- Zope - Zope lists

Re: [Zope-Annce] Web page comparing Zope with Frontier
by Martijn Pieters 03 Mar '00

03 Mar '00

From: <jlim(a)natsoft.com.my> > I am compiling statistics on the growth of Zope and Frontier on the > internet. Visit this page to view the phenomenal growth of Zope: > > It grew threefold in January 2000 for example. > > http://webfeet.editthispage.com/frontier Note that the servers listed as runinng Zope on Netcraft, are those that run straight ZServer. Those sites that run Zope behind Apache, IIS, Zeus, or any other webserver, will be listed under those webservers. So, a small percentage of the number of Apache sites on the web, runs Zope. >From my personal expirience, I find that a lot more people run Zope behind Apache, instead of pure ZServer. So, the number of Zope sites is a significant factor higher than the 300 listed by Netcraft. For an example, go to: http://www.netcraft.com/whats/?host=www.zope.org You'll see that it is listed as running Apache (which it is). Martijn Pieters | Software Engineer mailto:mj@digicool.com | Digital Creations http://www.digicool.com/ | Creators of Zope http://www.zope.org/ | The Open Source Web Application Server ---------------------------------------------

1 0

RE: [Zope] Security flaw in Zope FTP server?
by Brian Lloyd 03 Mar '00

03 Mar '00

> I was running a security scanner (nessus) on my webserver > tonight, and it came > back with port 8021 having an ftp server which "closes the connection > when USER, PASS, or HELP is given with a too long argument." It says > "This is probably due to a buffer overflow" Is this a false positive? > Or is this something to actually be concerned about? Because the FTP server code is in Python, the chances of this being a real classic "buffer overflow" (of the sort that can start to overwrite unintended memory) is slim (I expect that the worst you could do is send something so long that it consumes all available memory and causes Python to raise a MemoryError). We should look into the handling of those commands though. I don't manage the FTP code so I don't have enough deep Zen to know what the "correct" behavior is, but it seems that if it's giving a false positive then something is probably not being handled totally correctly. Can you make an post in the Collector about this so that it doesn't get lost in the flow of the list? Thanks! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

2 1

Re: [Zope] SQLSession and Performance issues
by Hung Jung Lu 03 Mar '00

03 Mar '00

timothy grant <tj-(a)avalongroup.net> wrote: >I am curious as to what methods may be used to reduce calls to >SESSION['varname'], or if I am even barking up the right tree. I guess it depends on what database you are using. If your database is a remote server hooked up through TCP/IP port, too many calls to SESSION could be bad. Also, if the session data is large, during the transimission many packets have to be send. I don't have an answer... maybe you could describe first what database you are using (Gadfly on the same machine? remote database?), do you do many retrievals and updates? ------------------------ In the code SQLSession.py, there is a 'caching' variable. SQLSession seems to cache variables that are already retrieved or are recently updated. Try to set 'caching' to 1 and see if that helps. ------------------------ As Pavlos Christoforou said, another strategy is to have a single session data variable (a dictionary, for instance), and then retrieve it, say, in your standard_html_header and store it in your standard_html_footer (or their equivalents.) This way you only need to access the database twice per request. ------------------------ Please post back... I am also very interested. You can also time performance by calling time.time() in Python or <dtml-var ZopeTime> in DTML. I am curious in the source of the problem... It would be nice to find out whether the time is spent in each database query or in TCP/IP packet splitting/joining/waiting. regards, Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

3 3

RE: [Zope] Security flaw in Zope FTP server?
by Brian Lloyd 03 Mar '00

03 Mar '00

http://classic.zope.org:8080/Collector/ Thanks! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com > -----Original Message----- > From: jiva(a)devware.com [mailto:jiva@devware.com] > Sent: Friday, March 03, 2000 12:13 PM > To: Brian Lloyd > Cc: zope(a)zope.org > Subject: Re: [Zope] Security flaw in Zope FTP server? > > > On Fri, Mar 03, 2000 at 09:29:28AM -0500, Brian Lloyd wrote: > > We should look into the handling of those commands though. I don't > > manage the FTP code so I don't have enough deep Zen to know what > > the "correct" behavior is, but it seems that if it's giving a > > false positive then something is probably not being handled > > totally correctly. Can you make an post in the Collector about > > this so that it doesn't get lost in the flow of the list? > > Sure! How do I do that? > > -- > If we suffer tamely a lawless attack upon our liberty, we > encourage it, > and involve others in our doom. > -- Samuel Adams >

1 0

Zope needs this (and Dynamo has it)
by Alexander Staubo 03 Mar '00

03 Mar '00

A colleague insightfully commented that while Dynamo has a high bullshit factor, this is the reason it sells. Take a look at this screen shot: http://www.atg.com/news/images/screen-shots/systemconsole.gif Dynamo is an expensive, closed product with a promotional web site that smells like a million-dollar penthouse office space, replete with glass walls and postmodern sculptures. It smells a bit funky, and the people are possibly evil, but the product is of high quality, and it sells. And because it sells, many people use it, and because so many people use it, skilled developers exist in large numbers. Unfortunately, I can't say the same of Zope. Speaking of which, SNMP support for Zope would have been nice. Then we could import the numbers needed to build monitors like the one featured in the screen shot. -- Alexander Staubo http://alex.mop.no/ "Do not go gentle into that good night/old age should rave and burn against the close of day/Rage, rage against the dying of the light." --Dylan Thomas

2 1

Any sample web for testing Zope after installation?
by Alessandro Bottoni 03 Mar '00

03 Mar '00

As a post-installation test tool, it would be great to have a sample DTML web site. Does anybody have such a small collection of DTML pages to donate to the public domain? TIA -------------------------------- Alessandro Bottoni (Alessandro.Bottoni(a)Think3.com) (alessandro.bottoni(a)libero.it) Web Programmer Think3 inc. (www.think3.com)

2 1

Re: [Zope] Install problem, please help...
by Tres Seaver 03 Mar '00

03 Mar '00

"Eric L. Walstad" <ewalstad(a)energywright.com> wrote: > > Hello all - > > I am unable to connect to my Zope 2. > I am running Linux 2.2.14, with Apache > I am new to Zope and pretty new to Linux > > I installed Python 1.5.2, then installed Zope using "python w_pcgi.py" > I entered ./start > It worked... for a while... until I shutdown... > When I restarted, Zope wasn't available. I went back to the Zope directory > and tried ./start again but the script seems to lock up after displaying the > following: > ------ > PROBLEM(100) ZServer Computing default hostname > ------ > INFO(0) Zserver Medusa (V1.13) started at ... > Hostname: frankenstein.energywright.com > Port:8080 > > ------ > INFO(0) ZServer FTP server starte at ... > Authorizer:None > Hostname: frankenstein.energywright.com > Port:8021 > ------ > INFO(0) ZServer PCGI server started at ... > Unix Socket: /usr/local/Zope/var/pcgi.soc > ------ > INFO(0) ZServer Monitor Server (V1.5)started on port 8099 That is not "locked up" -- that is the normal "blocked waiting for requests" state that you see whenever you start Zope with the "-D" flag. > > When I try to connect to http://192.168.1.100:8080/manage I get a "File does > not exist: /home/httpd/html/manage" error in my Apache error_log Try "http://frankenstein.energywright.com:8080" -- what do you see? Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

2 1

Re: [Zope] Oedipus 0.06 released
by Andrew M. Kuchling 03 Mar '00

03 Mar '00

Tres Seaver writes: >"Andrew M. Kuchling" <akuchlin(a)mems-exchange.org> wrote: >> The exported ZClass product still doesn't seem to work, though; if you >> untar it in a new Zope installation, no Product is added when you >> start up Zope. Anyone else notice this problem? >Hmm. ZClass products aren't automagically imported; when exported, turn into >zexp files, either on the client machine somewhere or in the server's >$ZOPE_HOME/var directory. To install them on another server, on Sorry; I wrote sloppily and shouldn't have said "exported". This is the .tgz file produced when you make a distribution of a ZClass-based product. For that, you do need to restart Zope -- but the new Product never shows up. I haven't yet dug into Zope to see if this feature is broken, or if something else is going on. -- A.M. Kuchling http://starship.python.net/crew/amk/ "Doctor, are you a party to this militaristic nonsense?" "I'm not a party to any kind of nonsense, your Grace." -- The Duke of Forgill and the Doctor, in "Terror of the Zygons"

1 0

Trouble with dtml-in
by Kiran Jonnalagadda 03 Mar '00

03 Mar '00

I'm having trouble with using dtml-in in batch mode. A syntax like this: <dtml-in objectlist size=1 start=qs> <dtml-var sequence-item> </dtml-in> Works properly when qs=1 or qs=0 (treated as 1). Anything more than 1 causes it to ignore the "size=1" setting and loop through all the elements in the list. The "next" and "previous" parameters exhibit this problem too. I can't understand what I'm doing wrong. I'm using the exact code as in the DTML reference (except for the size of 1). I upgraded from Zope-2.1.1 to 2.1.4 to see if this problem had been fixed, but no luck yet. The only way I can find to get around this is to remove the size=1 parameter and use a <dtml-if "_['sequence-index']-1==qs"> to make the batch work. -- Kiran Jonnalagadda http://lunateks.com baby.sh: while true; do echo "^G^G^G^G^G"; sed -e 's/food/poop/'; sync; sync; sleep 15; done

2 1

<dtml-call >
by Chui Tey 03 Mar '00

03 Mar '00

Hi, What is the difference between <dtml-call "...."> and <dtml-call ...>. For instance, if I have this directory structure: | +-base +-subfolder from base, <dtml-call subfolder.manage_addFolder(...)> doesn't add any folders, while <dtml-call "subfolder.manage_addFolder(...)"> behaves as expected. It took about an hour of experimenting before getting this right. Could someone explain what is the difference here? Thanks. Chui

3 2