Re: [Zope-dev] SVN: zope.dublincore/trunk/setup.py Add 'zope.app.component' to the 'test' extra in the setup.py so that the
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Aaron Lehmann wrote: > Log message for revision 101312: > Add 'zope.app.component' to the 'test' extra in the setup.py so that the > creatorannotator tests can pass. > > > > Changed: > U zope.dublincore/trunk/setup.py > > -=- > Modified: zope.dublincore/trunk/setup.py > === > --- zope.dublincore/trunk/setup.py2009-06-29 11:48:01 UTC (rev 101311) > +++ zope.dublincore/trunk/setup.py2009-06-29 13:36:38 UTC (rev 101312) > @@ -36,7 +36,11 @@ > namespace_packages=['zope'], > include_package_data=True, > extras_require=dict( > -test=['zope.testing', 'zope.security', 'zope.app.testing'] > +test=[ > +'zope.app.component', > +'zope.testing', > +'zope.security', > +'zope.app.testing'] > ), > install_requires = ['setuptools', > 'zope.annotation', This *can't* be the right fix! (/me checks the tests). Those tests are *terrible*: we should be rewriting them, rather than papering over a completely stupid dependency on zope.app.component. Tres. - -- === Tres Seaver +1 540-429-0999 tsea...@palladion.com Palladion Software "Excellence by Design"http://palladion.com -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFKSSGE+gerLs4ltQ4RAkieAJ4hBsR9MoQ/oVRgOAYIxfH4IeQYRQCgsU4j ioE53ucXAZwYIwBu/3SDm6c= =xEN8 -END PGP SIGNATURE- ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] ZCatalog and indexes cleanup
On 29.06.09 19:33, yuppie wrote:
> Hi Andreas!
>
>
> Andreas Jung wrote:
>
>> On 29.06.09 12:48, yuppie wrote:
>>
>>> 3.) remove security declarations from ZCTextIndex and DateRangeIndex
>>>
>>> All the other indexes don't have security declarations. AFAICS there is
>>> no way to access indexes from untrusted code without having the 'Manage
>>> ZCatalogIndex Entries' permission.
>>>
>>>
>> I think that all index implementation should have security assertions?!
>>
> Why?
>
> '_catalog.indexes' is protected by the underscore and using the
> 'Indexes' alias is protected by 'Manage ZCatalogIndex Entries'. Only
> additional security restrictions would have any effect.
>
> Or am I missing a security hole?
Not sure. I created a catalog /catalog and an index 'my_index'.
Within a debug shell:
>>> app.catalog.Indexes['my_index']
>>> app.unrestrictedTraverse('catalog/Indexes/my_index')
>>> app.restrictedTraverse('catalog/Indexes/my_index')
Traceback (most recent call last):
File "", line 1, in ?
File
"/Users/ajung/sandboxes/Zope-2.11/2.11/lib/python/OFS/Traversable.py",
line 301, in restrictedTraverse
return self.unrestrictedTraverse(path, default, restricted=True)
File
"/Users/ajung/sandboxes/Zope-2.11/2.11/lib/python/OFS/Traversable.py",
line 236, in unrestrictedTraverse
next = guarded_getattr(obj, name)
AccessControl.unauthorized.Unauthorized: You are not allowed to access
'Indexes' in this context
h...
Andreas
begin:vcard
fn:Andreas Jung
n:Jung;Andreas
org:ZOPYX Ltd. & Co. KG
adr;quoted-printable:;;Charlottenstr. 37/1;T=C3=BCbingen;;72070;Germany
email;internet:i...@zopyx.com
title:CEO
tel;work:+49-7071-793376
tel;fax:+49-7071-7936840
tel;home:+49-7071-793257
x-mozilla-html:FALSE
url:www.zopyx.com
version:2.1
end:vcard
___
Zope-Dev maillist - Zope-Dev@zope.org
http://mail.zope.org/mailman/listinfo/zope-dev
** No cross posts or HTML encoding! **
(Related lists -
http://mail.zope.org/mailman/listinfo/zope-announce
http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] ZCatalog and indexes cleanup
Hi Andreas! Andreas Jung wrote: > On 29.06.09 12:48, yuppie wrote: >> 3.) remove security declarations from ZCTextIndex and DateRangeIndex >> >> All the other indexes don't have security declarations. AFAICS there is >> no way to access indexes from untrusted code without having the 'Manage >> ZCatalogIndex Entries' permission. >> > > I think that all index implementation should have security assertions?! Why? '_catalog.indexes' is protected by the underscore and using the 'Indexes' alias is protected by 'Manage ZCatalogIndex Entries'. Only additional security restrictions would have any effect. Or am I missing a security hole? Cheers, Yuppie ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] ZCatalog and indexes cleanup
On 29.06.09 12:48, yuppie wrote: > Hi! > > > I did plan to work on a small catalog improvement, but after looking at > the code I'd like to do some cleanup first: > > > 1.) remove the deprecated TextIndex > > The deprecation warning says: > 'Using TextIndex is deprecated (will be removed in Zope ' > '2.12). Use ZCTextIndex instead.' > > +1 > 2.) remove CHANGES.txt, README.txt and version.txt from Products/ZCatalog > > These files seem to be obsolete. > +1 > > 3.) remove security declarations from ZCTextIndex and DateRangeIndex > > All the other indexes don't have security declarations. AFAICS there is > no way to access indexes from untrusted code without having the 'Manage > ZCatalogIndex Entries' permission. > I think that all index implementation should have security assertions?! > > 4.) add 'indexSize' to IPluggableIndex and implement it where missing > > ZCatalog uses that method and most indexes implement it already. > +1 Andreas begin:vcard fn:Andreas Jung n:Jung;Andreas org:ZOPYX Ltd. & Co. KG adr;quoted-printable:;;Charlottenstr. 37/1;T=C3=BCbingen;;72070;Germany email;internet:i...@zopyx.com title:CEO tel;work:+49-7071-793376 tel;fax:+49-7071-7936840 tel;home:+49-7071-793257 x-mozilla-html:FALSE url:www.zopyx.com version:2.1 end:vcard ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] Schema to JSON
Em Seg, 2009-06-29 às 11:18 +0100, Paul Wilson escreveu: > 2009/6/29 Martijn Faassen > > > > Hi there, > > > > Paul Wilson wrote: > > > I'm about to embark on a module to serialize Zope schemas into the JSON > > > format for my application, taking inspiration from z3c.schema2xml. I've > > > had a look around SVN to see if this functionality has already been > > > implemented but can't find anything - does anybody know whether this has > > > already been done somewhere? > > > > I imagine lazr.restful hides functionality for this somewhere in its > > codebase. Perhaps one way forward would be to extract it? Maybe not, but > > it bears some investigation. > > > Thanks for the hint. I'll take a look. > > > > > > Also, it makes sense in my mind for a schema2xml and schema2json to > > > implement the same interface. How does Zope handle this case? With a > > > format agnostic interface module or something? > > > > I am not sure I understand the proposal. Which interface would be the > > same and why would that be useful? > > I don't want my application to have knowledge of the format that the > object tree will be serialized into - I want that to be a > configuration detail. So, a simple format independent interface (with > serialize and deserialize) would hide this. I was considering > implementing some of the TODOs in the schema2xml package for my json > version, but this would diverge their behaviour enough to spoil my > hopes of switching freely between the two formats. Perhaps I'm looking > at this the wrong way? > > > I think you should just think in terms of what the API should be like > > before you worry about interfaces. (though interfaces are also used to > > look up adapters here). > > I've structured it internally in a very similar way to your schema2xml > package, and shamelessly copied your test cases! :-) > > > > > Sounds like a useful project! > > > > It's in my sandbox at the moment - all tests pass as it stands but it > needs more attention I think. > > Regards, > Paul Nice, I would be interested in helping as well. Perhaps you could open a launchpad project or something? We are planning a new web app using GWT (Google Web Toolkit) as frontend. We already have an application written in Django that spits json to a GWT interface and we are planning a new app based on zope3 (yeah, I did not like django that much, perhaps I should write about this when I get to know zope3 more...) -- Gustavo Matheus Rahal IBM Linux Technology Center ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
[Zope-dev] Zope Tests: 8 OK
Summary of messages to the zope-tests list. Period Sun Jun 28 12:00:00 2009 UTC to Mon Jun 29 12:00:00 2009 UTC. There were 8 messages: 8 from Zope Tests. Tests passed OK --- Subject: OK : Zope-2.10 Python-2.4.6 : Linux From: Zope Tests Date: Sun Jun 28 20:46:44 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012051.html Subject: OK : Zope-2.11 Python-2.4.6 : Linux From: Zope Tests Date: Sun Jun 28 20:48:46 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012052.html Subject: OK : Zope-trunk Python-2.4.6 : Linux From: Zope Tests Date: Sun Jun 28 20:50:46 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012053.html Subject: OK : Zope-trunk Python-2.5.4 : Linux From: Zope Tests Date: Sun Jun 28 20:52:46 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012054.html Subject: OK : Zope-trunk Python-2.6.1 : Linux From: Zope Tests Date: Sun Jun 28 20:54:51 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012055.html Subject: OK : Zope-trunk-alltests Python-2.4.6 : Linux From: Zope Tests Date: Sun Jun 28 20:56:52 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012056.html Subject: OK : Zope-trunk-alltests Python-2.5.4 : Linux From: Zope Tests Date: Sun Jun 28 20:58:53 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012057.html Subject: OK : Zope-trunk-alltests Python-2.6.1 : Linux From: Zope Tests Date: Sun Jun 28 21:00:53 EDT 2009 URL: http://mail.zope.org/pipermail/zope-tests/2009-June/012058.html ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] ZCatalog and indexes cleanup
On 6/29/09 12:48 PM, yuppie wrote: > Hi! > > > I did plan to work on a small catalog improvement, but after looking at > the code I'd like to do some cleanup first: > > > 1.) remove the deprecated TextIndex > > The deprecation warning says: > 'Using TextIndex is deprecated (will be removed in Zope' > '2.12). Use ZCTextIndex instead.' > > > 2.) remove CHANGES.txt, README.txt and version.txt from Products/ZCatalog > > These files seem to be obsolete. > > > 3.) remove security declarations from ZCTextIndex and DateRangeIndex > > All the other indexes don't have security declarations. AFAICS there is > no way to access indexes from untrusted code without having the 'Manage > ZCatalogIndex Entries' permission. > > > 4.) add 'indexSize' to IPluggableIndex and implement it where missing > > ZCatalog uses that method and most indexes implement it already. An API to both get and set 'extras' would be very useful for GenericSetup as well :) Wichert. ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
[Zope-dev] ZCatalog and indexes cleanup
Hi! I did plan to work on a small catalog improvement, but after looking at the code I'd like to do some cleanup first: 1.) remove the deprecated TextIndex The deprecation warning says: 'Using TextIndex is deprecated (will be removed in Zope ' '2.12). Use ZCTextIndex instead.' 2.) remove CHANGES.txt, README.txt and version.txt from Products/ZCatalog These files seem to be obsolete. 3.) remove security declarations from ZCTextIndex and DateRangeIndex All the other indexes don't have security declarations. AFAICS there is no way to access indexes from untrusted code without having the 'Manage ZCatalogIndex Entries' permission. 4.) add 'indexSize' to IPluggableIndex and implement it where missing ZCatalog uses that method and most indexes implement it already. If there are no objections, I'll make these changes on the 2.12 branch and the trunk. Cheers, Yuppie ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] Schema to JSON
2009/6/29 Martijn Faassen > > Hi there, > > Paul Wilson wrote: > > I'm about to embark on a module to serialize Zope schemas into the JSON > > format for my application, taking inspiration from z3c.schema2xml. I've > > had a look around SVN to see if this functionality has already been > > implemented but can't find anything - does anybody know whether this has > > already been done somewhere? > > I imagine lazr.restful hides functionality for this somewhere in its > codebase. Perhaps one way forward would be to extract it? Maybe not, but > it bears some investigation. Thanks for the hint. I'll take a look. > > > Also, it makes sense in my mind for a schema2xml and schema2json to > > implement the same interface. How does Zope handle this case? With a > > format agnostic interface module or something? > > I am not sure I understand the proposal. Which interface would be the > same and why would that be useful? I don't want my application to have knowledge of the format that the object tree will be serialized into - I want that to be a configuration detail. So, a simple format independent interface (with serialize and deserialize) would hide this. I was considering implementing some of the TODOs in the schema2xml package for my json version, but this would diverge their behaviour enough to spoil my hopes of switching freely between the two formats. Perhaps I'm looking at this the wrong way? > I think you should just think in terms of what the API should be like > before you worry about interfaces. (though interfaces are also used to > look up adapters here). I've structured it internally in a very similar way to your schema2xml package, and shamelessly copied your test cases! :-) > > Sounds like a useful project! > It's in my sandbox at the moment - all tests pass as it stands but it needs more attention I think. Regards, Paul ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] A couple of questions about (maybe) missing dependencies
Hello, * 2009-06-29 10:25, Martijn Faassen wrote: > Seems like a bug at first glance. Feel free to add the dependency back > (though I hope we can look into removing it again). I would love to, but I don't have (yet) commit rights on svn.zope.org. :) Thanks, Fabio ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] Schema to JSON
Hi there, Paul Wilson wrote: > I'm about to embark on a module to serialize Zope schemas into the JSON > format for my application, taking inspiration from z3c.schema2xml. I've > had a look around SVN to see if this functionality has already been > implemented but can't find anything - does anybody know whether this has > already been done somewhere? I imagine lazr.restful hides functionality for this somewhere in its codebase. Perhaps one way forward would be to extract it? Maybe not, but it bears some investigation. > Also, it makes sense in my mind for a schema2xml and schema2json to > implement the same interface. How does Zope handle this case? With a > format agnostic interface module or something? I am not sure I understand the proposal. Which interface would be the same and why would that be useful? I think you should just think in terms of what the API should be like before you worry about interfaces. (though interfaces are also used to look up adapters here). Sounds like a useful project! Regards, Martijn ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Re: [Zope-dev] A couple of questions about (maybe) missing dependencies
Hi there, Fabio Tranchitella wrote: > While analyzing the dependency graph of one of our applications, I found > some missing dependencies. I'm not sure these are bugs, but I'd like to ask > your opinion about them: > > - zope.app.publisher does not depend anymore on zope.app.pagetemplate, but >it uses it in src/zope/app/publisher/browser/viewmeta.py >>>> zope.app.pagetemplate.simpleviewclass import SimpleViewClass Seems like a bug at first glance. Feel free to add the dependency back (though I hope we can look into removing it again). > - shouldn't zope.pagetemplate depend on zope.security [untrustedpython]? >it imports it in engine.py: > >>>> from zope.security.untrustedpython import rcompile The same as above, seems like a bug, feel free to add the dependency back, better yet if we can devise a way to really get rid of it. > - I think we should release zope.location (added miss dependency on >zope.deferredimport, it is ok in trunk but not yet released); +1 > - I think we should release zope.sendmail (not it depends on transaction >instead of ZODB3, it is ok in trunk but not yet released). +1 Regards, Martijn ___ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
