Re: [Zope-dev] App.Permission security hole

2003-05-29 Thread Shane Hathaway
Jamie Heilman wrote: Tooling through restructuring of my site I discovered a stupid permissions problem. While App.Permission declares the 'Define permission' perm it never gets initialized and thus manage_addPermission{,Form} basically had weakened security. The permission 'Access contents

Re: [Zope-dev] manage_addZClass* permission question

2003-05-29 Thread Shane Hathaway
Jamie Heilman wrote: I can't fathom the ZClass code. Can somebody tell me if manage_addZClass, manage_addZClassForm, and manage_subclassableClassNames are supposed to be protected by the 'Add Zope Class' permission, or if the code in ZClasses/__init__.py is pure fluf? That permission never shows

Re: [Zope-dev] The Return of the Son of Session Errors, redux

2003-05-29 Thread Chris McDonough
On Wed, 2003-05-28 at 04:54, Jean Jordaan wrote: Hi all We're being chowed heavily by the KeyError discussed from the 13th to the 18th March in this thread: http://mail.zope.org/pipermail/zope-dev/2003-March/019081.html Has there been any definite resolution of that issue? We're

Re: [Zope-dev] manage_addZClass* permission question

2003-05-29 Thread Jamie Heilman
Shane Hathaway wrote: It is. Older Zope code uses the manage_ prefix to require the Manager role by default. Needless to say, that strategy did not cope well with later enhancements to Zope. OK. So what about the stuff in ZClasses/__init__.py, pure fluf? After yesterdays App.Permission

Re: [Zope-dev] The Return of the Son of Session Errors, redux

2003-05-29 Thread Dieter Maurer
Jean Jordaan wrote at 2003-5-28 10:54 +0200: ... Session Errors ... Our errors are triggered in the bowels of XMLWidgets What have session errors to do with XMLWidgets? Dieter ___ Zope-Dev maillist - [EMAIL PROTECTED]

Re: [Zope-dev] WebDAV File Descriptor Leak

2003-05-29 Thread Dieter Maurer
Andreas Jung wrote at 2003-5-27 18:11 +0200: Can you reproduce the behaviour with 2.6.2? We have the same problem with 2.6.1 without WebDAV. Thus, the problem is probably not WebDAV related (but rather related to file uploading). Dieter ___

Re: [Zope-dev] ZEO install/runtime issues

2003-05-29 Thread Dieter Maurer
Jeremy Hylton wrote at 2003-5-27 14:38 -0400: ... The problem with sharing software is that the ZEO server can load arbitrary modules when it attempts to perform conflict resolution. If there is a conflict for an instance of class A.B.C, then ZEO will load A.B.C and see if it has an

[Zope-dev] [CRITICAL] Conflict Errors, Transactions, Retries, Oh My....

2003-05-29 Thread Jeffrey P Shell
I need to know more about Conflict Errors. We're running into a lot of them lately, it seems, on production Zope 2.6.1 sites (running on FreeBSD). The primary culprit seems to be Temporary Storage/Sessions. Something that has happened, and is causing a small amount of alarm, is that a large

Re: [Zope-dev] [CRITICAL] Conflict Errors, Transactions, Retries,Oh My....

2003-05-29 Thread Chris McDonough
On Wed, 2003-05-28 at 21:33, Jeffrey P Shell wrote: Something that has happened, and is causing a small amount of alarm, is that a large method that interfaces to external non-transactional systems seems to (on occasion) send their information off to that external system twice, but

Re: [Zope-dev] ZEO install/runtime issues

2003-05-29 Thread Richard Jones
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday, May 28, 2003, at 04:38 AM, Jeremy Hylton wrote: [Please followup to zodb-dev.] You made some changes to the mkzeoinst.py script in April. I was busy then, and I've just had a chance to look at the changes now. I'd like to discuss some

Re: [Zope-dev] [CRITICAL] Conflict Errors, Transactions, Retries, Oh My....

2003-05-29 Thread Jeffrey P Shell
On Wednesday, May 28, 2003, at 10:19 PM, Chris McDonough wrote: This doesn't happen often, but (as stated), this is a critical operation that needs to be better protected. All other exceptions and bits and pieces in the block of code in question has been tested thoroughly and we have not had

Re: [Zope-dev] The Return of the Son of Session Errors, redux

2003-05-29 Thread Jean Jordaan
Dieter Maurer wrote: What have session errors to do with XMLWidgets? XMLWidgets stores the state of the document that you're editing in the session. We don't want to hack and fork XMLWidgets, so we're not in a position to change the way it uses the session. -- Jean Jordaan

Re: [Zope-dev] The Return of the Son of Session Errors, redux

2003-05-29 Thread Jean Jordaan
Hi Chris I just checked in a change that disables the low conflict connection feature of temporary storage. We've patched, and so far it looks good. We've seen one KeyError, but that was after leaving the session to expire. Will 2.6.2 get the patch? Thanks! -- Jean Jordaan

Re: [Zope-dev] The Return of the Son of Session Errors, redux

2003-05-29 Thread Chris McDonough
On Thu, 2003-05-29 at 07:56, Jean Jordaan wrote: Hi Chris I just checked in a change that disables the low conflict connection feature of temporary storage. We've patched, and so far it looks good. We've seen one KeyError, but that was after leaving the session to expire. Will 2.6.2 get