http://blog.gmane.org/gmane.comp.web.zope.plone.remember hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://comments.gmane.org/gmane.comp.web.zope.plone.remember/913 <pre>Hi, I have just released membrane 2.1.4, with a fix by Craig Haynal: False user property values were being converted to empty strings which would cause the property sheet to treat them as strings and make it impossible to set these properties back to True. Thanks Craig! </pre> Maurits van Rees 2012-04-13T11:34:47 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/902 <pre>Hey, all. There's an increasing trend to migrate Plone products from the Plone subversion repository to GitHub, which will only be accelerated by the recent shutdown of the plone.org SVN browser service. I would like to make the Products.remember migration happen, soon, and have scoped it out so it should be easy to do. I believe the result of the migration would be that the trunk in the plone.org svn repo would be replaced by a note, indicating the new location on GitHub, so ongoing development and new releases would be done via GitHub. The current branches and tags would still be accessible in the svn repo, however, so production checkouts wouldn't break. See the http://collective.github.com web page for info about the Plone collective on GitHub. (From the bit I've done with GitHub, it seems to be an outstanding source code management platform, with a somewhat more elaborate but substantially improved workflow compared to the svn service.) Any objections to the migration? I need to do the migration soon, before I get swamped in other work. Ken -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2012/02/1328139029680 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> ken manheimer 2012-02-01T23:30:13 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/894 <pre>Hi list, In the wake of the security release of Products.membrane from yesterday I fixed a similar problem in Products.remember, also indicated by Richard Mitchell, thanks. The security problem is this: anonymous users could get the password hash of a remember member. It is not an immediate problem, but it sure makes it easier to crack passwords. I have made three releases with this fix on PyPI, 1.1, 1.2, 1.9, all listed here: http://pypi.python.org/pypi/Products.remember 1.1 is the old 1.1b3 release from 2009 with the security fix added. Use this when you were using that release and do not want a big upgrade. Compatible with Plone 3.x and Products.membrane 1.1. Definitely NOT with Plone 4 or Products.membrane 2.x. 1.2 has more changes; see the changelog. It has the changes that were done on trunk before Ken started doing bigger changes leading to the 1.9 series. Compatible with Plone 3 and Products.membrane 1.1 or 2.x (2.1.1 recommended). Might work on Plone 4 but the automated tests say otherwise; that might just be a problem with the tests though. 1.9 is the obvious choice when you were already running 1.9b1. Compatible with Plone 4.x and Products.membrane 2.x (2.1.1 recommended). Like always: make a backup of your Data.fs (and blobstorage if you have it) before applying this upgrade and make sure you know how to restore that backup and the previous software versions in case anything goes wrong. And do some testing on a copy of your site first. Got a question? Ask it on this list. Note for developers of Products.remember: I have made branches 1.1 and 1.2 that can be used in case new releases need to be made in those lines. New developments are likely to only happen on trunk (1.9), though I myself have no current plans. If anyone wants to fix the 1.2 branch (or perhaps just the tests) so the tests run on both Plone 3 and 4, be my guest. All branches and trunk have a buildout.cfg for testing. Kind regards, </pre> Maurits van Rees 2011-12-02T14:00:16 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/890 <pre>Hi all, Richard Mitchell has responsibly disclosed a security vulnerability in Products.membrane, reported to the maintainers he could track down. Thanks! The vulnerability is an information disclosure. An anonymous user could for example get the e-mail address of a membrane user or his password. Normally that should only be a hashed password, like is the case when you use Products.remember. So it should usually be no big deal, but it is certainly better not to give away such a hash in the first place. Use Products.membrane 2.1.1 when you are on Plone 3.3 or 4.x: http://pypi.python.org/pypi/Products.membrane/2.1.1 Use Products.membrane 1.1 when you are on any Plone 3 version: http://pypi.python.org/pypi/Products.membrane/1.1 The 1.1 version is basically the old 1.1b5 release from early 2009 with an uninstall profile added plus this security fix. If you are currently a happy user of 1.1b5 and are scared of a sudden big version increase to 2.1.1 then version 1.1 is a safe upgrade. Like always: make a backup of your Data.fs (and blobstorage if you have it) before applying this upgrade and make sure you know how to restore that backup and the previous software versions in case anything goes wrong. And do some testing on a copy of your site first. Got a question? Ask it on this list. Kind regards, </pre> Maurits van Rees 2011-12-01T20:17:56 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/889 <pre>Hi, Can someone grant me rights to release new versions on http://pypi.python.org/pypi/Products.remember and preferable plone.org as well: http://plone.org/products/remember ? I have already asked Ken and Ross but got no answer yet, and I have no correct email address from Rob Miller. I hope you are still reading this list, Rob. :-) I have prepared some tags for a security fix (information disclosure). For the same reason I have already created and released new versions of Products.membrane. I will write about that soon. Cheers, </pre> Maurits van Rees 2011-12-01T19:58:51 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/886 <pre>hi, all I have custom product based on Products.remember. It provides three types extended BaseMember.  After migration site content via portal_migration tool i have a clean portal_memberdata, without any members. There are no errors and seems no warnings during migration. My custom product works fine after migration. Only members data have been lost. How make migration properly? Versions of products: Plone 4.0.9 Products.remember 1.9b1 Products.membrane 2.1.0 Products.FacultyStaffDirectory 3.0 Irina -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2011/11/1321967074229 To unsubscribe send an email with subject "unsubscribe" to remember&lt; at &gt;lists.coactivate.org. Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Бессарабова Ирина 2011-11-22T13:04:31 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/885 <pre>Hi, A client has a 3.3.5 site with remember-based members. I was asked to create a second remember-based content type which I have done. Now I must convert some of the existing members to the new type. For each member, my plan is: * rename the existing profile * create a new profile with the same id * copy old data to new profile * delete old profile * reset password of new profile Is there any other way that is less disruptive to the users? Regards Mike -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2011/07/1311950040493 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Mike Metcalfe 2011-07-29T14:33:52 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/884 <pre>hi guys, just stumbled upon the collective.indexing upgrade (2.0a1) which removed all the setup profiles. But Products.membrane requires the default profile in setuphandlers.py ... so my quick solution was to pin collective.indexing=1.8 ... and everything is fine again. maybe someone wants to look at the membranes setuphandlers to work with collective.indexing&gt;=2.0 cheers -- Archive: http://coactivate.org/projects/remember/lists/remember/archive/2011/07/1310562026622 To unsubscribe send an email with subject "unsubscribe" to remember&lt; at &gt;lists.coactivate.org. Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Peter Mathis 2011-07-13T13:00:26 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/881 <pre>hi, all. i've checked a bunch of substantial Products.remember changes into the products.remember trunk&lt;http://svn.plone.org/svn/collective/Products.remember/trunk/&gt; (svn browser&lt;https://dev.plone.org/collective/browser/Products.remember/trunk/&gt;), including: - an uninstall method that enables proper operation of non-remember accounts - prevention of disruption that Products.remember used to cause to portals that didn't have the product quick-installed - email login id that is controlled by the standard Site Setup / Security / "Use email address as login name" setting - Plone 4/membrane 2 compatibility (i think i checked that in and announced it a while back) i'm running out of time to do much more, but am hoping to find a window to release it to pypi in the next few days. the HISTORY.txt has many more details about the changes. ken manheimer -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2011/06/1307220145801 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> ken manheimer 2011-06-04T20:42:09 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/878 <pre>I'm cleaning up Products.remember, and want to make the way it changes the Site Setup Users and Groups (&lt; at &gt;&lt; at &gt;usergroup-userprefs) configlet less disruptive. In general, can products substitute different page templates for standard Site Setup configlets without permanently changing it for all portals in the zope instance? The latter is what Products.remember is currently doing, replacing the standard usergroup-userprefs template with its own via an overrides.zcml. There are two big problems with this - it affects all the portals in the Zope instance, whether or not Products.remember is quick-installed, and it is permanent, lasting after Products.remember has been removed entirely from the system. Since I don't know why that approach was taken, i'm unsure about whether less disruptive approaches would work. Don't products sometimes have to offer different versions of standard control panel configlets? What's the right way to do it? Guidance would be greatly appreciated! I've checked in several Products.remember fixes to the collective, including Plone 4 and Products.membrane 2 compatibility, integration of someone else's email-login provisions, a substantial part of uninstallation, and more. This, plus an upgrade step to undo the effects of the overrides.zcml, are the main obstacles i'm facing before packaging up the changes for release. Ken Manheimer -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2011/05/1306432078173 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> ken manheimer 2011-05-26T17:47:42 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/877 <pre>Hi, I am working on a dexterity package that has behaviors and a content type that implement the membrane interfaces. See here: https://svn.plone.org/svn/collective/dexterity.membrane/trunk Feel free to hack on it. The README.txt is informative so please read it. Note that this is for Plone 4.1. </pre> Maurits van Rees 2011-05-04T01:07:16 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/872 <pre>Hi, I did a few fixes on membrane trunk recently for better Plone 4.1 compatibility (tests pass on 3.3, 4.0 and 4.1) and for using dexterity content as membrane objects (deleting them no longer leaves a stale brain in the membrane_tool catalog). Any chance of a 2.0.2 release? Or some more eyeballs on those changes. Thanks, </pre> Maurits van Rees 2011-04-26T11:40:16 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/871 <pre>hi, all. i'm working towards releasing a version of Products.remember that works in Plone 4 and with Products.membrane v2, as well as some other fixes. i have a working version that is near release, but without proper uninstall. i was able to merge the elro-uninstall branch&lt;https://dev.plone.org/collective/browser/Products.remember/branches/elro-uninstall&gt; with my version, but it doesn't work. the problem may be a plone3/plone4 issue, but i don't have time to sort it out. does anyone out there have some time to work on getting Products.remember uninstall under plone 4 properly operational? i've created a branch with my changes and elro-uninstall merged&lt;https://dev.plone.org/collective/browser/Products.remember/branches/klm_trackm2_and_elro-uninstall&gt; to use as a reference, in case that would be helpful. like my version without elro-uninstall&lt;https://dev.plone.org/collective/browser/Products.remember/branches/klm_track-membrane2&gt;, it works under plone 4 with membrane v2, but uninstall fails with a traceback. (uninstall doesn't fail in my version without elro-uninstall, but, as was discussed on this list not too long ago, the uninstall is not complete.) contributed uninstall fixes need not be based on elro-uninstall, i'm just assuming that may be a good start. you can see my branch, without elro-uninstall, here&lt;https://dev.plone.org/collective/browser/Products.remember/branches/klm_track-membrane2&gt;- i've tested and use it with Products.membrane 2 under plone 4.0 and plone 4.0.3. i'll be posting followups here soon asking for help trying it out, when it's ready, before releasing to pypi. please let me know if you are going to work on it. i think that Products.remember is valuable, and hope to get it back to viability with a released version that works in plone 4 and with membrane 2. uninstall capability seems essential, but won't have time to work on it, myself, any time soon. ken manheimer ken.manheimer-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2011/03/1299793718285 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> ken manheimer 2011-03-10T21:48:21 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/870 <pre>Hi, I have been using remember and membrane for quite a while but we decided to not use it in the newer version (based on Plone 4) so I'm trying to remove it from Zope. I'm not a rock star Plone hacker so that's why I'm asking for help. Everytime I try to remove all traces of remember &amp; membrane prior to removing them from the buildout and afterwards switching to Plone 4 to migrate the Data.fs it fails with this stacktrace: 2011-01-31 18:01:08 ERROR Zope.SiteErrorLog 1296493268.780.134499934394 http://localhost:8080/plone Traceback (innermost last): Module ZPublisher.Publish, line 116, in publish Module ZPublisher.BaseRequest, line 434, in traverse Module ZPublisher.BeforeTraverse, line 99, in __call__ Module Products.CMFCore.PortalObject, line 78, in __before_publishing_traverse__ Module zope.event, line 23, in notify Module zope.component.event, line 26, in dispatch Module zope.component._api, line 138, in subscribers Module zope.component.registry, line 323, in subscribers Module zope.interface.adapter, line 575, in subscribers Module zope.component.event, line 33, in objectEventNotify Module zope.component._api, line 138, in subscribers Module zope.component.registry, line 323, in subscribers Module zope.interface.adapter, line 575, in subscribers Module plone.browserlayer.layer, line 14, in mark_layer Module zope.component._api, line 181, in getAllUtilitiesRegisteredFor Module zope.component.registry, line 178, in getAllUtilitiesRegisteredFor Module ZODB.Connection, line 838, in setstate Module ZODB.Connection, line 906, in _setstate Module ZODB.serialize, line 630, in setGhostState Module zope.component.persistentregistry, line 42, in __setstate__ Module zope.interface.adapter, line 85, in _createLookup Module zope.interface.adapter, line 429, in __init__ Module zope.interface.adapter, line 466, in init_extendors Module zope.interface.adapter, line 470, in add_extendor AttributeError: type object 'IUserAdder' has no attribute '__iro__' I removed the acl_users plugins, the portal_memberdata (an its contents) the portal_registration, the membrane_tool, the types created on portal_types ... but it seems it isn't enough to remove remember &amp; membrane. I also found a utility installed: from Products.membrane.interfaces import IUserAdder sm = app.plone.getSiteManager() util = sm.queryUtility(IUserAdder, name='remember') But even removing it doesn't solve my problem. Any remember &amp; membrane rock star out there can help me? Cheers, </pre> Gil Forcada 2011-01-31T18:08:41 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/859 <pre>I have an older site, Plone 2.5.5 running membrane1.0 and remember 1.0b1. It is a school newspaper site, so each year a couple of new students join the staff and few graduate. I can't delete the students who have graduated as the school wants to keep their work archived on the site. I set up a workflow for content and have an archive state, so only this year's content is displayed, and the archived content is in another folder. However, I don't have a way to disable the user accounts for the students who have graduated. I am looking for an easy way to disable logins to these accounts, but still preserve the content and the fact that John wrote these articles, and Samantha wrote these articles, even though they cannot login anymore. I guess I would need a way to "un-disable" an account, in case I disable the wrong one...;-) I have googled for a possible solution and searched this list, but I can't find anything under "disable member" and similar patterns. Thanks for any suggestions you may have! Mark -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2011/01/1295453339470 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Mark Phillips 2011-01-19T16:08:58 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/856 <pre>I have a vanilla Plone 2.5.5 site with members already established. I want to convert it to remember/membrane and a modified member join workflow. How do I migrate the current member to remember/membrane? I read the README in the cmfmember folder of remember, but it talks about Plone 2.1, so I am not sure if I need to follow those instructions or not or what part of them. Is there a document somewhere that talks about migrating a Plone 2.5.5 site to remember/membrane? Thanks! Mark -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2010/10/1287592701176 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Mark Phillips 2010-10-20T16:27:21 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/856 <pre>I have a vanilla Plone 2.5.5 site with members already established. I want to convert it to remember/membrane and a modified member join workflow. How do I migrate the current member to remember/membrane? I read the README in the cmfmember folder of remember, but it talks about Plone 2.1, so I am not sure if I need to follow those instructions or not or what part of them. Is there a document somewhere that talks about migrating a Plone 2.5.5 site to remember/membrane? Thanks! Mark -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2010/10/1287592701176 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Mark Phillips 2010-10-20T16:27:21 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/855 <pre>Hi all, We have been working hard this week at Penn State on a new, dexterity-based version of FacultyStaffDirectory. All has gone reasonably well so far. I've been working on integrating membrane functionality for our base dexterity content types and I have a couple of questions, and one notification. Question #1. Although the current documentation does not indicate this, it appears that collective.indexing is a hard requirement for indexing. Is this true? Question #2. Even after adding collective.indexing to our buildout, groups were not being indexed by the membrane tool, we looked at the code for the MembraneCatalogProcessor in catalog.py and it appears that the code which determines if a content object should be indexed into the membrane catalog only checks for user objects, not groups. This would seem to mean that no non-AT-based groups will ever be indexed by the membrane catalog. Is this a correct reading? Announcement: Assuming that our reading of the MembraneCatalogProcessor code is correct, we've fixed this problem in a branch we call 'cewing-addgroupindexing'. I'd appreciate it if someone could look that fix over and if it is acceptable, merge it to trunk. It's a pretty small diff. Wichert, I think you're running the show now, can you do that? It'd be especially nice if this change made it into any upcoming new releases of membrane, since dexterity-based groups are also desirable. Thanks for your attention, Cris ******************************** Cris Ewing Webmaster, Lead Developer Department of Radiology Web Services University of Washington School of Medicine Work Phone: (206) 616-1288 Cell Phone: (206) 708-9083 E-mail: cewing&lt; at &gt;u.washington.edu Web: http://www.rad.washington.edu ******************************* -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2010/10/1287172020293 To unsubscribe send an email with subject "unsubscribe" to remember&lt; at &gt;lists.coactivate.org. Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Cristopher Ewing 2010-10-15T19:44:44 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/831 <pre>Plone 3.2.1 / remember 1.1b1 First, I hope I got this address right. Its been a while since I used this list. Apologies if I messed up! I use remember to permit self-registration with approval on a series of team sites for my company. Today, we noticed that the memberdata folder is exposed to anonymous users if you know the direct url to it. Of course, google has found it, so when searching for the name of some of the registered members, the memberdata page shows up, along with a portal showing all of the users and their email info. That wasn't horrible, but the search box is available, and while you cannot actually see content, search will show titles / links for much of the site content. Does anyone have any ideas about what's going on? I can't find any security settings in the ZMI that seem to affect this. Also, I can't blame this on Remember with 100% certainty, although the memberdata folder seems to be a membrane/remember item, right? Thanks! Gray McCord Adapt, Mutate, Migrate, or Die -C. Darwin </pre> Gray McCord 2010-09-24T19:01:59 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/825 <pre>Hi, I see that membrane now runs on Plone4 - anyone know if and when remember will? Mike -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2010/09/1283585101488 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Mike Metcalfe 2010-09-04T07:25:00 http://comments.gmane.org/gmane.comp.web.zope.plone.remember/824 <pre>I've tagged and uploaded membrane 2.0b1. The sphinx documentation is now available at http://packages.python.org/Products.membrane/, and I have updated the homepage URL in the package metadata to point there. Wichert. -- Archive: http://www.coactivate.org/projects/remember/lists/remember/archive/2010/08/1283244671756 To unsubscribe send an email with subject "unsubscribe" to remember-81qHHgoATdGNjXQcXLqYpFN6ohzGQtmt&lt; at &gt;public.gmane.org Please contact remember-manager-81qHHgoATdGNjXQcXLqYpGD2FQJk+8+b&lt; at &gt;public.gmane.org for questions. </pre> Wichert Akkerman 2010-08-31T08:51:09 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.comp.web.zope.plone.remember