- Zope - Zope lists

Re: [Zope] ODBC DA for unix coming?
by Christopher Petrilli 20 Jul '99

20 Jul '99

> There is also the unixODBC project, which has vowed to bring ODBC freely > to Unix and in particular Linux. MySQL and PostgreSQL drivers are > available. > > "The unixODBC Project goals are to develop and promote unixODBC to be > the definitive standard for ODBC on the Linux platform. This is to > include GUI support for KDE." After some talking, I'd say our position vis a vis ODBC on UNIX is that it's simply not a good solution for application servers. ODBC real value lies in the client side, and on Windows NT, where often it is the easiest (or only) solution. On UNIX, all database vendors ship native libraries (except Microsoft, but don't go there ;-), which are substantially better choices. Some "swag" looks, ODBC for Oracle, for example, is 1/10th the performance level of the native OCI level interface, so why would you use this in your application server? This is a good project for the community, but I hazard that we have no resources to dedicate to ODBC/UNIX integration. Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

1 0

RE: [Zope] Re: [Zope-dev] Introspection, managing External Method s?
by Michel Pelletier 20 Jul '99

20 Jul '99

> -----Original Message----- > From: Andreas Kostyrka [mailto:andreas@mtg.co.at] > Sent: Tuesday, July 20, 1999 9:44 AM > To: Robin Becker > Cc: zope(a)zope.org > Subject: Re: [Zope] Re: [Zope-dev] Introspection, managing External > Methods? > > > ad 3) Ok, changing the standard superuser password is > natural. Perhaps it > should be random generated. For releases, it is. CVS checkouts get the standard password for our own sanity. > Again, Monitor access is equivalent with Unix login level access. The > shell just happens to be called python, not /bin/sh ;) > Also, for general knowledge, the monitor server by defalt only listens on the localhost interface, network access is disabled by default. Turning it on would be pretty dangerous. -Michel > Andreas > -- > Win95: n., A huge annoying boot virus that causes random > spontaneous system > crashes, usually just before saving a massive project. > Easily cured by > UNIX. See also MS-DOS, IBM-DOS, DR-DOS, Win 3.x, Win98. > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

2 1

Re: [Zope] Re: [Zope-dev] Introspection, managing External Methods?
by michel＠digicool.com 20 Jul '99

20 Jul '99

Robin Becker <robin(a)jessikat.demon.co.uk> writes: > In article <199907181357.XAA01659(a)mbuna.arbhome.com.au>, Anthony Baxter > <anthony(a)interlink.com.au> writes > > > >This has come up on a number of occasions - the problem is that an > >external method can subvert all the protections and access control > >that Zope provides. > > > >Having said that, there's nothing stopping you (or someone else) > >writing an external method that allows you to edit external methods. :) > > > >Anthony > > > Yes I know that external methods can do anything. But since the manager > can destroy the site what's wrong with allowing editing only for the > manager. I realise that malicious managers could wipe the hard disk if > the manager user could, but then so can the manager sitting at the > console. > The problem here is that Zope can have many concepts of a 'manager'. Someone you trust with managerial rights in /some/backwater/zope/folder is as much a 'manager' as a top level manager, only restricted in place, not permission. If you give a user the 'Manager' role, they will have the permission to 'Edit External Methods' unless you explicitly turn it off. Another reason is that HTTP is not the World's Most Secure Protocol. In fact, HTTP Basic authentication is downright scary. Remember, external methods can do more than just whack your site, they can do anything to the filesystem the Zope process owner can do. Including something more sinister than just mere deletion (which any sys admin worth her salt should be able to restore in minutes) such as password sniffing trojan horses and possibly even something kinda wild like XML-RPC worms (now THAT would be cool!). The last thing we want to see is a back orifice for Zope, which is exactly what I think could be developed if we ever provided a hole through Zope's security machinery. -Michel

4 5

Re: [Zope-dev] Introspection, managing External Methods?
by Anthony Baxter 20 Jul '99

20 Jul '99

This has come up on a number of occasions - the problem is that an external method can subvert all the protections and access control that Zope provides. Having said that, there's nothing stopping you (or someone else) writing an external method that allows you to edit external methods. :) Anthony >>> Robin Becker wrote > Are there any plans to upgrade the External Methods product to allow > remote management ie creation/deletion/modification of the file texts? I > ask because a major advantage of Zope is the ability to manage at a > distance and this is not possible for External Methods. I can see easy > fudges using a hack of fsimport, but something based on the existing > external methods would be better. > > More generally how can one upgrade a Zope product remotely; assuming > this were possible it would be nice to be able to remotely shut down > Zope and get it to restart. > -- > Robin Becker > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://www.zope.org/mailman/listinfo/zope-dev > > (For non-developer, user-level issues, use the companion list, > zope(a)zope.org, http://www.zope.org/mailman/listinfo/zope ) -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

3 2

semipersistent
by Robin Becker 20 Jul '99

20 Jul '99

I'm using various external methods to create GIF files in my current server. These are expensive to produce, but are created on a per user basis eg as the results of a user input. How can I make these temporary in the sense that they live until the connection is dropped. -- Robin Becker

2 1

cgi and zope
by Peter Oliver Monz 20 Jul '99

20 Jul '99

Hello! Can I include cgi-output like in SSI (Apache) in Zope templates? Y.S. peter o. monz

2 1

RE: [Zope] manage_changeProperties
by Alex.Thomas＠dresdnerkb.com 20 Jul '99

20 Jul '99

I get this too. Drat! With the earlier alpha releases one had to explicitly assign the permission to the method, but now it looks like it does it for you, except that it doesn't...!? cheers Alex > -----Original Message----- > From: Jason Spisak [mailto:webmaster@mtear.com] > Sent: 19 July 1999 20:43 > To: zope(a)zope.org > Subject: [Zope] manage_changeProperties > > > Zopists, > > What permissions does a user have to have to use > manage_changeProperties. And it is not "Mange Properties" because a > user with that permission gets an unauthorized traceback to > manage_changeProperties. Actually even with all permissions a user > can't access manage_changeProperties unless the DTML is > proxied with the > Manager Role. Anyone have a thought as to why this is? > > Jason Spisak > webmaster(a)mtear.com > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) > ########################################## This email, its content and any files transmitted with it are intended solely for the addressee(s) and may be legally privileged and/or confidential. Access by any other party is unauthorised without the express written permission of the sender. If you have received this email in error you may not copy or use the contents, attachments or information in any way. Please destroy it and contact the sender on the number printed above, via the Dresdner Kleinwort Benson switchboard on +44 171 623 8000 or via e-mail return. Internet communications are not secure unless protected using strong cryptography. This email has been prepared using information believed by the author to be reliable and accurate, but Dresdner Kleinwort Benson makes no warranty as to accuracy or completeness. In particular Dresdner Kleinwort Benson does not accept responsibility for changes made to this email after it was sent. Any opinions expressed in this document are those of the author and do not necessarily reflect the opinions of the Bank or its affiliates. They may be subject to change without notice. ##########################################

1 0

Bugfix: Navigation-0.0.4 Product released.
by Andreas Kostyrka 20 Jul '99

20 Jul '99

Hi! I've released Navigation-0.0.4.tar.gz, it's available at the Zope contribution area (http://www.zope.org/Download/Contrib/) This fixes a pretty weird bug when navigate_filter is called with acquire=0 (meaning ``ignore Aquisition'') with previous versions, which resulted in wrong results because deactivated objects were not taken in account. As a result, it now activates all potential objects, which should not be a big problem, as the tree tag has to do this with the result also. Andreas -- Win95: n., A huge annoying boot virus that causes random spontaneous system crashes, usually just before saving a massive project. Easily cured by UNIX. See also MS-DOS, IBM-DOS, DR-DOS, Win 3.x, Win98.

1 0

RE: [Zope] please help test this site
by Alexander Staubo 20 Jul '99

20 Jul '99

>-----Original Message----- >From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of >Anthony Pfrunder >Sent: 20. juli 1999 11:20 >To: bruce(a)perens.com >Cc: zope(a)zope.org >Subject: Re: [Zope] please help test this site > > >Hi, > >Great site! > >I'm using IE 4.0 on Win95 and don't have problems with images or text. >However, I cannot submit comments to articles. Due to IE's great >feedback system it is hard for me to tell where the problem >is. [stuck in >a Microsoft only environ :(] If by "feedback system" you mean how it replaces HTTP error messages with its own inane DHTML pages, you can turn this off. Go Tools, Internet Options, Advanced, disable "Show friendly HTTP error messages". >Otherwise, great! > >PS Why not add links to comp.risks, privacy digest and >www.ntsecurity.com > >Cheers, > >Anthony Pfrunder >CS, HCI Engineer -- Alexander Staubo http://www.mop.no/~alex/ "Reality is that which, when you stop believing in it, doesn't go away." --Philip K. Dick

1 0

RE: [Zope] Zope v Enhydra v NAS v ASP?
by Paul Everitt 20 Jul '99

20 Jul '99

danda wrote: > Hmm... what amount of support does it have for XML besides > XML-RPC? Is there > pre-built Zope functionality for dealing with XML, or is it > more like, plug in > your favorite XML parser and roll your own? > For example, Enhydra supplies XMLC, which is a HTML/XML to > Java compiler. Look for an email within the next day or so from us with the full monty on this subject. --Paul Paul Everitt Digital Creations paul(a)digicool.com 540.371.6909 ----------------------------------------- The Open Source Zope application server http://www.zope.org/ -----------------------------------------

1 0