- Zope - Zope lists

- ANN: CodeIt does Zope hosting
by Paul Everitt 23 Jan '99

23 Jan '99

>From the news on the Zope site: CodeIt Computing is proud to announce: http://www.codeit.com/announce.html Zope support with CodeIt's Standard Monthly Hosting Package. CodeIt has been working with and will continue to work with Digital Creations, the creator of Zope, to bring Zope hosting to the community. CodeIt will also be hosting the www.zope.org website. I'm extremely pleased to make this joint announcement with Scott Robertson from CodeIt. Getting a list of Zope Hosting Providers is a priority for us, and I couldn't have asked for a better company to start with than CodeIt. I expect to have www.zope.org moved over to the new machine, which is already online there, within the next week. A very sincere thanks to Scott and his folks for moving quickly on a contract with us... --Paul Paul Everitt Digital Creations paul(a)digicool.com 540.371.6909

3 2

RE: [Zope] - Re: XML-RPC
by Paul Everitt 23 Jan '99

23 Jan '99

Skip wrote: > Still, a URI plus a content type should be enough to decide > you're going to > be processing an XML-RPC request, right? Presumably you > won't have the same > combination of URI and content type meaning two completely > different things. If someone does an HTTP file upload of a .xml file, and something in the client's system (operating system, browser config) associates .xml extensions with a content type of text/xml, then you would have a clash. No? --Paul Paul Everitt Digital Creations paul(a)digicool.com 540.371.6909

2 1

RE: [Zope] - ANN: CodeIt does Zope hosting
by bruce＠pixar.com 23 Jan '99

23 Jan '99

You forgot "Zope doesn't run under a privileged user ID". It sounds to me as if it would be simple enough, given the way PCGI-wrapper works, to run Zope in a chroot jail. Apache belongs in there, too. This does not close _all_ holes, though. Thanks Bruce From: Paul Everitt <Paul(a)digicool.com> > In general, when talking about the through-the-web part of Zope: > > o The access control machinery tries to cover nearly everything > > o Jim Fulton went to great lengths to make DTML and expr's "safe", > though more work can be done. > > o Hallelujah, you _don't_ deal with files on the filesystem! :^) > > o All user information and security information is internal to Zope and > not mixed in with /etc/passwd or group, file system permissions, etc. > > o Users only exist in their part of the Folder system, thus can't take > control of someone else's area > > ..plus more I probably haven't thought of. -- The $70 Billion US "budget surplus" hardly offsets our $5 Trillion national debt. The debt increased by $133 Billion in the same year we found a "surplus". More debt is predicted for 1999. See www.concordcoalition.org . Bruce Perens K6BP bruce(a)pixar.com 510-620-3502 NCI-1001

1 0

- Understanding DTML processing
by Paulo Eduardo Neves 23 Jan '99

23 Jan '99

Hi, I'm with a doubt about DTML processing. I'll try to create a simple example to demonstrate it. I didn't tested it, so it can be flawed. Suppose we have a product inside a folder: class Product: def __init__(self): self.aName = "My Name" template_html = HTMLFile('template') def process(self, REQUEST): """Process the product and return the template""" #process something here return self.template_html() The template.dtml file should access the class attributes, something like: <HTML><BODY>  Name:   There is no name  </BODY></HTML> I thought that calling http://mysite.com/folder/productId/template_html or http://mysite.com/folder/productId/process would return me the same output. Although the first one shows me "Name: My Name" and the second one shows "There is no name". Is this the correct behavior? If so, what should I return from process() to make it have the same output of template_html? Thanks in advance, -- Paulo Eduardo Neves PUC-Rio de Janeiro Pager: Central: 292-4499 cod. 213 99 64 ou use a URL: http://www.learn.fplf.org.br/neves/mensagempager.html

3 3

- subscribe
by none 23 Jan '99

23 Jan '99

confirm 999186

1 0

RE: [Zope] - ANN: CodeIt does Zope hosting
by Paul Everitt 23 Jan '99

23 Jan '99

Gabe wrote: > I'm curious -- has Zope been analyzed from a security point of view? I > honestly haven't thought this through -- perhaps the security > issues are no > more than that of CGI.. If "analyzed" means "Did we get a 3rd party audit?", no. However, the whole of Zope was built for safe, through-the-web editing. Security is the reason that some things aren't as elegant as you'd like, such as the expression syntax and not storing Python code in the database. In general, when talking about the through-the-web part of Zope: o The access control machinery tries to cover nearly everything o Jim Fulton went to great lengths to make DTML and expr's "safe", though more work can be done. o Hallelujah, you _don't_ deal with files on the filesystem! :^) o All user information and security information is internal to Zope and not mixed in with /etc/passwd or group, file system permissions, etc. o Users only exist in their part of the Folder system, thus can't take control of someone else's area ...plus more I probably haven't thought of. --Paul

1 0

RE: [Zope] - DTML Example folder...
by Paul Everitt 23 Jan '99

23 Jan '99

Andy wrote: > It should be useful for newbies to get a feel for how to achieve the > 'bare-bones' functionality you might want when creating a > site. (Looping, > Traversing, Storing Info, Creating Folders etc.). I'd just like to note that I tried this out yesterday and it is a really, really useful starting point for people wanting to do DTML scripting. --Paul

1 0

- ZMySQLDA/MySQLmodule.c: Bugs and fixes
by Mitch Chapman 23 Jan '99

23 Jan '99

This really concerns MySQLmodule.c, not ZMySQLDA per se. But I found these problems while working w. Zope, so thought it best to address the Zope list too. Problem 1: When compiling against MySQL 3.22.14b-gamma, this warning is displayed: ./MySQLmodule.c: In function `pythonify_row': ./MySQLmodule.c:199: warning: assignment from incompatible pointer type Cause: mysql_fetch_lengths() returns 'unsigned long *'. The result is being assigned to 'unsigned int *'. Not a problem on many 32-bit platforms, but what the hey. Problem 2: When attempting to do an invalid database insert (e.g. inserting with a duplicate key value), Python dumps core. Cause: In function DBH_query(), not all fields of sth are properly initialized. When a database insert fails, sth->res has a random value. The subsequent free(self->res) in STH_dealloc() generates a bus error. The attached context diff contains the fixes I used. Lemme know if you have any questions/corrections. -- Mitch Chapman | 4105 Executive Drive Ohio Electronic Engravers, Inc. | Beavercreek, OH 45430 mchapman(a)oee.com | import StandardDisclaimer *** MySQLmodule.c Tue Dec 22 12:34:23 1998 --- MySQLmodule.c.patched Fri Jan 22 18:33:43 1999 *************** *** 193,199 **** PyObject *rowlist, *fieldobj; MYSQL_FIELD *tf; int i, n; ! unsigned int *lengths; n = mysql_num_fields(res); lengths = mysql_fetch_lengths(res); --- 193,199 ---- PyObject *rowlist, *fieldobj; MYSQL_FIELD *tf; int i, n; ! unsigned long *lengths; n = mysql_num_fields(res); lengths = mysql_fetch_lengths(res); *************** *** 902,907 **** --- 902,908 ---- if (sth == NULL) return NULL; sth->sth_use_result = self->dbh_use_result; sth->dbh = NULL; + sth->res = NULL; if (!PyArg_ParseTuple(args, "s#|i:query", &query, &size, &(sth->sth_use_result))) { Py_XDECREF(sth); return NULL;

1 0

Re: [Zope] - Website recommendation
by simon＠joyful.com 22 Jan '99

22 Jan '99

> Please (everyone) brainstorm some ideas on this. We don't want Have the zopesters seen the Giant Java Tree (www.gjt.org) ? I think it does excellent things in this area. Speaking of "Zopespot" - I'm surprised slashdot hasn't yet mentioned zope, it seems very apropos. And I submitted it too. Hasn't CmdrTaco realized we're planning a takeover ? :) -Simon

4 4

Re: [Zope] - Website recommendation
by simon＠joyful.com 22 Jan '99

22 Jan '99

"Andrew M. Kuchling" <akuchlin(a)cnri.reston.va.us> writes: > Best to wait until something has been actually implemented Just to clarify - I submitted "zope-has-been-made-open-source!", not "zopespot-is-going-to-make-slashdot-look-like-a-.." :) This was some time back. -Simon

1 0