- Zope - Zope lists

session variables in the presence of conflicts
by Dennis Allison 20 Nov '05

20 Nov '05

Zope 2.8.4 ZEO 3.4.2 ZODB 3.4.2 Python 2.4.2 or 2.3.5 MySQL 4.0.20 MySQL-Python 1.2.0 MYSQLDA 2.0.9 We have just moved from Zope 2.7.6 to Zope 2.8.4 motivated, in part, but the ability to avoid read conflicts under ZODB 3.4.2. We have been having a lot of problems: more conflict errors, release of unreleased locks in MySQL transactions, loss of session variables, and others. We use session variables and MySQL very heavily. Our MySQL tables are MyISAM and are not transactional. ZODB3 3.4.1 introduce some changes to the conflict resolution which appears to be a logical improvement but also appears to have acerbated our problems. In the ZODB# 3.4.2 system, if a commit fails, an exception is raised and the transaction is aborted. Zope then attempts to reschedule the transaction. The abort needs to roll back MySQL transactions that are part of the conflicting ZODB and the Session Variable Store so the restart is clean. In our case, we have been using MyISAM tables, which are not transactional. The rollbacks fail and the locking in the database adapter gets confused. Changing the table type from MyISAM to Innodb, which is transactional, should resolve the MySQL problems, although it has yet to be tested. Conflict errors also arise through the session variables. Since we have a multi-Zope system configuration sharing a single ZEO, the session variables are stored in a Temporary Storage object on the ZEO host. When a conflict occurs, a number of things, none good, apparently can happen. Session variable transactions cannot be rolled back (as the temporary storage mechanism is not transactional). And, at a different level, session variable persistence requires that transactions require a copy-out/copy-in mechanism to identify those changes which have been changed and need to persisted; an aborted transaction may not be marked as persistent and so will disappear at some apparently random time in the future when the temporary store is packed and cruft removed. Some refactoring of the programming can help minimize the potential for session variable conflicts, but they cannot be eliminated. If systems stability in the face of session variable conflicts is important, 1. Does the store for session variable need to be transactional and support rollbacks? and 2. What Temporary Storage object provides the right mechanism to manage session variables with rollback efficiently?

5 10

MD5 Python Zope Plone
by D Washburn 20 Nov '05

20 Nov '05

I have a need to encrypt a parameter passed on a URL to another website using Python and MD5 encryption. I tried to set up a test python script: I am running ZOPE and Plone. I have made other Python scripts that work. ******************* import md5 print "This is the", script.meta_type, '"%s"' % script.getId(), if script.title: print "(%s)" % html_quote(script.title), print "in", container.absolute_url() hash1 = md5.new("Hello world").digest() print "hash=",hash1 return printed ************** When I do this and I attempt to test it - my ZOPE/Plone instance pops up the login screen (even though I am logged in already). I tried logging in but it just kept asking for my username/password. Suggestions? Anyone got a simple example of a Python script that can be passed a piece of text and return an encrypted string? Thanks, David

4 3

CMF 1.5.5 released
by Jens Vagelpohl 20 Nov '05

20 Nov '05

The CMF developer community and Zope Corporation are pleased to announce the release of version 1.5.5 of the Zope Content Management Framework (CMF). This release marks the latest stable release in the CMF 1.5 series and should be suitable for production use. What is the CMF? The Zope Content Management Framework provides a set of services and content objects useful for building highly dynamic, content-oriented portal sites. As packaged, the CMF generates a site much like the Zope.org site. The CMF is intended to be easily customizable, in terms of both the types of content used and the policies and services it provides. Where do I get it? Download it from http://zope.org/Products/CMF/CMF-1.5.5 Points of interest include: - "Windows ZIP file", http://zope.org/Products/CMF/CMF-1.5.5/CMF-1.5.5.zip - "Unix tar/gzip archive", http://zope.org/Products/CMF/CMF-1.5.5/CMF-1.5.5.tar.gz - "Release notes", http://zope.org/Products/CMF/CMF-1.5.5/README.txt - "Change history", http://zope.org/Products/CMF/CMF-1.5.5/CHANGES.txt - "Installation instructions", http://zope.org/Products/CMF/CMF-1.5.5/INSTALL.txt Where do I go to learn more? The "CMF mailing list":mailto:zope-cmf@zope.org has many participants who are active in supporting the CMF. ...to report bugs? The "CMF Collector":http://zope.org/Collectors/CMF is ths place to report bugs (please search for existing reports of your issue first!) --------- Jens Vagelpohl jens(a)dataflake.org

1 0

Problem with multiple Browser Id Managers
by Pablo Ziliani 19 Nov '05

19 Nov '05

Hello all, I have a situation here; as I has previously posted, I need to set the domain/host for of the cookie that stores the session id so it is shared among multiple subdomains. As Dieter has pointed to me, I should change the 'domain' property for the Browser Id Manager (from now on BMI) that controls the session. Unfortunately, my Zope instance holds multiples virtual sites, so I can't simply change the root BMI that comes with Zope's installation; instead I need to create inner BMI instances. So I did, giving the new instance a different Browser Id Name than the root's _ZopeId both to differentiate them and to be more site-specific. Then I restarted Zope (don't know if this really matters) and re-entered the site to see what happened: I was still given the same cookie, _ZopeId. Reading the documentation I found this quote (browser-add.stx): """ Instantiating Multiple Browser Id Managers (Optional) (...) In its default configuration, Zope will not allow you to create a browser id manager if one is installed in the root or in a place where the new browser id manager can acquire the original browser id manager via its containment path (for programmers: the session id manager's class' Zope __replaceable__ property is set to UNIQUE). This means, practically, that if you wish to have multiple browser id managers, you need to carefully delete the root browser id manager, then you need to place additional browser id managers in the most deeply-nested containers first, working your way out towards the root, finally replacing the root browser id manager if desired. """ ...which is either false or (more likely), outdated, since first (as I said) I had no trouble in adding another deeper BMI; and second, because any attempt to delete root's BMI ends in a "/browser_id_manager/ cannot be deleted." page error message. Any hint? Thanks all in advance, Pablo Ziliani

3 5

Reprise -- Manager Proxy Role ineffective for deleting/moving objects
by George Lee 19 Nov '05

19 Nov '05

I forget if I submitted a collector issue about this before, but I didn't see it. I just posted one at <http://www.zope.org/Collectors/CMF/396>: Title: PortalFolder.py _verifyObjectPaste ignores executable security Version info: CMF 1.5.4 but also in trunk _verifyObjectPaste calls "sm.checkPermission(permission_name,self)" rather than "_checkPermission(permission_name,self)" This makes it ignore executable security. So, if _verifyObjectPaste is in an external method or in a script with sufficient proxy roles, it raises an Unauthorized error for users when the external method / proxy role security should suffice. On 9/9/05, Dieter Maurer <dieter(a)handshake.de> wrote: > George Lee wrote at 2005-9-8 23:57 -0400: > > ... > >Is it okay to just replace sm.checkPermission with _checkPermission > >from CMFCore.utils or is that not okay? > > Yes. But, please file a bug report as well. > > >Also Dieter I noticed that Alan Runyan and you briefly discussed this > >issue back in 2002: > >http://mail.zope.org/pipermail/zope-cmf/2002-September/015350.html > > Any internal use should always take executable security (i.e. > executable ownership and proxy roles) into account. > Not doing so is a but, as things expected to be possible are not > and (maybe even worse) things expected to be impossible may > be possible. > > There may be a need for application code to check the permissions > of the user with proxy roles not taken into account. > > E.g. a script that must use a "Manager" roles to do one > thing but does not want to do another unless the current > user has specific permissions. > > For this case, there also should be a method checking > permissions with proxy roles not taken into account. > > -- > Dieter >

1 0

FYI: Zope 3 Book on Safari
by Jonathan Cyr 18 Nov '05

18 Nov '05

FYI, I noticed that O'Reilly just added Steven Richter's Zope 3 book to their Safari service. I now read all my Safari-based manuals on a Tablet PC, rather than stocking my bookshelves with the appropriate resources at $30-50 bucks a pop. Even though I'd already bought the Zope 3 book, I think it's great that I don't need to have it with me now. I'll probably donate it to the local library as I did with the rest of my bookshelf resources. O'Reilly, for some reason, doesn't seem to be the biggest fan of Zope or Python, so it's nice to see this addition to the service. http://safari.ora.com -Jon Cyr -- Jonathan Cyr http://www.cyr.info http://www.weddingweblog.com cyrj(a)cyr.info

1 0

conflicts, sessions, and programming best practices guidelines
by Dennis Allison 18 Nov '05

18 Nov '05

Has anyone prepared a set of best practice guidelines on the techniques to use to minimize conflicts? It is becoming clear that we need to do to refactor some of our code to get us out of our current conflict pickle. A quick google produced lots of commentary but nothing I could hand to our programmers as guidelines.

6 12

Zope 2.8.4 external methods do not autorefresh
by Dennis Allison 18 Nov '05

18 Nov '05

test framework: <dtml-var standard_html_header> <dtml-var expr="eproc()"> <dtml-var standard_html_footer> Setup an external method def eproc( self ): return 'hello world' and run the test method. It prints hello world Now, change the test method def eproc( self ): return 'hello world too' and run the test method. It prints hello world which is a deviation from the usual Zope2 behavior. To adopt the code for the modified method the external method needs to be resaved. Is this a bug or a feature? --

4 4

filename splitter
by Peter Bengtsson 18 Nov '05

18 Nov '05

Hi, I don't usually do this but I need your advise on something. It's a filename splitter for a KeywordIndex of File objects. http://www.peterbe.com/plog/filename-splitter By applying this splitter I hope to be able to search for files by parts of the filename. Has anything like this been done before? Am I on the right track? Do you see any pitfalls? -- Peter Bengtsson, work www.fry-it.com home www.peterbe.com hobby www.issuetrackerproduct.com

3 4

Zope 2.8.4 compilation error
by Gusti Gonzalez 18 Nov '05

18 Nov '05

Hi, I am having the following error when compiling Zope: --------------------------------------------------------------- "/usr/bin/python" "/infra/portal/Zope-2.8.4-final/setup.py" \ build --build-base="/infra/portal/Zope-2.8.4-final/build-base/python-2.3" --build-lib="/infra/portal/Zope-2.8.4-final/build-base/python-2.3/build-lib" --build-scripts="/infra/portal/Zope-2.8.4-final/build-base/python-2.3/build-scripts" --build-temp="/infra/portal/Zope-2.8.4-final/build-base/python-2.3/build-temp" running build running build_py running build_ext building 'AccessControl.cAccessControl' extension gcc -pthread -fno-strict-aliasing -DNDEBUG -g -O3 -Wall -Wstrict-prototypes -fPIC -IExtensionClass -IAcquisition -I/usr/include/python2.3 -c AccessControl/cAccessControl.c -o /infra/portal/Zope-2.8.4-final/build-base/python-2.3/build-temp/AccessControl/cAccessControl.o En el fichero incluído de /usr/lib/gcc-lib/i486-linux/3.3.5/include/syslimits.h:7, de /usr/lib/gcc-lib/i486-linux/3.3.5/include/limits.h:11, de /usr/include/python2.3/Python.h:19, de ExtensionClass/ExtensionClass.h:83, de AccessControl/cAccessControl.c:51: /usr/lib/gcc-lib/i486-linux/3.3.5/include/limits.h:122:75: limits.h: No existe el fichero o el directorio En el fichero incluído de ExtensionClass/ExtensionClass.h:83, de AccessControl/cAccessControl.c:51: /usr/include/python2.3/Python.h:28:19: stdio.h: No existe el fichero o el directorio /usr/include/python2.3/Python.h:30:5: #error "Python.h requires that stdio.h define NULL." /usr/include/python2.3/Python.h:33:20: string.h: No existe el fichero o el directorio /usr/include/python2.3/Python.h:34:19: errno.h: No existe el fichero o el directorio /usr/include/python2.3/Python.h:36:20: stdlib.h: No existe el fichero o el directorio /usr/include/python2.3/Python.h:39:20: unistd.h: No existe el fichero o el directorio /usr/include/python2.3/Python.h:46:20: assert.h: No existe el fichero o el directorio ... ... and the error list goes on. --------------------------------------------------------------- but the limits.h file does exist at the above mentioned location My environment is: Debian 3.1 (stable) dpkg -l | grep python ii python 2.3.5-2 An interactive high-level object-oriented la ii python-ldap 2.0.4-1 A LDAP interface module for Python. [dummy p ii python2.3 2.3.5-3 An interactive high-level object-oriented la ii python2.3-dev 2.3.5-3 Header files and a static library for Python ii python2.3-ldap 2.0.4-1 A LDAP interface module for Python 2.3 dpkg -l | grep gcc ii gcc 3.3.5-3 The GNU C compiler ii gcc-3.3 3.3.5-13 The GNU C compiler ii gcc-3.3-base 3.3.5-13 The GNU Compiler Collection (base package) ii libgcc1 3.4.3-13 GCC support library dpkg -l | grep make ii ant 1.6.2-2 Java based build tool like make ii libant1.6-java 1.6.2-2.1 Java based build tool like make -- library ii make 3.80-9 The GNU version of the "make" utility. ii makedev 2.3.1-77 creates device files in /dev Any ideas what can be missing from my installation? Best regards, Gustavo.

4 6