- Zope - Zope lists

Zope 4.6.1 and 5.2.1 released with an important security fix
by Jens Vagelpohl 08 Jun '21

08 Jun '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6.1 and 5.2.1. This bugfix release solves a few minor issues and also contains an important security fix, see below. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. NOTE: These releases contain an expanded security fix that prevents remote code execution through TAL expressions. The first iteration of the security fix in Zope 4.6 and 5.2 did not catch all cases of unauthorized TAL path expression traversal. Just like the first fix, you will only ever be at risk if you allow untrusted users to add or edit Zope Page Template objects, which is a very unusual non-standard site configuration. For more details, see the security advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2…. A CVE has been requested through GitHub. NOTE FOR PLONE USERS: Make sure to install the latest version of PloneHotfix20210518 first, which should appear shortly after this Zope release. See https://plone.org/security/hotfix/20210518. Don't install Zope 4.6.1 or 5.2.1 into an existing Plone setup without testing. The security changes in Zope break some Plone add-ons that relied on the old insecure traversal behavior. PloneHotfix20210518 ensures support for those Plone add-ons. Jens Vagelpohl

1 0

Zope 4.6 and 5.2 released with an important security fix
by Jens Vagelpohl 21 May '21

21 May '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6 and 5.2. This bugfix release solves a few minor issues and also contains an important security fix, see below. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. NOTE: These releases contain a security fix that prevents remote code execution through TAL expressions. You will only be at risk if you allow untrusted people to add or edit Zope Page Template objects. For more details, see the security advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-j…. A CVE has been requested through GitHub. NOTE FOR PLONE USERS: Before installing Zope 4.6 or 5.2 make sure to install PloneHotfix20210518 first, see https://plone.org/security/hotfix/20210518. The security changes in Zope break some Plone add-ons that relied on the old insecure traversal behavior. PloneHotfix20210518 ensures support for those Plone add-ons. Jens Vagelpohl

2 3

Two or three things about Zope 5
by Giampiero Benvenuti 07 May '21

07 May '21

Hi there, first of all, I want to thanks all the people who works on the project “5”. Second, please bear with me while I try to communicate my failures with the "5”. I was able to install zope5.1.2 on my mac and also on opalstack.com with the help of Sean. It looks great! The Chameleon Editor works fine and so almost all the products I would need. So far, the only issues I have with it are the errors expressions and the Session Data Manager. 1. When in some script I do some typo like “reuest” instead or “request” I get the error “Internal Server Error The server encountered an unexpected internal server error (generated by waitress)” Question: can I have a better and less “minimalistic” error expressions, something more “friendly”? 2. Yeah! Session Data Manager: "Sessioning is currently disabled because the session data container path setting is invalid. Please enter the path to a valid session data container object.”. What can I do bout it? 3. Sorry, I forgot about this: zone time. In zope 2.xx I used to set the local/zone time in this way: in instance/bin/runzope: export TZ=Europe/Rome. How do I fix it in zope5? Thanks you all for your work and help, —giampiero

2 3

ExtFile/ExtImage compatibility with Zope 4/5?
by Jesus Cea 30 Mar '21

30 Mar '21

I am getting ready to migrate to Zope 4, and checking products I depends massively on ExtFile/ExtImage. I wonder about the support of that product or something similar. Where are third-party Zope products hosted nowadays? If this product is not supported/abandoned in Zope 4/5, would be people interested in a fork maintained by me? Could I ask here questions about "the modern way" of writing products for current Zope? If not, who/where should I ask? Thanks. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - https://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

3 6

Zope 4.5.5 and 5.1.2 released
by Jens Vagelpohl 02 Mar '21

02 Mar '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.5.5 and 5.1.2. This bugfix release solves a few minor issues and improves security checking for some types of XML-RPC requests. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. Jens Vagelpohl

1 0

Two low-impact security issues in Products.PluggableAuthService
by Jens Vagelpohl 26 Feb '21

26 Feb '21

Hi all, Two low-impact security issues have been identified in Products.PluggableAuthService: - an information disclosure issue involving the ZODB Role Manager plugin. See https://github.com/zopefoundation/Products.PluggableAuthService/security/ad… for details. - an open redirect issue in the Cookie Auth Helper. See https://github.com/zopefoundation/Products.PluggableAuthService/security/ad… for details. Both issues are mitigated by updating to Products.PluggableAuthService version 2.6.1 or higher. The Plone release managers will apply this update with Plone bugfix releases they are planning to publish within the next few days. jens

1 0

Zope 4.5.4 and 5.1.1 released
by Jens Vagelpohl 10 Feb '21

10 Feb '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.5.4 and 5.1.1. This bugfix release solves a few minor issues and updates the shipped versions of bootstrap, jQuery and Font Awesome to their latest releases. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. Jens Vagelpohl

1 0

Announcement: Zope 5.0 released
by Michael Howitz 08 Oct '20

08 Oct '20

On behalf of Zope developer community I am pleased to announce the release of Zope 5.0! This release - drops support for Python 2.7 and 3.5 - drops support for `ZServer` - adds support for the newly released Python 3.9 Although this release is a major one, it should be possible to use it without any changes if the following preconditions are met: - Your project runs on the latest Zope 4 release on Python 3.6+ and does not use ZServer. - Neither your tests nor running your Zope instance shows DeprecationWarnings. Additionally this release contains some minor features and bug fixes which have been backported to Zope 4 where possible. As Zope 5 is now released, Zope 4 is put into bugfix mode until 2021-12-31. (See the roadmap for details: https://zope.readthedocs.io/en/latest/roadmap.html) For details about this release see the what’s-new-section and the change log: - https://zope.readthedocs.io/en/latest/news.html#what-s-new-in-zope-5 - https://zope.readthedocs.io/en/latest/changes.html#id1 To install the new version see https://zope.readthedocs.io/en/latest/INSTALL.html -- Mit freundlichen Grüßen Michael Howitz

1 0

Tutorial for zope4
by Miguel Beltran R. 01 Oct '20

01 Oct '20

Good morning list,Glad to be here again in the list and community I used zope many years ago until version 2.13 and I want to update to the new version 4/5 but I have found that the Zope Book is not so useful to me as before. I used to do me little systems all in the ZMI using pagetemplate, zsql method, postgresql, zserver, etc. -Zserver was replaced in favor of waitress, no problem. -pagetemplate is almost the same, but now use chameleon engine, no problem. -zsqlmethod is not installed by default, I installed it using pip. The recommendation is to use zope.sqlalchemy. I dont know sqlalchemy and how to use it with zope 4/5. help here -I tried to find the postgresql connector to zope 4 in pypi without success, even the ODBC connector I could not find it. how do I connect to a database? Also, I saw that the Plone foundation have now the rights of Zope foundation. I wish them the best for his work. do someone can recomend me a zope 4 tutorial for dummys? -- ________________________________________ Lo bueno de vivir un dia mas es saber que nos queda un dia menos de vida

3 2

Announcement: Zope 4.4.2 released
by Michael Howitz 16 Jun '20

16 Jun '20

On behalf of Zope developer community I am pleased to announce the release of Zope 4.4.3. The 4.4.3 release contains mostly bug fixes and little improvements in error handling. For details of the changes see https://zope.readthedocs.io/en/4.x/changes.html#id1 To install the new version see https://zope.readthedocs.io/en/4.x/INSTALL.html -- Mit freundlichen Grüßen Michael Howitz

1 0