- Zope - Zope lists

init.d script and out of place instances
by Fernando Martins 24 Nov '05

24 Nov '05

Hi, As far as I can see and tried, the zope2.8 script only deals with instances which are created in the default instance directory, /var/lib/zope2.8/instance/. I would prefer to keep a specific instance of zope in a different directory, together with other related directories, e.g. files from LocalFS. That is, I prefer to have all directories of the application, zope or not, under a common directory. Is there anything wrong with this approach?? I tried to symlink into the instance into /var/lib/zope2.8/instance but the start script fails. BTW, where are the messages logged? (I'm running Ubuntu) Is there any solution? Is this specific to the distribution? Regards, Fernando

5 4

standard_error_message as PageTemplate?
by Jürgen Herrmann 24 Nov '05

24 Nov '05

hi there! is it possible to replace the standard_error_message dtml method by a page template? has anybody done this? seems like i don't get error_type, error_tb etc... regards, juergen herrmann _______________________________________________________________________ >> XLhost.de - eXperts in Linux hosting << Jürgen Herrmann Bruderwöhrdstraße 15b, DE-93051 Regensburg Fon: +49 (0)700 XLHOSTDE [0700 95467833] Fax: +49 (0)721 151 463027 WEB: http://www.XLhost.de

3 2

Does ZWiki compromise Win2003 security behind a firewall?
by Bill Bell 24 Nov '05

24 Nov '05

Yes or no. OK, I know it's not that simple. I am working in an agency that employs a third party to manage our network. The third party is reluctant to install Zope and ZWiki for me, claiming that this will open "the system" to "potential attacks". The wiki would be for use by agency personnel only and be available on a non-routable address, behind a firewall. Could someone tell me how this could be a security risk? Thanks for any ideas. Bill

2 1

External Methods, Proxy Roles, and Executable Security
by George Lee 23 Nov '05

23 Nov '05

In CMFCore 1.5.4: If a low-security-clearance user calls an external method that pastes an object from a PortalFolder, he gets an error because the following line in CMFCore.PortalFolder fails: if not sm.checkPermission(DeleteObjects, parent): raise AccessControl_Unauthorized This is even the case if "sm.checkPermission" is changed to "_checkPermission", which takes into account proxy roles. The external method does not allow proxy roles attached, so I can't just add a "Manager" proxy role. Because I called the pasting in an external method, I expected it to go through without security problems! Is this a right expectation / and a bug, or a wrong expectation? Peace, George On 11/18/05, George Lee <georgeleejr(a)gmail.com> wrote: > I forget if I submitted a collector issue about this before, but I > didn't see it. I just posted one at > <http://www.zope.org/Collectors/CMF/396>: > > Title: PortalFolder.py _verifyObjectPaste ignores executable security > > Version info: CMF 1.5.4 but also in trunk > > _verifyObjectPaste calls "sm.checkPermission(permission_name,self)" > rather than "_checkPermission(permission_name,self)" > > This makes it ignore executable security. So, if _verifyObjectPaste is > in an external method or in a script with sufficient proxy roles, it > raises an Unauthorized error for users when the external method / > proxy role security should suffice. > > > > On 9/9/05, Dieter Maurer <dieter(a)handshake.de> wrote: > > George Lee wrote at 2005-9-8 23:57 -0400: > > > ... > > >Is it okay to just replace sm.checkPermission with _checkPermission > > >from CMFCore.utils or is that not okay? > > > > Yes. But, please file a bug report as well. > > > > >Also Dieter I noticed that Alan Runyan and you briefly discussed this > > >issue back in 2002: > > >http://mail.zope.org/pipermail/zope-cmf/2002-September/015350.html > > > > Any internal use should always take executable security (i.e. > > executable ownership and proxy roles) into account. > > Not doing so is a but, as things expected to be possible are not > > and (maybe even worse) things expected to be impossible may > > be possible. > > > > There may be a need for application code to check the permissions > > of the user with proxy roles not taken into account. > > > > E.g. a script that must use a "Manager" roles to do one > > thing but does not want to do another unless the current > > user has specific permissions. > > > > For this case, there also should be a method checking > > permissions with proxy roles not taken into account. > > > > -- > > Dieter > > >

4 9

HTML to PDF.
by Fernando Lujan 23 Nov '05

23 Nov '05

Does Anyone has this product in a production environment? It's easy to configure and stuff? We currently are working with the reportlab, but it's painful to change the document... :( I need a product which generates a PDF file on the fly. Any other application or suggestion will be welcome. Thanks, Fernando Lujan

8 19

Zope-2.8.1, LocalFS, and the importance of _p_jar
by John Ziniti 23 Nov '05

23 Nov '05

I've encountered the issue described here: http://mail.zope.org/pipermail/zope/2005-August/161120.html on a recently upgraded Zope using LocalFS. I have tracked down the issue to the fact that the object that LocalFS "hands" to ZODB is a WrapperObject, and this object does not have an oid. This raises an AssertionError during the _commit method of ZODB.Connection. I have traced the code a little bit and I see that this block of code will be avoided for these objects if the objects do not appear in self._registered_objects, which I can achieve by making sure that the object has no _p_jar attribute. If I comment out the line in the LocalFS object where the wrapper object's _p_jar is set to the parent object's _p_jar, everything works fine, with no (apparent) problems. [ I tried also setting obj._p_oid = self._p_oid, but then Zope has pickling problems trying to pickle instances of the wrapper class ]. The problem I have with my "solution" is that I have no clue what _p_jar is. What is _p_jar used for within the Zope model? What are the implications of having an object with self._p_jar=None? What are the implications of a transient object (not stored in the ZODB but on the local filesystem), with self._p_jar=None? Thanks in advance for any information, John Ziniti

3 2

Hard-coded "Content-type:text/xml" as xmlrpc in Zope (2.8.1)
by John Ziniti 22 Nov '05

22 Nov '05

Back in June 2004, I had the following problem: http://mail.zope.org/pipermail/zope/2004-June/151436.html http://mail.zope.org/pipermail/zope/2004-June/151492.html http://mail.zope.org/pipermail/zope/2004-June/151497.html http://mail.zope.org/pipermail/zope/2004-June/151498.html which came about because HTTPRequest.py was hard-coded to assume that any request with a Content-type of "text/xml" is an xmplrpc call and handles the request as such. I resolved this issue with the help of brian(a)zope.org, who gave me the XmlFix product, which monkey-patches the HTTPRequest.processInputs method to respond a bit more appropriately. We noted in the thread that although Zope's behavior is broken, it is unlikely to change for historical reasons. I am fine with this and felt comfortable with the simplicity and supportability of the monkey-patch. This monkey-patch was no longer effective recently when I upgraded our Zope instances to 2.8.1. Zope-2.8.1 now additionally has the zope.app.publication. HTTPPublicationRequestFactory class, which also assumes that "text/xml" means xmlrpc (in fact, it assumes that anything that startswith('text/xml') is an xmlrpc call). Not fixing old code which acts in strange hard-coded ways is something I understand, but adding new code that also acts that way seems like it is getting further away from "good" :) Can anything be done to change the behavior in the HTTPPublicationRequestFactory so that it is not so obtuse? My monkey-patch now has to munge two methods to make xml uploads work and I am less happy with it than I was before. Thanks for your time, John Ziniti

3 2

cookie crumbler and error messages
by Paul Hendrick 22 Nov '05

22 Nov '05

Hi all, I'm using CookieCrumbler on a project which sits in / on one server, and /project in another. I'd like to secure a part of the site through *.metadata files so that users of a certain role can't access it. this is done and works well. however, when they try to access a part of the site which is secured, they're: a- given a log in popup prompt which they don't have the details for. and b- when they click cancel, they're given the dreaded zope barf screen. how can i either just redirect them to loggin_form or change the standard_error_message template to pick up these errors. i've tried changing the template that is in my zmi root, but none of the changes affect the screen when it appears, so i have no idea where to go from here. many thanks for reading! paul

3 4

Re: [Zope] unlinking stale socket?
by michael nt milne 22 Nov '05

22 Nov '05

Yes, so something must have killed the server and shut it down leading to the stale socket message. However I guess without further checking through the server logs I won't find out exactly why etc. On 11/22/05, J Cameron Cooper <jccooper(a)enfoldsystems.com> wrote: > > michael nt milne wrote: > > Ok, but Zope and Apache were serving nothing until I re-started Zope. > > The server had died for some reason > > Indeed. And that's what it tells you with the "unlinking stale socket": > it was not shut down in an orderly manner previously. > > But that message says nothing about why. > > --jcc > > > On 11/22/05, *Chris McDonough* <chrism(a)plope.com > > <mailto:chrism@plope.com>> wrote: > > > > I think it probably was running after the first time you invoked it. > > The message is only informative, meaning that zopectl died unexpectly > > the last time it was run (without cleaning up after itself). It's > > not a fatal error or at least hasn't been whenever I've seen it. > > > > On Nov 22, 2005, at 10:57 AM, michael nt milne wrote: > > > > > Yes, I noticed that the deamon wasn't running and so re-started it. > > > It started up fine but that was the message I received. Just > > > wondered what happened etc.. > > > > > > On 11/22/05, Chris McDonough <chrism(a)plope.com > > <mailto:chrism@plope.com>> wrote: Note that > > > Zope likely started. Did it? Did you try zopectl stop and > > > zopectl start again? If so, did it work? > > > > > > - C > > > > > > On Nov 22, 2005, at 9:52 AM, michael nt milne wrote: > > > > > > > Hi > > > > > > > > My zopeinstance went down and I was getting an 'upstream server' > > > > unknown message from apache. On restarting zope from ./zopectl this > > > > was the message I got..... > > > > > > > > unlinking stale socket > > > > /home/zopeinstance/var/zopectl/sock,sleep/ > > > > No handlers could be found for logger 'root' > > > > > > > > Does anyone have any idea on how to prevent this at all, or what > > > > happened here? > > > > > > > > Thanks > > > > > > > > Michael > > > -- > "Building Websites with Plone" > http://plonebook.packtpub.com/ > > Enfold Systems, LLC > http://www.enfoldsystems.com >

1 0

Proxy setting for Zope and Products
by Renfer Serge (EDU) 22 Nov '05

22 Nov '05

Hello all, I'm responsible of a server (Debian Sarge) which has been put behind a firewall! I am strugling with proxy problems. For instance, CMFSin doesn't seem to work (for syndication slots in Plone), and LDAPUserFolder cannot reach an external ldap server. On the system itself, I have set the http_proxy environment variable (in .bashrc), it works fine for apt-get, for example, but it seems it has no effect on Zope! Do you have any idea if there is a way to inform directly Zope and all its products about a proxy in a simple way, or only products that are proxy-aware can be set to work in such an environment? Thanks in advance! serge

2 1