- Zope - Zope lists

possible security flaw? - and, request for a phone conference.
by Jon Franz 08 Jun '00

08 Jun '00

Hello, First off, sorry for the cross-posting of this message to admin and to development. I'm a software developer for a major ISP in the Midwest region of the USA. Recently we began evaluating Zope for use in our web application development, internally and for our clients, and have been quite pleased with the wealth of features and add-ons available*; However, I need two points addressed if possible: 1) We are running Zope 2.1.4 mapped to the root of the apache install on a Linux (mandrake 7.0) box, and have found a rather nasty security - or at least, its what I'll call a nasty problem - because if you don't know about it, it could really bite you in the butt. Basically, if a user with manager privileges to a folder changes their password to be empty, then anyone (from permitted domains) can access the management screen for that folder Without Logging On... Zope assumes that you are the user without the password and treats you as if you have those rights. I found this problem when one day the welcome Zope page (default from install) didn't prompt me for a password when I clicked to enter the management screen. I did not realize what had happened until I went under the 'undo' tab and saw that all of my actions while I was snooping around for the problem were being listed as being done by one of the other developers... I went into the acl_users and fixed their password and everything is back to normal. I've tested this by setting my own password to an empty string, and it lets me log in... From a security standpoint, It should probably prompt for a user name and password, and simply accept a empty field for the password As the password for that user... Anyway, my point is to either inform the community of the bug, if it isn't known, or to find out if it is known and has been fixed in the newest release... If it has not been fixed in the newest release, I will be glad to create and provide a patch... 2) As an experienced web developer, I'm very keen on new technologies that can be reused and make my life easier - thus Zope is a godsend. However, my management is hesitant to start using Zope on a regular basis for our projects - they feel it is unproven and possibly unstable: Now, I realize, and have informed them of the facts, that Digital Creations makes their living off of Zope, and that new businesses are springing up almost everyday that are Zope-centric, and that many contracting/development firms are embracing it whole heartedly... But, my management is still kind of hesitant. Is there anyone among you in the community who would be willing to write about your experience with Zope in the professional development arena, to address their concerns? Even better, Would anyone be willing to participate in a conference call q & A session on Zope's suitability for use in professional web development? I cannot offer money for these, but I can promise my undying gratitude, and, I can promise that any and all add-ons and patches we create for Zope would be released back to the community at large... As a large website app dev firm, our contributions could be significant... Please email me privately if you wish to possibly participate in the phone conference. Thank you for your time and attention! * I have already made two modifications to the Zope source, one dealing with making 'border' a built in property (and used during tag output) of the image object. and another, simple hack to the basic dtml parsing routines that makes your dtml development a little faster by requiring less typing. Both of these will be available under my member area on Zope.org. Hopefully these will be the first of many patches and add-ons I get to contribute.

2 1

Links between DTML language and Python language...
by QUIN Fr�d�ric 08 Jun '00

08 Jun '00

Hello all, In the last mail I sent, I explaint my problem to know if a specified item is in a list. Oleg helped me and said that : "Learn Python". Now, I wonder if there are strong links between DTML language and Python language. Because, in the DTML language reference, you can find nothing meaning that. Sometimes, I see functions used in DTML which are not referenced in DTML language reference. I guess that it's Python functions. So, I ask the question if it's advised to be introduced to Python before programming in DTML. I would like to know too, if there is any rule that specify how to use Python functions in DTML language, and if all Python functions are accessible in DTML... Thanks, Fred

2 1

Re: [ZDP] Links between DTML language and Python language...
by Rik Hoekstra 08 Jun '00

08 Jun '00

> > >In the last mail I sent, I explaint my problem to know if a specified item is >in a list. Oleg helped me and said that : "Learn Python". Now, I wonder if >there are strong links between DTML language and Python language. Because, in >the DTML language reference, you can find nothing meaning that. As such the links are not really strong. But knowing Python helps you to understand what is going on in python. Moreover, you may sometimes want or have to resort to External/Python methods to stuff DTML is not usable for. DTML is really just a presentation language. As now there are no real guidelines as to when to use what. Use your own intuition ;-( > >Sometimes, I see functions used in DTML which are not referenced in DTML >language reference. I guess that it's Python functions. So, I ask the question >if it's advised to be introduced to Python before programming in DTML. I would >like to know too, if there is any rule that specify how to use Python functions >in DTML language, and if all Python functions are accessible in DTML... > > everytime you use an expression in DTML (<dtml-var expr="..."> or plainly <dtml-var "...">) the part between quotes is a python expression, which does not respond to dtml rules, but to python rules. Usually these are quite simple, but to use them you have to know some Python. Note, that learning (some) Python is not very difficult. And there are good training materials (and books) available. hth Rik

1 0

tracking clients
by Graham Chiu 08 Jun '00

08 Jun '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am just wondering whether it would be worthwhile using a session product such as SQLSession to profile client activity as they traverse a website. With each call to SQLSession, the URL, IPAddress, and time could be saved, and this could then be analysed later on from within Zope to profile user activity. ( see where people enter the site, move around from there, where they exit Eg without going to checkout to complete purchases, and how long they spend within the site ) Would this replicate the information contained within the ZServer logs? Would it impact greatly upon the server performance? Has someone done this already? ( I looked at www.zope.org/About and saw the nice graphs and got to thinking about this ... ) - -- Regards, Graham Chiu gchiu<at>compkarori.co.nz http://www.compkarori.co.nz/index.php Powered by Interbase and Zope -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBOT60g7TRdIWzaLpMEQI3sgCeLmTnvqGtfr62BncXPFxd+amdkEEAn0kF IlqJfbq6C5zySoAjG5FvpPOw =uDJi -----END PGP SIGNATURE-----

1 0

ZServer (Zope 2.1.6) thread synchronization bug -- with workaround
by Dr. Dieter Maurer 08 Jun '00

08 Jun '00

ZServer contains a thread synchronization bug exposed when the HTTP streaming protocol (i.e. RESPONSE.write) is used. For large responses, the reponse is written to a temporary file and the distribution thread receives "file_part_producer" requests. Writing to the tempfile uses "seek => write" in the request thread; reading the tempfile uses "seek => read" in the distribution thread. The threads are not synchronized. This may result in loss of response data: broken or buggy images/files. The following patch removes the use of a tempfile. This, of cause, is only a crude workaround. Dieter ******************************************************************* --- ZServer/:HTTPResponse.py Mon Jan 24 20:17:53 2000 +++ ZServer/HTTPResponse.py Thu Jun 8 09:01:31 2000 @@ -239,7 +239,9 @@ try: if type(l) is type(''): l=string.atoi(l) if l > 128000: - self._tempfile=tempfile.TemporaryFile() + # don't! exposes a thread synchronization problem + # self._tempfile=tempfile.TemporaryFile() + pass except: pass stdout.write(str(self))

1 0

How do you changing web port address of Zserver installed as a se rvice on Win NT4? rvice on Win NT4?
by Ian Thomas 08 Jun '00

08 Jun '00

I am looking for some guidance on how to change the web port address of my Zserver. I can use the -P option START.BAT file and start it manually but I haven't been able to figure out how to change it when I am starting the Zserver up as a service on a WinNT 4 box. It works fine on port 8080 but I now need to move it off of that port.

3 2

Re: [Zope] Greetings,
by ethan mindlace fremen 08 Jun '00

08 Jun '00

CURTIS David wrote: > > Greetings, > > I wish to use use the data of the database file in my html code. For example, > this database was last updated on 06/06/2000. I suppose that there must be a dynamic html tag that zope uses. What could it be? I looked at all the documentation and have yet to discover it. <DTML-ZOPE-FILE-DATE> Any help is apprechiated. I think you're looking for bobobase_modification_time , like <dtml-var name="bobobase_modification_time"> It's called that for hysterical reasons. ethan mindlace fremen zopatista community liason (thanks to MJ for the "correct" spelling of zopatista)

3 2

Re: [Zope] Python, Zope, and PowerPoint slides
by Rik Hoekstra 08 Jun '00

08 Jun '00

<snip> >> >>IIRC Pavlos Christoforou made a Zope product that creates pdf from stx files >>(goes to look it up) Yes. See >>http://www.zope.org/Members/gaaros/ZpdfDocument > > >I was quite exited when I saw this pdf possibility but I can't seem >to get it to work. I'm running Zope on my Win NT4.0. But I have some >questions 'bout it: Hm, worked for me (on my humble win95 homebox). It's been a time since I used it, though > >1. When I d/l the zpdf file it seems that something is missing. Where >exactly should I put it ? Unpack it in the <zopehome>/lib/python/Products >2. Is it a precompiled python file ? python will compile it at runtime >3. Should'nt it have some kind of extension to it to work in a windoze env ? apart from python no (but zope won't run if you don't have that ;-). It is a python only product as far as I can see. Rik

1 0

Re: [Zope] Python, Zope, and PowerPoint slides
by Rik Hoekstra 08 Jun '00

08 Jun '00

> >[...] > >> * Amos released updated "Zope training material", >> http://www.zope.org/Members/Amos/TrainingSlidesAnnounce >> that he and Michel Pelletier have been working on for >> the past couple weeks. >> >> There are twenty slide presentations which cover such topics >> as DTML, application design, and developing Python products. >> >> Note: the PowerPoint slides are built by a Python script >> that reads Structured Text and talks to PowerPoint over COM - cool. > > >How about taking the extra step and using 'PythonPoint' to make a pdf >presentation for non-MS'ers? > IIRC Pavlos Christoforou made a Zope product that creates pdf from stx files (goes to look it up) Yes. See http://www.zope.org/Members/gaaros/ZpdfDocument Though I agree a packed up version would be nice (I'm a windows user, so pythonpoint is ok for me) Any chance the python-powerpoint script could be made public anyway? hth Rik

2 1

Unless not quite the opposite of if?
by Curtis Maloney 08 Jun '00

08 Jun '00

Greetings, I'm sure this should be obvious to me... but I can't seem to get this code to work. It's supposed to send you to another page if a var has not been passed... <dtml-unless parmName> <dtml-call "RESPONSE.redirect('some.url.here')"> </dtml-unless> The problem is, when i test the page, it seems to pass over that that, and go right on with the page. So, I tried to be a little more explicit: <dtml-unless "REQUEST.has_key('parmName')"> ... </dtml-unless> Again... goes straight through. What's going on here? When I use: <dtml-if parmName> (as I have done in MANY cases), it always evaluates true if 'parmName' exists in the current context. Bring out that ol' clue stick, and swing it my directions a few times, because I need help. -- Have a better one, Curtis. <dtml-var standard_work_disclaimer>

1 1