- Zope - Zope lists

Failed upgrade to 2.2.4 - solutions?
by Luke Tymowski 08 Dec '00

08 Dec '00

Hello, I've just tried and failed to upgrade to 2.2.4 from 2.2.2. A python instance starts up and slowly swallows the CPU, ending with 99% of the CPU. A second python instance starts and doesn't do anything naughty. If I issue a ./stop, the second python instance ends properly, but the first continues to consume all CPU resources. I've tried recompiling it several times, reinstalling Python, but no go. It did once start up properly, but as soon as I tried logging into Zope, python took over the CPU. I'm using OpenBSD 2.8, python 1.5.2, x86, 196MB of RAM, GBs of free disk space. I've been using Zope since 2.0 and have never had this much trouble upgrading. the only Zope product I'm using is SiteAccess (the same setup as the old Zope.org before the cluster upgrade). Any ideas? thanks, Luke

2 4

Weird ZCatalog problem... bug?
by sean.upton＠uniontrib.com 08 Dec '00

08 Dec '00

On my developmet box, I'm using Zope 2.2.1 and ZCatalog to index ZClass-based classified ad objects; for some reason on sort="title" in the <dtml-in Catalog ... I get inconsistent results. I perform a search and get incorrect results. I then click refresh, get results sorted differently, then click refresh again, and it's messed up again. Anyone seen anything like this? Thoughts? Other info about setup: Globbing vocabulary Catalog and indexed objects are in BTree folder ZClasses catalog aware Other sort= values seem to work. Here is a DTML snippet... <dtml-var expr="REQUEST.get('fieldsort')"> <dtml-in Catalog size=50 start=query_start sort="REQUEST['fieldsort']"> ... </dtml-in> URL looks like results?title=&AdBody=par*&WeightWords=&fieldsort=title&SUBMIT=Submit+Query Thanks, Sean ========================= Sean Upton Senior Programmer/Analyst SignOnSanDiego.com The San Diego Union-Tribune 619.718.5241 sean.upton(a)uniontrib.com =========================

1 0

SECURITY alert and hotfix release
by Brian Lloyd 08 Dec '00

08 Dec '00

Hi all, Aleksander Salwa has brought a security issue to our attention that affects all Zope versions up to and including Zope 2.2.4. We have released a Hotfix product to address the issue that can be downloaded from zope.org. (Thanks to Aleksander for finding this and to Shane Hathaway for his quick response in resolving it!) The issue involves security registration of "legacy" names for certain object constructors such as the constructors for DTML Method objects. Security was not being applied correctly for the legacy names, making it possible to call those constructors without the permissions that should have been required. This issue could allow anonymous users with enough internal knowledge of Zope to instantiate new DTML Method instances through the Web. The hotfix for this issue is available on the zope.org web site: o http://www.zope.org/Products/Zope/Hotfix_2000-12-08/Hotfix_2000-12-08.tgz We *highly* recommend that any Zope site running versions of Zope up to and including 2.2.4 have this hotfix product installed to mitigate the issue. The hotfix will work for all versions of Zope 2.2.0 and higher. A future version of Zope will contain the fix for this issue, and you will be able to uninstall the hot fix after upgrading. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 2

Applying hotfix to running zope
by Oliver Sturm 08 Dec '00

08 Dec '00

Hi, is there a way to apply a patch like the current hotfix product to a running zope without restarting the process? MfG, Oliver Sturm -- GUI (gooey): What your computer becomes after spilling your coffee on it. -- Oliver Sturm / <sturm(a)oliver-sturm.de> Key ID: 71D86996 Fingerprint: 8085 5C52 60B8 EFBD DAD0 78B8 CE7F 38D7 71D8 6996

2 1

NIST meeting: "Defining Standard, Scriptable Objects for CAD/CAE/CAM/PDM" CAD/CAE/CAM/PDM"
by Steve Waterbury 08 Dec '00

08 Dec '00

"Defining Standard, Scriptable Objects for CAD/CAE/CAM/PDM" Date: December 13th Time: 10:00 AM - 4:00 PM Location: NIST, Building 225, Room A54 -> for directions and maps to NIST, see: http://www.nist.gov/public_affairs/maps/nistmaps.html * If you plan to come, you MUST contact Michael McLay, so that we are sure that the meeting room space is adequate: mailto:mclay@nist.gov - or call 301-975-4099 Background: Roughly, PDM ("Product Data Management") does for CAD/CAE/CAM models and related objects what Zope does for the objects that need to be managed in a typical Web site (HTML docs, etc.). Problem Statement The problem is to find an open architecture for integrating and managing the configuration of computer-aided design, analysis, and manufacturing (CAD/CAE/CAM) tools, models, and data. The purpose of the meeting is to evaluate technologies, try to define an approximate roadmap for building an open architecture, and establish a ROM guess of (1) how much work may be required to implement the architecture components and (2) the cost of developing and maintaining an instance of the architecture for an engineering organization. Agenda: * Engineering Tool/Data Integration Requirements Steve Waterbury/NASA * GenCAM: a Standard API for Electronic Manufacturing Data Michael McLay/NIST * The MEMS Exchange: Python and ZODB for Management of Complex Objects Andrew Kuchling/CNRI * The CADScript/IScript Architecture (and Demo) Doug Cheney/International TechneGroup, Inc. * Python and Zope: Architectures and Directions Barry Warsaw/Python Labs * Group discussion - How to incorporate interfaces to Python and Zope components such as ZODB into a standard PDM architecture - What enhancements to ZODB, ZCatalog, ZPatterns, etc., can address functionality and interfaces needed for general PDM - Which pieces of the architecture make the most sense as open source products, which ones are most logical as commercial products, and what interfaces should be standardized to enable open source and commercial products to interoperate. Cheers, -- Steve Waterbury NASA/Goddard Space Flight Center. oo _\o \/\ \ / ____________________________________________ oo _________________ "Sometimes you're the windshield; sometimes you're the bug." - Knopfler Stephen C. Waterbury Component Technologies Code 562, NASA/GSFC and Radiation Effects Branch Greenbelt, MD 20771 Engineering Web/Database Specialist Tel: 301-286-7557 FAX: 301-286-1695 WWW: http://misspiggy.gsfc.nasa.gov/people/waterbug.html _________________________________________________________________

1 0

persistence and dictionaries
by Matt 08 Dec '00

08 Dec '00

Hi I am trying to get a handle on how I should handle peristence in my python products. I have read all the ZODB documents and all the Product tutorials, which all led me to believe that 1) mutable objects such as lists and dictionaries are not persistent and that updates to these will not be implicitly saved into the ZODB, and 2) that custom classes would certainly not persist. That all seemed fine, and I used persitent mapping and __setstate__ to fill things back in where necessary. But then I decided to demonstrate that persitence does break as suggested. I used boring product, added a dicitonary and a custom class that contains it's own dictionary.... let the user update name : value pairs for both, and print the contents through index.dtml The problem is that everything persists fine !!!! through restarts, everything? Why does it work??? shouldn't it not? I have attached the modified boring product .... boringplus ..... it's dead simple to follow if you have made products before. Any explanation would be really nice. regards Matt

3 6

Re: [Zope] Disabling Services
by Dieter Maurer 08 Dec '00

08 Dec '00

Chris Withers writes: > ZServer Medusa (V1.16.4.3) > ... > > Which of those handles WebDAV requests? WebDAV runs on top of HTTP. You must disable ZServer Medusa. Maybe, you accept WebDAV? Dieter

3 2

image resize
by Leichtman, David J 08 Dec '00

08 Dec '00

Is there a way to do a dynamic image resize in Zope? I know PHP has that ability, and I was hoping that Zope had something similar. And I'm not talking about height and width atributes in the img tag. I mean actually creating, on-the-fly, a new duplicate of the image that's a different size.

2 1

security - am I going crazy ?
by Aleksander Salwa 08 Dec '00

08 Dec '00

Few days ago I found that on site that I'm currently working on, everybody can add DTMLMethods and Documents (and maybe do more, I haven't checked yet, but I think it's bad enough !) by simply entering URL http://www.mysite.com/manage_addDTMLMethod?id=q1&title=qq1&file=qqq1 After that Zope sends 'Location' header to redirect user to 'manage_main'. That (manage_main) causes 'Unauthorized' exception. But that object 'q1' was added !!! I was thinking that it's a bug in Product. (I use LoginManager, LocalFS, SiteAccess). I decided to upgrade my Zope from 2.2.1 to 2.2.4 and upgrade all Products (one good thing so far ;)). No success. So I did fresh install of Zope 2.2.4, without additional Products, with with brand new Data.fs. Problem persists ! I have default security settings, so Anonymous can't "Add Documents, Images, and Files". Of course user can put any DTML in this object - you know the consequences... (and if the folder where this object is located is owned by high-privileged user, then this object is owned by that user too (through acquisition)). I just checked: I can't add Folders this way. What's going on ?!? Have I found very big security hole, or just I'm going crazy ? :( P.S. Just take a look at object with id "haveIFoundABug" in root level of www.zope.org that I created few seconds ago... ololo(a)zeus.polsl.gliwice.pl /--------------------------------------\ | `long long long' is too long for GCC | \--------------------------------------/

2 2

Another Zope E-Commerce Site Online
by Brad Clements 08 Dec '00

08 Dec '00

Just announcing this new e-commerce zope based site. http://www.adirondackcraft.com Come buy something, but don't whack it too hard, this site is still a work in progress (aren't they all?) -- This site was "thrown together" in about 5 days for a disorganized customer, came online just 30 minutes before it's first sale. They had a big ad in the New York Times which pushed the deadline. - Zope 2.2.4 with Interbase, gvibDA and Wampum Generator running behind Apache with mod_proxy and mod_ssl, on RH Linux 7. I'm thinking of writing a white paper on this entire experience, from a consulting point of view and a programmer's viewpoint. Not sure how useful that would be to anyone. There were 2 graphics/layout designers and myself working directly with the customer to go from concept to completion in an extremely short timeframe. Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax netmeeting: ils://ils.murkworks.com AOL-IM: BKClements

11 20