Nuxeo Developers Blog

Package for OOo Security Bulletin 2006-06-29

OpenOffice.org 2.0.3 has been announced as out !
(french version is expected in the coming hours)

This announcement provides a security bulletin dealing with 3 potential vulnerabilities detected by internal security audits.

if you can not install this new 2.0.3 version for whatever reason, the issue dealing with java applet can be countered as mentionned on the Java Applets, CVE-2006-2199 dedicated page
(be carefull that other issues remain !!)

The solution proposed works great by deactivating java applets but is not so easy to deploy at large scale or for regular users. So i used the OOo Tools for what they are made for : The UNO Package concept that allow to create great extensions but also deploy configuration settings

So this addon reproduces what is proposed on the CVE page. It works for OOo 2.x as well as OOo 1.x

To deploy under OOo 2.x

• Tools > Package Manager > add and select the zip file
  or
  

• launch <OOoInstall>/program/unopkg <ZipFilePath>

To deploy under OOo 1.x

• launch <OOoInstall>/program/pkgchk <ZipFilePath>

Note that running these command lines with the -s switch (for share) let you deploy the addon for all your users

For testing that the patch has been applied correctly, you can insert an applet (eg. the JavaClock.class can be used for testing purpose) and see if it does not run.

You insert a java Applet though

• Insert > Object > Applet

Once the patch applied, only a drawing with the name of the applet should be displayed and the applet should not run anymore

This check also apply to already created document containing applets

(Post originally written by Laurent Godard on the old Nuxeo blogs.)

Finding the last changed object in a ZODB.

Today I had to figure out why something that should not create a write transaction did create one.

The first step is easy, you pack the database, do the thing that should not modify anything and look in the "undo" tab of your Zope site. There you'll see if something was written or not, it comes up as an undoable transaction.
Then it is a matter of figuring out what happens. In this case, it was quite a complex script with many parts. I wanted to see if I could narrow down the problem by seeing what was actually changed. So, from my lib/python directory, I ran this script:

from ZODB.FileStorage import FileStorage
storage = FileStorage('/path/to/var/Data.fs', read_only=1)
iter = storage.iterator()
try:
    while True:
        transaction = iter.next()
except:
    pass
for rec in transaction:
    print repr(rec.oid)

This prints out the "oids" of all modified objects in the transaction.
Then I can run zope in debug mode:

bin/zopectl debug

When I get the python prompt, I can get the objects that were modified:

app._p_jar['the oid pasted from the previous script']

This allowed me to narrow down the search for the culprit quite a lot. It still remains to figure out where in the code the modification is, but at least with the above you can get a rough idea of what is happening. See also Debugging ZODB bloat which documents roughly this process.

(Post originally written by Lennart Regebro on the old Nuxeo blogs.)

Creating a new Funambol connector

This blog post will be about sharing what I learned around developping Funambol Connector. It is not intended to be complete or a replacement of any Funambol tutorial. However, I'll try to give some tips here to better understand.

Basic documentation

First things firsts, before anything else, you should have a serious look at the Funambol module development tutorial. This will guide you in the creation of a dummy connector. However, this paper is not complete enough for new developers. Thus I'll try to explain some difficult points here.

Take care of which API reference you are reading. The j2se and DS-server APIs are different with similar concepts and names...

Understanding modules

First of all, the tutorial is about modules and not connectors... what's the difference ? In fact a module is a general additionnal component to Funambol which contains one or more connectors.

As you might have understood from the tutorial, the module is composed of several parts:

• The Java sources of you module, of course.
• SQL scripts used for installing and uninstalling the module and connector in the Funambol DS server.
• An optional install/install.xml ant script to run at the installation time
• Dependencies libraries.

There are two things to develop to create a complete connector:

• The Synchronisation source type class, which will access the data.
• The configuration panel that will be shown in the Funambol admin tool for easy configuration of the new synchronization source type.

Why are SQL scripts needed and what are they for ? Funambol is connected to a database describing the connectors and their informations. Thus the informations about your new connector have to be stored in order for it to be used. These informations include the class name of the source type and the one of the panel. There are three possible SQL scripts:

• create_schema.sql, to use if the module needs a custom data schema
• drop_schema.sql, called when uninstalling the module to remove the data
• init_schema.sql, called when installing the module to fill the data

SyncSource interface

The synchronization source type of your connector has to implement the ds-serveur SyncSource interface. These next lines will try to detail what the different methods are for.

Synchronization starting and ending

public void beginSync(SyncContext ctx) throws SyncSourceException;
public void endSync() throws SyncSourceException;
public void commitSync() throws SyncSourceException;

These methods are called to initialize and stop the synchronization. Thes can be used, for example, to start and stop a connection to the source. The commit method will commit the changes made during the synchronization to the source.

Element getters

public abstract SyncItemKey[] getAllSyncItemKeys()
    throws SyncSourceException;

This method will have to return all the items to synchronize in the source. This method is used in the synchronization mode. The result is an array of all the unique keys describing each element.

public abstract SyncItemKey[] getDeletedSyncItemKeys(Timestamp sinceTs, Timestamp untilTs)
    throws SyncSourceException;
public abstract SyncItemKey[] getNewSyncItemKeys(Timestamp sinceTs, Timestamp untilTs)
    throws SyncSourceException;
public SyncItemKey[] getUpdatedSyncItemKeys(Timestamp since, Timestamp until)
    throws SyncSourceException;

These three methods will return the deleted, new and updated items between the since and until timestamps. These methods are used in the fast synchronization mode. The result is an array of all the unique keys describing each element.

public abstract SyncItem getSyncItemFromId(SyncItemKey syncItemKey)
    throws SyncSourceException;

This method returns and item from its key. This is a difference between the client and server SyncSource interfaces: from the server side, using only keys and getting the item at the very last time helps to avoid big memory uses.

Elements setters

public abstract void removeSyncItem(SyncItemKey syncItemKey, Timestamp time, boolean softDelete)
    throws SyncSourceException;
public abstract SyncItem updateSyncItem(SyncItem syncInstance)
    throws SyncSourceException;
public abstract SyncItem addSyncItem(SyncItem syncInstance)
    throws SyncSourceException;

These methods will remove, add and update items in the source. The returned sync item correspond to the inserted or updated item. The update and add methods should solve the conflicts between the items that is already present on the server and the one that is about to be added or updated.

Extra methods

public abstract SyncItemKey[] getSyncItemKeysFromTwin(SyncItem syncItem)
    throws SyncSourceException;

This method returns the twin items keys, i.e. the keys of the items that are considered as identical. This notion of identical items is defined in this method.

public abstract void setOperationStatus(String operationName, int status, SyncItemKey[] keys);

This method is called by the DS-server to notify the status of an operation. The operation name can be either one of "Add", "Replace" or "Delete".

Configuration panel implementation

To create a new source configuration panel, you will need to extend the SourceManagementPanel class. The only thing to know here is to set the following properties into your synchronization source when clicking on the validation button. The validation method should contain the following skeleton:

if (getSyncSource() instanceof JCRSyncSource) {
          
        JCRSyncSource source = (JCRSyncSource)getSyncSource();
        source.setSourceURI(uriText.getText().trim());
        source.setName(nameText.getText().trim());
        source.setType(typeText.getText().trim());

        // TODO set your source specific values

        ContentType[] contentTypes = new ContentType[] {
            new ContentType("text/plain", "1.0")  
        };
        source.setInfo(new SyncSourceInfo(contentTypes, 0));
}

You just have to replace the TODO comment by lines setting the specific values to your source. Of course, you need to replace the JCRSyncSource class by your SyncSource class.

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

My first URE Component in Java

How to create a new URE based application ? The documentation is quite hard to find, but the main important thing is: create a UNO component implementing the com.sun.star.lang.XMain interface. This one will contain a method run() I'll explain how to create a "Hello URE World" application.

The project will be organized in the following way:

• idl diretory containing the application UNOIDL specifications
• source directory containing the implementation of the UNOIDL types
• program directory which will contain the application registries and libraries
• MANIFEST.MF file which will describe the registration class of the component
• Makefile file to make the build much easier
• unotest file to launch the newly created application
  

UNOIDL file definition

The file idl/org/unotest/Main.idl will describe a simple service org.unotest.Main exporting the XMain interface this gives the following code:

   module org { module unotest {
       service Main: com::sun::star::lang::XMain {
         create ();
       }
   }; };

Note that this service is a new style one: defining constructors and exporting a single interface.

Java implementation

Now just create a org.unotest.comp.MyMain Java class in the source/org/unotest/comp/MyMain.java file. This class will implement the following three methods:

      public int run (String[] arguments) {
         // Printing Hello URE World ;) and exit
         System.out.println("Hello URE World ;)");
         return 0;
      }

  __getServiceFactory(...) and __writeRegistryServiceInfo(...) are used for the component registration. They implementation is fully described in the chapters 4.5.3 and 4.5.4 of the OpenOffice.org Developer Guide

Generation of the component

The component generation works like the OpenOffice.org components generation, however there are some tricky things to know:

• use the URE regmerge and regcomp tools. Otherwise you will get some Loader exceptions when trying to use regcomp on your component.
• do not put your class files directly in your current directory: this is a new issue that will be corrected. If you do not respect this advice, the regcomp tool will use the class files in your current directory before the one in your jar file.

In our unotest case, the build instructions are written in the Makefile. It should use the following tools:

1. idlc -Ourd -I$(SDK_HOME}/idl idl/org/unotest/Main.idl
2. $(URE_HOME)/bin/regmerge program/types.rdb UCR urd/Main.urd
3. javamaker -Torg.unotest.Main -BUCR program/types.rdb -X$(URE_HOME)/share/misc/services.rdb -X$(URE_HOME)/share/misc/types.rdb
4. javac -d . -cp $(CLASSPATH) source/org/unotest/comp/MyMain.java
5. jar cfm program/unotest.uno.jar MANIFEST.MF org/unotest/compMyMain.class org/unotest/Main.class
6. rm -Rf org
7. $(URE_HOME)/bin/regcomp -register -br $(URE_HOME)/share/misc/types.rdb -br $(URE_HOME)/share/misc/services.rdb -r program/services.rdb -c file://$(PWD)/program/unotest.uno.jar -classpath $(CLASSPATH)

What will these commands do ?

1. Compile your UNOIDL specification to create the urd/Main.urd registry
   
2. Merge the generated urd file in the program/types.rdb registry
3. Create the org/unotest/Main.class file
4. Compile your java implementation of the service
5. Create the jar file of the component
6. Delete the unused class files to avoid problems with regcomp
7. Register the component in the URE

Launching the application

In the unotest file, you just have to put a call to the uno tool contained in the URE:

   $URE_HOME/bin/uno -c org.unotest.comp.MyMain \
                     -l file://`pwd`/program/unotest.uno.jar \
                     -ro program/services.rdb \
                     -ro program/types.rdb \
                     -ro $URE_HOME/share/misc/services.rdb \
                     -ro $URE_HOME/share/misc/types.rdb

Thus when launching the unotest file, you will launch the URE with you org.unotest.comp.MyMain as the main class to load at the beginning. This will print you the expected "Hello URE World ;)"

The next step is to do the same with a C++ component... but I'm still working on it.

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

UNO Component for URE test.

I have written an example of URE application just saying Hello URE world in two languages: C++ and Java.
To run this example you will need an UNIX environment, that is to say a UNIX or an emulation like cygwin. It uses the following tools:

• GNU Make
• G++ 3.3
• OpenOffice.org 2.0 SDK
• URE installed in /opt/openoffice.org/ure/

Howto run the example ?

You just have to launch make to build the component. Launch unotest to run the URE starting with the C++ implementation and the Java one. To clear the directory, use make purge.

How does it work ?

This example is the one given in this post of my blog. It has been completed by a C++ implementation. The principle in C++ is the same than in Java: the major problem is the compilation chain. You can study it by reading the content of the makefile contained in the archive. To understand the makefile syntax, please refer to this page.

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

A UNO-URE exercise

I just have completed to write and document a small exercise to learn the basis for C++ URE based applications. Just get the joint archive and look at the README file for the instructions.
In the archive you will find: the correction, the question and the makefile for the build. In a few words, the exercise consists in writing the specifications and implementation of an application using a Banker and a Customer asking for money. Completing the exercise without looking at the answer takes approximatly working 2 or 3 days ;)

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

MS Office XML format not so clear

Yesterday, in a meeting at school, I could clearly see what could prevent us to consider MS Office XML file as open.

• There is a processing directive at the beginning of the Word document saying: "it's a word document". This could be interpreted by the XML parser to do what it want's wihtout we know it.
• To our surprise, there are some XML namespaces where the URN is no. This means obviously that the format is not fully known by a customer.

I have an answer now for people saying me that MS Office XML is open... XML doesn't necessary mean open !

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

OOEclipse Integration isn't dead

A new version

I have released a new version (1.0.1) of the Eclipse plugin to support OpenOffice.org development. Here are the changes from the previous release:

• a new UNO-IDL interface wizard
• the new UNO project wizard was extended with the new service wizard as a second page
• definition of default values in the wizards
• build bug fixed (was just a workspace refreshing problem)

Important: The plugin doesn't work with the gij and gcj

Getting the new version

• Sources available on the api/ooeclipseintegration CVS
• Add http://cedric.bosdonnat.free.fr/ooeclipseintegration as an Eclipse update site.
  

What's next ?

• C++ language support: This mainly includes the cppumaker use
• detection of the Eclipse available plugins to configure the wizards/li>
• complete the code documentation and the user help
• update of the Cheat Sheets
• fix some configuration bugs.

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

Creating an URE application in C++

I just have finished to write a tutorial on how to create a simple C++ application based on the URE. This paper is written for URE and UNO beginners and might be missing some important informations.

I would really appreciate every return to modify this tutorial and make it better: it may be a tool to spread UNO around the world. The tutorial is refering to an article I wrote earlier: " A UNO/URE exercise". See the attached link to get the tutorial itself.

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)

Handling GStreamer throught UNO

Big news, I have a first working version of an UNO component to handle GStreamer from UNO code. This will allow using gstreamer features within UNO framework such as macro but also Java, c++ or pyUNO programs.

This component has many advantages for OpenOffice.org: it uses a free multimedia framework, and provide an API. This API has to be extended and doesn't give access to every GStreamer feature.

The component is described on my personnal website where you can download the OpenOffice.org package to install as well as a sample Basic macro playing an Ogg file.

Of course this is still under development, and may not work in some cases. However, every feedback is welcome.

Many thanks to Laurent Godard who help me to debug and test the component

(Post originally written by Cedric Bosdonnat on the old Nuxeo blogs.)