- Zope - Zope lists

fsdump.py output
by Sean Hastings 20 Mar '05

20 Mar '05

I am running fsdump.py to see what is in my Data.fs file, because it seems to be growing a lot faster than it used to. The beginning of the file is a large number of object listings as expected. However, about half way through I start to see a lot of transaction information. These transactions are still in the file even though I have consistently packed the ZODB once a day. The dates on these transactions start a few moths ago, and relate to various functions in a product I have been working on. Is there something that I could have added to the code at that time (perhaps committing parts of transactions to avoid conflicts) that could be causing this transaction information to be left in the Data.fs file even after packing it?

2 1

RE: [Zope] running fsump.py
by Sean Hastings 20 Mar '05

20 Mar '05

Ok, I got it working by adding a couple of lines to the top of the "fsdump.py" file that appended the correct info to sys.path > > Message: 12 > Date: Sun, 20 Mar 2005 07:01:02 -0500 > From: "Sean Hastings" <whysean(a)softhome.net> > Subject: > To: zope(a)zope.org > Message-ID: <LOBBJCJJJBIOBEAFOIDCAEKIEAAA.whysean(a)softhome.net> > Content-Type: text/plain; charset="us-ascii" > > I am trying to run fsdump, but am having import issues. Both my > windows and > linux boxes have Zope installed and running, but when I try to > run fsdump.py > on either machine, I get an import error: > > # python fsdump.py > > Traceback (most recent call last): > File "fsdump.py", line 5, in ? > from ZODB.fsdump import fsdump > ImportError: No module named ZODB.fsdump > > > and despite various attempts to set the PYTHONPATH, I have had no success > getting python to find the ZODB.fsdump code. A Google search for > this error > is producing nothing. > > Any ideas?

1 0

Re: [Zope-dev] Re: Zope on Windows - REQUEST for volunteers
by Tim Peters 20 Mar '05

20 Mar '05

[Mark Hammond] ... > I understand I could probably gain committer privileges Send in a contributor form, and that's certain. > but as mentioned, I wouldn't quite know what to do with them if I > did <wink> You would use your new powers only for good. If you ran the Zope test suite before checking in changes, what could possibly go wrong <wink>?

1 0

Re: [Zope-dev] Re: Zope on Windows - REQUEST for volunteers
by Tim Peters 20 Mar '05

20 Mar '05

[Mark Hammond] ... > * All Zope versions are clearly "broken" (as above) in fundamental (but > generally the same) ways on Windows, but the status of my patches as > "features" vs "bugfixes" is unclear - especially given my lack of > understanding of the culture or the Zope world beyond Plone. They're clearly bugfixes to me; that shouldn't be a hangup here. What's missing is a Zope committer who runs on Windows volunteering time to commit the patches in 2.7-land, and to port them to 2.8- and 3.0-land (those require more than just mechanical merge, because things like moving to Python's standard logging module require rewriting code). Alas, Zope in Windowsland attracts about as much volunteer work apart from Mark Hammond as, say, Python 1.5.2 in Windowsland did. Mark understands what that means. Everyone else can read it as "except for building the installer, hard to distinguish from none" <0.7 wink>.

1 0

dtml-tree: Passing parameters to branches-method
by Ulla Theiss 19 Mar '05

19 Mar '05

Hallo list, how can I pass a parameter (namely the REQUEST-Object) to the branches-method of dtml-tree? I tried the following: <dtml-tree branches="getBranches(REQUEST)"> branch: id: <dtml-var id> <dtml-var title_or_id> </dtml-tree> But it seems, the method "getBranches" isn't called at all. No tree is built up, but there isnt an error-message, too. Many thanks in advance, Ulla.

2 1

Change properties -> auto-update
by Gre7g Luterman 19 Mar '05

19 Mar '05

I've created a product with a zClass that has a couple of property sheets. Users can place this product in their web hierarchy and edit properties with the Properties tab. This all works just fine. The problem is that modifying one of the properties needs to have a side effect. I would like to update a database if this property is changed. Is there an easy way to hook into this process so I can set up a side-effect script? The default propertysheets/Basic/manage page posts the results to propertysheet/Basic, but I'm fuzzy on how (or if) you can change the processing of this script. I suppose I could replace the page that displays the properties and have it submit the changes to a custom script, but I'm not exactly crazy about that idea. The downside of that route is that hardcoding the template page with one of my own will lose me the flexibility I have now. If I add a new property, I'll have to remember to add it to the template. Or does anyone know where I can find the current template that dynamically shows the property form, so I can make a modified version for this product? Gre7g

2 1

Zope on Windows - REQUEST for volunteers
by Andreas Jung 19 Mar '05

19 Mar '05

Hi, there are several open issues in the Zope collector with Zope running on Windows. I can't see anyone worrying about the Windows platform (I also don't care about Windows as UN*X guy). So if you are interested in running Zope on Windows in a reasonable way than *you* should help to fix the outstanding bugs. I heard some remarks (behind my back) that Zope is not a stable solution on Windows...possibly.....but since Zope is a community-driven project people doing such remarks should either shut up or help to improve the situation by volunteering (which is also true for other parts of the Zope development). So if you want to improve running Zope on Windows: go the Zope collector, search for Windows related problems, find a solution, submit a patch and don't expect that everything can be handled by the handful of active Zope 2 core developers...means it's also up to *YOU*. Andreas

1 0

OWASP relevance?
by Bill Seitz 18 Mar '05

18 Mar '05

Are any of the OWASP guidelines either (a) a non-risk by default in Zope, or (b) documented in terms of specific Zope practices to follow/avoid? http://www.owasp.org/documentation/topten.html

2 1

Re: Zope SQL injection
by Jim Penny 18 Mar '05

18 Mar '05

>Andy Yates wrote: >> Could somebody either point me to an article or explain what >> precautions should be taken to prevent SQL injection in Zope. If >> user entered form data is passed to a ZSQL method does something >> automajically db escape the data or is the programmer responsible >>for >> doing this. If the programmer is responsible, how is it done in >> Zope? Thanks! >Don't use <dtml-var> in ZSQL-Methods, use only <dtml-sqlvar>. ><dtml-sqlvar> is escaping the parameter automagically, so nobody can >inject malicious code... at least I hope so...;) >Cheers, Maik OK, this is pretty close. Use dtml-sqlvar whenever possible. dtml-sqlvar will sql_quote things declared string for you, and will through an exception if something declared float or integer can't be evaluated. Unfortunately, there are some fairly common cases where dtml-sqlvar won't work. The best example is when using a LIKE clause. select * from foo where field like <dtml-sqlvar stuff type=string>% will render as select * from foo where field like 'sql_quoted_form_of_stuff'% which is syntactically incorrect. You have to use select * from foo where field like '<dtml-var stuff sql_quote>%' Do not sql_quote numeric items, always use dtml-sqlvar, as sql_quote really just affects quoting, and does not escape semi-colon.

1 0

Zope SQL injection
by Andy Yates 18 Mar '05

18 Mar '05

Could somebody either point me to an article or explain what precautions should be taken to prevent SQL injection in Zope. If user entered form data is passed to a ZSQL method does something automajically db escape the data or is the programmer responsible for doing this. If the programmer is responsible, how is it done in Zope? Thanks! Andy

2 1