peter(a)grenna.net> >To: <lee.reilly(a)ntlworld.com> >CC: <zope(a)zope.org> >Subject: Re: [Zope] Re: Zope digest, Vol 1 #1209 - 45 msgs >Date: Fri, 23 Feb 2001 17:48:50 -0000 > >I never received the Digest for some strange reason, so I might be out of >reference but... > >Javascript must NEVER BE NECESSARY!! What must never happen is that you are >disabled for working properly only because a Javascript doesn't happen to >work. I wouldn't agree with NEVER NECESSARY... for example, I'm writing a web application for our department. We have standarized on IE 5.0 or higher; The "non-compliant" browser users are few (myself included) and have *reasonably* compliant javascript browsers. In this case, using javascript is safe; I know my target browsers and I know that any differences will be version levels. Andrew Williams _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

Re: Zope digest, Vol 1 #1209 - 45 msgs
by Lee 23 Feb '01

23 Feb '01

> Unfortunately this is not possible, because we mustn't use JavaScript > nor Java for the usual reasons. Pure HTML only. Are you saying that you shouldn't use Java / JavaScript with Zope at all? Forgive my ignorance; but why? The management screens might use a little JavaScript but I don't *think* this would cause any conflicts/probs. Cheers, Lee

3 2