[Zope-Annce] Hotfix for cross-site scripting vulnerability

2007-03-20 Thread Martijn Pieters
3rd-party code that calls these methods indirectly may still be affected. Hotfix We have prepared a hot fix for this problem at: http://www.zope.org/Products/Zope/Hotfix-2007-03-20/ Hotfix-20070320/, http://www.zope.org/Products/Zope/Hotfix-2007-03-20/ Hotfix-20070320

[Zope-Checkins] SVN: Zope/trunk/ - Add a request method decorator to AccessControl, creating decorators that limit a method to one request method only.

2007-03-20 Thread Martijn Pieters
Log message for revision 73386: - Add a request method decorator to AccessControl, creating decorators that limit a method to one request method only. - Protect various security-setting-mutators with a POST-only decorator. Changed: U Zope/trunk/doc/CHANGES.txt U

[Zope-Checkins] SVN: Zope/branches/2.10/ - Backport a postonly decorator from Zope trunk's requestmethod decorator factory.

2007-03-20 Thread Martijn Pieters
Log message for revision 73388: - Backport a postonly decorator from Zope trunk's requestmethod decorator factory. - Protect various security-setting-mutators with this decorator. Changed: U Zope/branches/2.10/doc/CHANGES.txt U Zope/branches/2.10/lib/python/AccessControl/Owned.py U

[Zope-Checkins] SVN: Zope/branches/2.9/ - Backport a postonly decorator from Zope trunk's requestmethod decorator factory.

2007-03-20 Thread Martijn Pieters
Log message for revision 73389: - Backport a postonly decorator from Zope trunk's requestmethod decorator factory. - Protect various security-setting-mutators with this decorator. Changed: U Zope/branches/2.9/doc/CHANGES.txt U Zope/branches/2.9/lib/python/AccessControl/Owned.py U

[Zope-Checkins] SVN: Zope/branches/Zope-2_8-branch/ - Backport a postonly decorator from Zope trunk's requestmethod decorator factory.

2007-03-20 Thread Martijn Pieters
Log message for revision 73390: - Backport a postonly decorator from Zope trunk's requestmethod decorator factory. - Protect various security-setting-mutators with this decorator. Changed: U Zope/branches/Zope-2_8-branch/doc/CHANGES.txt U

[Zope-Checkins] SVN: Zope/hotfixes/ Import POST-only hotfix

2007-03-20 Thread Martijn Pieters
/README.txt === --- Zope/hotfixes/README.txt2007-03-20 09:05:56 UTC (rev 73390) +++ Zope/hotfixes/README.txt2007-03-20 09:09:02 UTC (rev 73391) @@ -0,0 +1,62 @@ +Hotfix-20070320 README + +This hotfix corrects a cross-site

[Zope-Checkins] SVN: Zope/hotfixes/ Undo botched import

2007-03-20 Thread Martijn Pieters
=== --- Zope/hotfixes/README.txt2007-03-20 09:09:02 UTC (rev 73391) +++ Zope/hotfixes/README.txt2007-03-20 09:10:28 UTC (rev 73392) @@ -1,62 +0,0 @@ -Hotfix-20070320 README - -This hotfix corrects a cross-site scripting vulnerability in Zope2, -where an attacker can use a hidden GET request

[Zope-Checkins] SVN: Zope/hotfixes/Hotfix_20070320/ Undo botched import

2007-03-20 Thread Martijn Pieters
73392) +++ Zope/hotfixes/Hotfix_20070320/README.txt2007-03-20 09:11:46 UTC (rev 73393) @@ -0,0 +1,62 @@ +Hotfix-20070320 README + +This hotfix corrects a cross-site scripting vulnerability in Zope2, +where an attacker can use a hidden GET request to leverage a +authenticated user's

[Zope-Checkins] SVN: Zope/trunk/lib/python/AccessControl/requestmethod.py Add backward compatible postonly decorator

2007-03-20 Thread Martijn Pieters
Log message for revision 73395: Add backward compatible postonly decorator Changed: U Zope/trunk/lib/python/AccessControl/requestmethod.py -=- Modified: Zope/trunk/lib/python/AccessControl/requestmethod.py === ---

[Zope-Checkins] SVN: Zope/trunk/lib/python/AccessControl/requestmethod.py Add comment about postonly status

2007-03-20 Thread Martijn Pieters
Log message for revision 73396: Add comment about postonly status Changed: U Zope/trunk/lib/python/AccessControl/requestmethod.py -=- Modified: Zope/trunk/lib/python/AccessControl/requestmethod.py === ---

[Zope-dev] Zope Tests: 5 OK

2007-03-20 Thread Zope Tests Summarizer
Summary of messages to the zope-tests list. Period Mon Mar 19 12:00:00 2007 UTC to Tue Mar 20 12:00:00 2007 UTC. There were 5 messages: 5 from Zope Unit Tests. Tests passed OK --- Subject: OK : Zope-2.7 Python-2.3.6 : Linux From: Zope Unit Tests Date: Mon Mar 19 21:52:50 EDT 2007

[Zope-PAS] Properties Plugin

2007-03-20 Thread Christian Klinger
Hello, i try to add Properties to all of my PAS-Users. The Properties should be the adresse information of my Users, which i get about an WebService. Now i have developed a very simple example of a IPropertiesPlugin: security.declarePrivate('getPropertiesForUser') def

[Zope] catalog aware not working.. help

2007-03-20 Thread Allen Huang
I made a pyhon product with catalogaware as one of my base class but my zcatalog named 'catalog' doesn't automatically catalog when I add a product item. what could be a problem? Please help this is part of my code that include catalogawareness: class ShpTypePointClass(Item, Persistent,

[Zope] Re: catalog aware not working.. help

2007-03-20 Thread Josef Meile
Hi Allen I made a pyhon product with catalogaware as one of my base class but my zcatalog named 'catalog' doesn't automatically catalog when I add a product item. what could be a problem? Perhaps setting the catalog in your object instance may help: self.manage_editCataloger(catalogPath)

[Zope] Addressbook Product

2007-03-20 Thread Frank Drews
Hi, I have realy searched for a nice addressbook product for a couple two days now. I dont find anything suitable. I need it for a collaboration plattform running on zope, cmf. I like zope very much and am looking for a shared addressbook. Anybody any experiences or suggestions? What would

Re: [Zope] catalog aware not working.. help

2007-03-20 Thread Jonathan
- Original Message - From: Allen Huang [EMAIL PROTECTED] To: Zope zope@zope.org Sent: Tuesday, March 20, 2007 3:09 AM Subject: [Zope] catalog aware not working.. help I made a pyhon product with catalogaware as one of my base class but my zcatalog named 'catalog' doesn't

Re: [Zope] I keep getting validate error.. why?

2007-03-20 Thread Jonathan
- Original Message - From: Allen Huang [EMAIL PROTECTED] Subject: [Zope] I keep getting validate error.. why? I keep getting this error, but the same code work on another zope server and I didn't use any key or attribute named 'validate'. What is the cause of this? Time2007/03/20

Re: [Zope] I keep getting validate error.. why?

2007-03-20 Thread Dieter Maurer
Allen Huang wrote at 2007-3-20 05:39 -0700: I keep getting this error, but the same code work on another zope server and I didn't use any key or attribute named 'validate'. What is the cause of this? Time2007/03/20 17:38:03.726 GMT+8 User Name (User Id)admin (admin) Request

[Zope] Who's using Quanta+ / Kdevelop for ZPT?

2007-03-20 Thread Mihamina (R12y) Rakotomandimby
Hi, I just wondered if there was some Quanta+/Kdevelop users in here. I am looking for their way to handle ZPTs. I know it's pretty close to XML, but any tip would interest me. Thank you! ___ Zope maillist - Zope@zope.org

Re: [Zope] Addressbook Product

2007-03-20 Thread Mihamina (R12y) Rakotomandimby
On Tuesday 20 March 2007 11:39, Frank Drews wrote: Hi, I have realy searched for a nice addressbook product for a couple two days now. I dont find anything suitable. I need it for a collaboration plattform running on zope, cmf. I like zope very much and am looking for a shared addressbook.

Re: [Zope] catalog aware not working.. help

2007-03-20 Thread Bakhtiar A Hamid
On 3/20/07, Allen Huang [EMAIL PROTECTED] wrote: I made a pyhon product with catalogaware as one of my base class but my zcatalog named 'catalog' doesn't automatically catalog when I add a product item. what could be a problem? Please help this is part of my code that include

Re: [Zope-DB] MySQL gone away

2007-03-20 Thread Andreas Jung
--On 20. März 2007 09:18:19 +0100 [EMAIL PROTECTED] wrote: Hello, I am getting errors in queries on a MySQL 5.027 database using zmysqlda 2.0.9b3 and mysql-python 1.2.1 with Zope 2.10.2. The errors occured the next day after setting the whole thing up and while at first it was working all

RE: [Zope-DB] DCOracle2 with a Stored Procedure that Returns REFCURSOR / ORA TIMESTAMP DataType Issue

2007-03-20 Thread Maan M. Hamze
To give an update: To run a stored procedure which returns a ref cursor, I tried: c1 = db.cursor() c2 = db.cursor() sql = storedProcedureName(:inparam1, :inparam2, etccc, :outparam) options = (inparam1, inparam2, et, c2) c1.execute(sql, options) As recommended below. This did not work.

RE: [Zope-DB] DCOracle2 with a Stored Procedure that Returns REFCURSOR

2007-03-20 Thread Maan M. Hamze
You have a point Maciej - but I got used to DCOracle2 and so far it has performed quite well. I link it with Oracle lib32 libraries, but use it with ora lib 64-bit libraries in the path. So far, there has been no issues I am aware of. The only thing that came up recently is how to use it with a

Re: [Zope-DB] DCOracle2 with a Stored Procedure that Returns REFCURSOR / ORA TIMESTAMP DataType Issue

2007-03-20 Thread Matthew T. Kromer
Chances are good that the C code that is trying to construct the timestamp doesn't know how to convert it... A quick peek into the source code hints the code doesn't have a type converter for SQLT_TIMESTAMP, although there is a converter for SQLT_DAT (date). Putting a converter into the

Re: [Zope-DB] DCOracle2 with a Stored Procedure that Returns REFCURSOR / ORA TIMESTAMP DataType Issue

2007-03-20 Thread Maciej Wisniowski
This was causing a segmentation fault on a Sun Solaris box. On Windows, I got an actual error message. While fetching, the cursor has a field of ora datatype TimeStamp. This was crashing DCOracle2. a to_char solved the issue. I am using DCOracle2 and Oracle 10 on Solaris (and Windows XP).