- Zope - Zope lists

Zope Hotfix: ObjectManager subscripting
by ethan mindlace fremen 11 Oct '00

11 Oct '00

This hotfix addresses an important security issue that affects Zope versions up to and including Zope 2.2.2. The issue involves the fact that the 'subscript notation' that can be used to access items of ObjectManagers (Folders) did not correctly restrict return values to only actual sub items. This made it possible to access names that should be private from DTML (objects with names beginning with the underscore '_' character). This could allow DTML authors to see private implementation data structures and in certain cases possibly call methods that they shouldn't have access to from DTML. While we know of no instances of this issue being used to exploit a site, we recommend that any Zope 2.2.x site that allows DTML to be edited by untrusted users apply this Hotfix. http://www.zope.org/Products/Zope/Hotfix_2000-10-11/Hotfix_2000-10-11.tgz The hotfix will work for all versions of Zope 2.2.0 and higher. A future version of Zope will contain the fix for this issue, and you will be able to uninstall the hot fix after upgrading.

1 0

Restart button corrupted data.fs.index file
by Kit O'Connell 11 Oct '00

11 Oct '00

After installing two new Products (ZCounter the first time,and FSCounter the next time), I hit the Restart button in the Zope Control Panel. Zope did not come up. I tried a manual stop/start. The start resulted in this error message: > Traceback (innermost last): > File "/usr/home/txpn/Zope/z2.py", line 554, in ? > exec "import "+MODULE in {} > File "<string>", line 1, in ? > File "/usr/home/txpn/Zope/lib/python/Zope/__init__.py", line 110, in ? > DB=ZODB.FileStorage.FileStorage(Globals.BobobaseName) > File "/usr/home/txpn/Zope/lib/python/ZODB/FileStorage.py", line 292, in +__init__ > r=self._restore_index() > File "/usr/home/txpn/Zope/lib/python/ZODB/FileStorage.py", line 427, in +_restore_index > info=p.load() > cPickle.UnpicklingError: pickle data was truncated The data.fs.index file was then corrupt. If I renamed it, and tried another start, Zope would start fine. I did this twice w/ the same results. I'm using Zope 2.2.2. Stevea on #zope suggested Jim might be interested in this, and that I should also send it to a Zope mailing list -- since I'm not on Zope Dev yet, I'm sending it here. I have a copy of the old index files if anyone needs to see them. Cheers, Kit

1 0

Namespace within a product... (argh...)
by Pierre-Julien Grizel 11 Oct '00

11 Oct '00

Well, beeing very straightforward, I read this, in OSFP/Help/DTMLDocument.py : """ A DTMLDocument implicitly pass itself as a client argument in addition to the specified client, so names are looked up in the DTMLDocument itself. Passing in a namespace to a DTML Document is often referred to as providing the Document with a *context*. DTML Documents are called three ways: From DTML -- A DTML Document can be called from another DTML Method or Document:: <dtml-var standard_html_header> <dtml-var aDTMLDocument> <dtml-var standard_html_footer> In this example, the Document 'aDTMLDocument' is being called from another DTML object by name. The calling method passes the value 'this' as the client argument and the current DTML names pace as the REQUEST argument. The above is identical to this following usage in a DTML Python expression:: <dtml-var standard_html_header> <dtml-var "aDTMLDocument(_.None, _)"> <dtml-var standard_html_footer> From Python -- Products, External Methods, and PythonMethods can call a DTML Document in the same way as calling a DTML Document from a Python expression in DTML; as shown in the previous example. By the Publisher -- When the URL of a DTML Document is fetched from Zope, the DTML Document is called by the publisher. The REQUEST object is passes as the second argument to the Document. """ So - I had a look at DTMLDocument.py and saw the following method : def __call__ (self, client = None, REQUEST = {}, **kw): ... SO - I try to create this method for my product : def __call__ (self, client = None, REQUEST = {}, **kw): print client print REQUEST and it prints : None {} It seems that in fact the DTML document doesn't actually pass _.None and _ to my object. WHY ?????? How can I enforce DTML Docs/Meths to pass it anyway ??? Many thanks, P.-J. -- If the only tool you have is a hammer, you tend to see every problem as a nail. Si le seul outil dont vous disposez est un marteau, vous avez tendance à voir chaque problème comme un clou. --Abraham Maslow

6 6

Bizarre ZMySQLDA problem...
by Tony McDonald 11 Oct '00

11 Oct '00

Hi all, I've just installed Zope-2.2.1 onto a clean Solaris 8 machine. I've built Python 1.5.2 from source and have MySQL 3.22 on the server. I've compiled up the ZMySQLDA product and put the MySQLModule.so in the correct place (ie one directory up from the src directory). I've restarted the Zope server, checked that ZMySQLDA is not broken and created a connection: test@localhost root I've created a ZSQL method that is essnetially 'select * from my_table' (and there *is* data in this table). The DA reports: There was no data matching this Z MySQL Database Connection (connected) query. The same query produces a flood of data from the mysql monitor. I'm totally baffled here, and would really appreciate any advice... Tone ------ Dr Tony McDonald, FMCC, Networked Learning Environments Project http://nle.ncl.ac.uk/ The Medical School, Newcastle University Tel: +44 191 222 5116 A Zope list for UK HE/FE http://www.fmcc.org.uk/mailman/listinfo/zope

2 2

Stackless Zope
by entropia 11 Oct '00

11 Oct '00

Have someone tried Zope with Stackless. Is that stable? I don't know to much about Stackless internals. Which modules are incompatible with Stackless? Anc D extensions?

1 1

acl_user and parent directory
by Stephan Goeldi 11 Oct '00

11 Oct '00

When I create a user in a subfolder, he can view the files in the parent folders: /www/folder1 /www/folder2 The manager of folder1 can not only view the content of /www but the content and the files of /www/folder2 too. This is BAD security IMHO. I don't want the user of folder1 let to know, that there exists a folder2! _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

1 0

Login
by Joaldo Junior 11 Oct '00

11 Oct '00

<<...>> It will be that somebody knows to inform me as I obtain to catch the 0 variable that informs the user name login.

1 0

Easiest way to turn X-Forwarded-For to Remote-IP?
by Marcin Kasperski 11 Oct '00

11 Oct '00

I use Zope via Apache proxy, what causes some trouble (all remote IPs for Zope are equal to 127.0.0.1). As I finally installed mod_proxy_add_forward, I get original address in X-Forwarded-For header (REQUEST['HTTP_X_FORWARDED_FOR']). The question is: can I do something easy to automatically perform if(remote_ip = 127.0.0.1 and X-Forwarded-For exists) then set remote_ip = whatever is in X-Forwarded-For logic? In particular, I would like changed IP to be used by Zope access control and Zope log. Regards -- http://www.mk.w.pl / Marcin.Kasperski | O kredytach mieszkaniowych: @softax.com.pl | http://www.kupmieszkanie.w.pl/mieszkanie_kredyt @bigfoot.com \

1 0

Medusa Monitor
by Hung Jung Lu 11 Oct '00

11 Oct '00

Hi, Zope comes with the Medusa monitor (port 8099 by default) which is kind of cute and allows one to get into the guts of Zope. But do people really use it? How do people use it? Is there any document describing the usages of this monitor? Are there some features of this monitor that makes debugging easier? regards, Hung Jung _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

3 2

ZMySqlDA Binary version
by Agus Setiawan 11 Oct '00

11 Oct '00

Hi all, Does anyone have a binary version of ZMySqlDA product? Because I'm running it on my Win 2000 Professional, and with the non-binary version, it give me message like this: 2000-10-11T12:26:25 ERROR(200) Zope Couldn't import Products.ZMySQLDA Traceback (innermost last): File D:\WEBSITE\lib\python\OFS\Application.py, line 397, in import_products (Object: string) File D:\WebSite\lib\python\Products\ZMySQLDA\__init__.py, line 106, in ? File D:\WebSite\lib\python\Products\ZMySQLDA\DA.py, line 108, in ? File D:\WebSite\lib\python\Products\ZMySQLDA\db.py, line 106, in ? ImportError: No module named _mysql and if anyone have the product, could you please help me by sending it through my e-mail? Thanks very much __________________________________________________ Do You Yahoo!? Get Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/

1 0