- Zope - Zope lists

Small Spam Vulnerability in Squishdot
by Chris Withers 09 Feb '06

09 Feb '06

Garikoitz Araolaza <garaolaza(a)codesyntax.com> has discovered a vulnerability in Squishdot that can result in a Squishdot Site being used to send spam. Full discussion and a fix can be found here: http://www.squishdot.org/1139510883 cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

Session Variables Redux
by Dennis Allison 09 Feb '06

09 Feb '06

Zope 2.9.0 Python 2.4.2 There appears to still be a problem with session variables that does not appear to be the result of interactions with conflicts nor the result of unexpected restarts. It does not appear to be load related. The problem we see is a sudden disappearance of all, one, or a small number of session variables. In a session varaiable stateful system this is an embarassment. The behavior is a bit like a variable which is not identified as persistent, but all read and write accesses go through a getSessionVariable/setSessionVariable interface: ## Script (Python) "getSessionVariable" ##bind container=container ##bind context=context ##bind namespace= ##bind script=script ##bind subpath=traverse_subpath ##parameters=varname ##title= ## request=container.REQUEST session=request['SESSION'] return session[varname] ## Script (Python) "setSessionVariable" ##bind container=container ##bind context=context ##bind namespace= ##bind script=script ##bind subpath=traverse_subpath ##parameters=var, val ##title= ## request = container.REQUEST session=request['SESSION'] # write only if necessary if not session.has_key(var) or session[var]!=val: session[var]=val Our session lifetimes are long (hours, days) and conflicts are fairly frequent. Hand checking of the logs does not show any obvious correlation between session variable loss and conflict. Moreover, all conflicts are "resolved". Does anyone else see this sort of problem? Any suggestions as to how to isolate the problem?

2 1

proxy roles on Product methods
by Palermo, Tom 09 Feb '06

09 Feb '06

Hi All, Is it possible to set proxy roles on methods located in Zope Products. I need to turn the View permission off on some folders so certain users can't see them in a sitemap (uses dtml-tree). However, I've got an edit_html method located in a Zope product that then needs to use stuff in one of the folders that has "View" set to off for that user (who's running edit_html). Thanks, Tom

3 3

htaccess with zope/plone ?
by michael nt milne 09 Feb '06

09 Feb '06

Hi I've managed to set-up SSL over Apache and Zope/Plone virtual hosts on Windows but am slightly stuck on implementing the htaccess part of my solution. I've done extensive googleing but can't seen to find any solid documentation. My question is, do you need the <Directory> definition within the <VirtualHost> ? And what should this be set-to considering that no flat directory exists as everything is served from Plone. Also, where would you put the htpasswd file? In the Plone site somewhere? Thanks -- Michael

6 18

Startup error with Formulator
by Dennis Allison 09 Feb '06

09 Feb '06

Zope 2.8.4 Python 2.4.2 Startup error with Formulator. What's missing or broken? Out of the box: 2006-02-08T01:51:58 ERROR Zope Couldn't install Five Traceback (most recent call last): File "/usr/local/src/zope/Zope2.8/lib/python/OFS/Application.py", line 773, in install_product initmethod(context) File "/usr/local/src/zope/Zope2.8/lib/python/Products/Five/__init__.py", line 29, in initialize zcml.load_site() File "/usr/local/src/zope/Zope2.8/lib/python/Products/Five/zcml.py", line 45, in load_site _context = xmlconfig.file(file) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 439, in file include(context, name, package) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 375, in include processxmlfile(f, context) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 245, in processxmlfile parser.parse(src) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/expatreader.py", line 109, in parse xmlreader.IncrementalParser.parse(self, source) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/xmlreader.py", line 123, in parse self.feed(buffer) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/expatreader.py", line 216, in feed self._parser.Parse(data, isFinal) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/expatreader.py", line 364, in end_element_ns self._cont_handler.endElementNS(pair, None) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 225, in endElementNS self.context.end() File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/config.py", line 518, in end self.stack.pop().finish() File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/config.py", line 665, in finish actions = self.handler(context, **args) File "/usr/local/src/zope/Zope2.8/lib/python/Products/Five/fiveconfigure.py", line 56, in loadProducts xmlconfig.include(_context, zcml, package=product) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 375, in include processxmlfile(f, context) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 245, in processxmlfile parser.parse(src) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/expatreader.py", line 109, in parse xmlreader.IncrementalParser.parse(self, source) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/xmlreader.py", line 123, in parse self.feed(buffer) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/expatreader.py", line 216, in feed self._parser.Parse(data, isFinal) File "/usr/local/lib/python2.4/site-packages/_xmlplus/sax/expatreader.py", line 353, in start_element_ns AttributesNSImpl(newattrs, qnames)) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/xmlconfig.py", line 206, in startElementNS self.context.begin(name, data, info) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/config.py", line 515, in begin self.stack.append(self.stack[-1].contained(__name, __data, __info)) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/config.py", line 815, in contained return RootStackItem.contained(self, name, data, info) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/config.py", line 683, in contained factory = self.context.factory(self.context, name) File "/usr/local/src/zope/Zope2.8/lib/python/zope/configuration/config.py", line 461, in factory raise ConfigurationError("Unknown directive", ns, n) ZopeXMLConfigurationError: File "/usr/local/src/zope/Zope2.8/lib/python/Products/Five/skel/site.zcml", line 12.2-12.23 ZopeXMLConfigurationError: File "/opt/zope/zproducts/standard/Formulator/configure.zcml", line 7.2 ConfigurationError: ('Unknown directive', u'http://namespaces.zope.org/i18n', u'registerTranslations') ------ The offending file is: <configure xmlns="http://namespaces.zope.org/zope" xmlns:i18n="http://namespaces.zope.org/i18n" >  <i18n:registerTranslations directory="i18n" /> </configure> --

2 2

ExtFile - wrong file extension and content_type
by Palermo, Tom 09 Feb '06

09 Feb '06

All, I am working on a project using ExtFile. Lately, when uploading MS Word files, they get uploaded to the file system as .exe files (eg. test.doc becomes test.exe) and the content_type is set to application/octet-stream instead of application/msword. Sometimes the content_tpye is correct but the file extension is still set to .exe. Does anyone know what could be causing this? Is there a config setting in ExtFile that's doing this? Any ideas would be much appreciated. Thanks, Tom

4 3

Re: [Zope] major problems placing authentication on an extranet site-security flaw?
by Sascha Welter 09 Feb '06

09 Feb '06

(Wed, Feb 08, 2006 at 12:00:07PM -0500) zope-request(a)zope.org wrote/schrieb/egrapse: > From: michael nt milne <michael.milne(a)gmail.com> > Subject: [Zope] major problems placing authentication on an extranet > site-security flaw? > I have major problems here trying to set-up authentication over a whole > Plone site using Zope. You are aware that there is a Plone mailing list? And that Plone handles many things in special ways different from "stock", plain Zope (e.g. having Groups of users)? > Using my superuser account I've navigated to the site > root page in the ZMI where it lists all the site pages and objects etc. I've > then gone into security, scrolled down to the bottom and for the 'View' > option I have tried all combinations of 'Manager', 'Authenticated' and > 'Aquire'. It simply won't work. plone.org had fine tutorials and howtos for setting up closed plone sites last time I looked. > I get a pop-up box but the superuser manager pass doesn't work. Then, even A pop-up box? Plone doesn't use that. You either have murked up your setup completely or you have set up stuff that you are not telling us. > I find the Zope security, permissions set-up hideously complex and unusable > to be honest and it doesn't even seem to work. That is the proper attitude to get help. For some people always all the world is at fault. For other people their own lack of understanding turns to the revelation that it's *their* lack and they can do something about it. Regards, Sascha

1 0

Zope=ZEO connection
by Dennis Allison 08 Feb '06

08 Feb '06

Zope 2.9.0 Python 2.4.2 Amd dual Opteron Linux I am seeing occasional (several per day) Zope crashes under load. The event.log immediately before and after the crash looks like: 2006-02-06T14:07:20 INFO ZPublisher.Conflict ConflictError at <some path>: database conflict error (oid 0x086e, class BTrees._OOBTree.OOBTree, serial this txn started with 0x03633ca95f75e900 2006-02-06 22:01:22.373575, serial currently committed 0x03633caf59114244 2006-02-06 22:07:20.875176) (463 conflicts (0 unresolved) since startup at Mon Feb 6 08:21:26 2006) ------ 2006-02-06T14:09:09 INFO ZServer HTTP server started at Mon Feb 6 14:09:09 2006 Hostname: x-harper Port: 8081 which also triggers a connection drop and restarBt of ZEO. The failure happens silently even with <eventlog> level ALL <logfile> path $INSTANCE/log/event.log level info </logfile> </eventlog> When this happens zope is running under zopectl and zeo isi running under zeoctl. What sort of Zope failure can cause this sort of behavior? What's the best approach to get more information to localize the failure.

4 4

work around for importing zexp into zope2.8.1?
by Tim Nash 08 Feb '06

08 Feb '06

Hello Group, Has anyone come across a work around for the problem of importing zexp into zope 2.8.1? I want to utilize iungo which requires zexp imports but I'd rather not ask my hosting provider for an update to zope. Thanks Tim BTW, thanks for the input on using zope as a standard application server.

3 3

Help with a simple DMS
by Joshua Gilbert 08 Feb '06

08 Feb '06

Hi. I'd like to make a simple DMS, users upload their PDFs/docs/ps/whatever and then they can search within the documents. I need to be able to automate the submission of documents as I'm part of a large research lab, we've accumulated a lot of papers over the years. Other than that I'd like a nice, simple authentication scheme. That's about it. Dead simple. Please help. I've got an instance of Zope running, with Plone. The plethora of tools is bewildering to me and I don't know what to use. I am a Python programmer (three years now I think) but I'd like to minimize the amount of code I have to write. Simplicity and ease of use are my watchwords. If Zope doesn't provide what I'm looking for, can you suggest anything else? Thank you. Josh.

2 3