- Zope - Zope lists

new 2.2.4 security/role bug ?? (ZCatalog related ??)
by Didier Georgieff 18 Dec '00

18 Dec '00

Hello, I'm experimenting some really weird and annoying things since i upgraded to 2.2.4 with 12-08 and even with 12-15a hotfix (seems to be ok in 2.2.2) For all objects, I can access directly (URL) with no problem (according to the roles and the local roles. This is ok). For some of those objects (seems to be all the one i've added in 2.2.4 in folders with local roles) I can't (exeption raise) access the objects while in the context of the catalog (those objects are Catalog Aware via Yihaw product). I epurate the method until this minimal test method who still raise the exeption <dtml-in Catalog> <dtml-with "Catalog.getobject(data_record_id_)"> <a href="&dtml-absolute_url;"><dtml-var title_or_id></a><br> </dtml-with> </dtml-in> I have a workaround with a <dtml-try> but i miss all the objects, while they are fully reachable directly via their URL The problems seems to be on objects with local roles (anonymous has no view, no access content and other roles have this autorisations via local roles). The second weird thing (should help for a diagnostic) is : While i have "manager" role (i can do whatever i want on the manage interface), i tried to give a proxy role to my test method, to see if i could investigate further. And trying to change the proxy role raised an execption, despite the fact i have manager role with full autorisations. This last thing makes me think is an acquisition/role/security bug. Any idea/solution because we offcially open tomorrow morning, and i'm in a deep.... well embarassed ;-)) =======> This is the FIRST traceback. Zope Error Zope has encountered an error while publishing this resource. Unauthorized You are not authorized to access title_or_id. Traceback (innermost last): File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/OFS/DTMLMethod.py, line 172, in __call__ (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/DocumentTemplate/DT_String.py, line 528, in __call__ (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/DocumentTemplate/DT_In.py, line 611, in renderwb (Object: Catalog(bobobase_modification_time=ZopeTime()-14, bobobase_modification_time_usage='range:min', sort_on='bobobase_modification_time', sort_order='reverse')) File /home/georgieff/Zope-2.2.2- src/lib/python/DocumentTemplate/DT_With.py, line 146, in render (Object: Catalog.getobject(data_record_id_)) File /home/georgieff/Zope-2.2.2- src/lib/python/OFS/DTMLMethod.py, line 194, in validate (Object: test_latest) File /home/georgieff/Zope-2.2.2- src/lib/python/AccessControl/SecurityManager.py, line 139, in validate File /home/georgieff/Zope-2.2.2- src/lib/python/AccessControl/ZopeSecurityPolicy.py, line 209, in validate Unauthorized: (see above) =======> This is the SECOND traceback. Zope Error Zope has encountered an error while publishing this resource. Forbidden You are not authorized to change test_latest because you do not have proxy roles. Traceback (innermost last): File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 222, in publish_module File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/georgieff/Zope-2.2.2-src/lib/python/Zope/__init__.py, line 221, in zpublisher_exception_hook (Object: test_latest) File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: manage_proxy) File /home/georgieff/Zope-2.2.2-src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: manage_proxy) File /home/georgieff/Zope-2.2.2-src/lib/python/OFS/DTMLMethod.py, line 278, in manage_proxy (Object: test_latest) File /home/georgieff/Zope-2.2.2-src/lib/python/OFS/DTMLMethod.py, line 271, in _validateProxy (Object: test_latest) Forbidden: (see above) -- Didier Georgieff DDAF du Bas-Rhin - Cellule SIG 2, rue des Mineurs 67070 Strasbourg Cedex tél : 03.88.25.20.33 - fax : 03.88.25.20.01 email : didier.georgieff(a)agriculture.gouv.fr SIT du Bas-Rhin : http://www.bas-rhin.sit.gouv.fr GéoWeb http://sertit10.u-strasbg.fr

2 1

Python Method and builtin-functions
by Sven Hohage 18 Dec '00

18 Dec '00

Hello, I'd like to use Python - Methods but I'm afraid that some builtin-functions are not implemented like type() or list(). Is this a problem of me or are my nightmares fulfilled. Another question is if the Python-Method-product is the same thing as the one shipping with Zope 2.3? Thanks.

2 1

ANNOUNCE: Zope security alert and hotfix release
by Brian Lloyd 18 Dec '00

18 Dec '00

Hi all - A security issue has recently come to our attention (thanks to Erik Enge for identifying this) that affects Zope versions up to and including Zope 2.2.4. The issue involves the computation of local roles. In some situations the computation was not climbing the correct hierarchy of folders, sometimes granting local roles inappropriately. This could allow users with privileges in one folder to gain the same privileges in another folder. We *highly* recommend that any Zope site running versions of Zope up to and including 2.2.4 have this hotfix product installed to mitigate the issue. - http://www.zope.org/Products/Zope/Hotfix_2000-12-15/README.txt - http://www.zope.org/Products/Zope/Hotfix_2000-12-15/Hotfix_2000-12-15.tgz The hotfix will work for all versions of Zope 2.2.0 and higher. A future version of Zope will contain the fix for this issue, and you will be able to uninstall the hot fix after upgrading. Note that we will be making a Zope 2.2.5 release early next week that includes the fix for this issue as well as the issue addressed by the recent 12/08 hotfix. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

2 3

Stupid File Upload Question
by jpenny＠universal-fasteners.com 18 Dec '00

18 Dec '00

This is for Jos: I ran into the same problem today. I had previously used this method, and it works better than LocalFS for my purposes. Anyway, be absolutly sure that your form says: <form method=post action=whatever method="multipart/form-data"> ... </form> Then you should be able to access REQUEST.form['attachment'].filename and REQUEST.form['attachment'].read() (Well, I hope). If the method=post is omitted, Netscape (linux at least) will work. MSIE will not. Man I ain't got enough hair for these kinds of problems! Jim Penny

3 3

PopyDA and DBMS Transactions
by Paolo Quaglia 18 Dec '00

18 Dec '00

Hi I heve finally installed the PopyDA0.7 that is a Multithreaded DA (multiple concurrent access on the DBMS) Now I'm doing tests to verify the DBMS transactions (Postgress support DB transations): But something doesn't work as expected: I summarize my tests: I have two DTML Documents: first DTML: now called D1 <dtml-var header> ...1st sql statement: select * from customers where name='white' ...time.sleep(10) #external function that invokea the sleep function (10 sec) ...2dn sql statement: update customer set descr='Updated 1' where customer='white' <dtml-var footer> Second DTML: now called D2 <dtml-var header> ...sql statement: update customer set descr='Updated 2' where customer='white' <dtml-var footer> with two browser I called: D1 and then D2 My expected Behaviour was: -With the first statement of D1, Postgres would locks the table The update of D2 has to wait to write because the table is locked only when D1 has finished, D2 commit As result the updated field has to result "Update 2" and not 'Update 1" With the option Auto-commit mode ON the Behaviour was: -D2 autocommit without waiting the end of D1! (as espected with autocomm. off) As result the updated field has to result "Update 1" (because D1 ended after D1) With the option Auto-commit mode OFF the Behaviour was: -D2 autocommit without waiting the end of D1!!!!!!!!!! Why??????!?!??!? -When D1 finished an error occurs: Error Type: ProgrammingError Error Value: ERROR: Can't serialize access due to concurrent update As result the updated field has to result "Update 2" FAULT!! HOW CAN I HAVE TO DO in order to build a concurrent transaction Application with Popy and Postgress??? Thank you Very Much for your Help! Paolo Quaglia Information Technology Coordinator Sitek S.p.A. paolo(a)sitek.it

2 1

Re: [Zope] How to make two racks work under one specialist?
by Dirksen 18 Dec '00

18 Dec '00

Hi Steve, Both racks are set to be loaded by accessing 'id', which, as you guessed right, don't appear in handling attributes list! This is the simplified skinscript in maleMemberRack: WITH getMale(self.id) COMPUTE original_object=RESULT WITH self.original_object COMPUTE name=id, gender=gender, email=email getMale is a python method: member = getMember(id) if id.gender == 'male': return member Things just go opposite direction in femaleMemberRack. What do you think? Dirksen __________________________________________________ Do You Yahoo!? Yahoo! Shopping - Thousands of Stores. Millions of Products. http://shopping.yahoo.com/

2 1

Bizarre Netscape Problem
by Robin Becker 18 Dec '00

18 Dec '00

On my Win98 SE Zope 2.2.2 I have some zope permissions which I can view fine in IE 5 or from a networked box with Netscape 4.7. However, when I attempt to view the permission with Netscape it seems as though Netscape starts to use larger and larger amounts of memory. I have no explanation and checking the xml dump of the permission it seems to have a similar structure. In desperation I changed the netscape to 4.76, but the problem persists. I am stumped! Any one got any ideas? -- Robin Becker

2 2

Re: [Zope] PoPy1.4 Installed:
by Federico Di Gregorio 18 Dec '00

18 Dec '00

> Here Is some tips to install PoPy DA on a RH6.2 > > First: You have to use Postgres7.0 with PoPy1.4 > - download the Postgres7.0 with the development libraries (the development > RPM from the Postgres download) > - Download the Popy1.4.1 and the ZPopyDA0.7 > - untar Popy1.4.1 > - $./configure mmm... ./configure --postgreql-includes=/usr/include/pgsql is much better (do a ./configure --help to display all the configuration options...) > - change the Makefile ... the include path isn't /usr/include/postgres but > it's /usr/include/pgsql not required if you do as above. > - the file /usr/include/pgsql/os.h is a broken link .. we have to solve this > prob yes, this is a problem. > - copy the popymodule.so in the [zopedir]/lib/python no. popy should live in the *python* hierarchy. just do a "make install" and make will take care of installing it in the right directory (usually /usr/lib/python1.5/site-packages or the local alternative.) ciao, federico -- Federico Di Gregorio MIXAD LIVE Chief of Research & Technology fog(a)mixadlive.com Debian GNU/Linux Developer & Italian Press Contact fog(a)debian.org All programmers are optimists. -- Frederick P. Brooks, Jr.

1 0

Troubles importing module DemoPortal.zexp
by Francisco M. Marzoa Alonso 18 Dec '00

18 Dec '00

Hi there everybody, I'm trying to install the ZopePTK on my SuSE LiNUX 7.0 box but I'm having troubles. I've followed installation instructions at http://www.zope.org//Products/PTK/ZWiki/PTKInstallation literally saving this point: [...] 3. Copy DemoPortal.zexp and Wizard.zexp to your .../import [...] where I've created symlinks to these zexp files instead or copy them to save disk space. I've tested that symlinks and permissions are both OK. I've imported Wizard.zexp succesfull following the instructions at mentioned document, but when I try to do the same operation with DemoPortal.zexp I receive the following persistant error message: Error Type: ImportError Error Value: No module named PythonMethod.PythonMethod Package files that I'm using are: Zope-2.2.2-linux2-x86.tgz ZopePTK-0.9.2-src.tar.gz Can someone help me with this? Thanks a lot in advance, -- Francisco M. Marzoa Alonso Loyalt-e Commerce, S.A. System Administrator & Po. de la Chopera, 29 Software Developer 28760 - Madrid - España/Spain e-mail: fmmarzoa(a)loyalt-e.com Phone: +34 914 841 068 Powered by LiNUX! Fax: +34 916 613 954

2 2

PoPy1.4 Installed:
by Paolo Quaglia 18 Dec '00

18 Dec '00

Hi Here Is some tips to install PoPy DA on a RH6.2 First: You have to use Postgres7.0 with PoPy1.4 - download the Postgres7.0 with the development libraries (the development RPM from the Postgres download) - Download the Popy1.4.1 and the ZPopyDA0.7 - untar Popy1.4.1 - $./configure - change the Makefile ... the include path isn't /usr/include/postgres but it's /usr/include/pgsql - the file /usr/include/pgsql/os.h is a broken link .. we have to solve this prob download the source distribution of Posrgress7.0 (not the RPM) and substitute the broken link os.h with the file linux.h ... rename linux.h->os.h and put it in the correct path (/usr/include/pgsql) - make will now finish without errors!! and you get the Popymodule.so - copy the popymodule.so in the [zopedir]/lib/python - Untar the ZPopyDA and go to the ZPoPyDa directory in the lib/python/Products dir of Zope - modify the PoPy_db.py file changing, __compatibility__ = ('1.4','1.4.1') - Launch Zope and All WORKS!! Hope this Help Paolo Quaglia Information Technology Coordinator Sitek S.p.A. paolo(a)sitek.it

1 0