Zope 2.4 Migration Guide (Beta 1)

This document is intended to note some of the important changes for Zope 2.4 and to answer some common questions of Zope users and developers.

The focus of the Zope 2.4 release has been the move to using Python 2.1 as the basic platform, so many of the issues addressed here are related to the effects of that change.

Zope 2.4 Requires Python 2.1

As of the Zope 2.4 release, Zope required Python 2.1 or greater. Binary distributions will come with a 2.1 Python. If you try to run Zope 2.4 with an older version, you will get an error message from the start script as a reminder.

**Modules regex and ts_regex are deprecated**

Prior to 2.4, Zope still contained quite a bit of usage of the regex, regsub modules (as well as custom versions made thread safe for Zope such as ts_regex). The regex and regsub modules are deprecated in Python 2.1 and will produce warnings if you import or use them.

As of Zope 2.4, the Zope core has been converted to use re instead of the old modules, and should produce no warnings. Many third party Zope components will likely still use the old modules, which may produce warnings when Zope is started. Third-party component authors are encouraged to convert their code to use re, as a future Python release (which Zope will move to eventually) will do away with regex and regsub altogether.

Python Unicode Support

One of the biggest changes in Python 2.x is the introduction of unicode support. This is a potentially big area, and we have intentionally chosen to proceed carefully on this for Zope.

Since Zope 2.4 runs on Python 2.1 you can now use unicode in Python, though Zope 2.4 will not provide any particular support for unicode (this will be done in the future). The Zope object database has no problem dealing with unicode, so it is safe for third-party developers to use unicode in products.

The main caveat regarding unicode is regarding Zope C extensions. None of the current C extensions have been modified to provide any special handling of unicode, which may restrict what you can expect to do with unicode in some cases. Some examples of this are the Splitter module used by the Catalog, or code that depends on using the cStringIO module.

New Restricted Execution Model

Some of the updates in Python 2.1 provided an opportunity to unify the "restricted execution" machinery used for "through the Web code" such as DTML and Python Scripts. Zope 2.4 uses a new RestrictedPython package to handle restricted code that will make the restrictions on TTW code more consistent, robust and maintainable.

The new restricted execution model is invisible from the users point of view. It is mentioned here just in case there are any third-party component developers whose code has dependencies on the details of the previous restricted execution implementation.

Python 2.1 Garbage Collector

Most Zope instances are instances of ExtensionClasses, which have not been updated to support the new Python 2.1 garbage collector. That does not mean that you cannot turn GC on, just that (as a product developer) you cannot currently count on GC to save you from circular references.

Zope 2.4 works with the new GC enabled or disabled, though the choice you make may have some impact on performance characteristics. The actual performance impact is not yet clear - some preliminary testing shows that the impact of having GC on or off may be either good or bad depending on what is being tested (how's that for scientific?).

At this point we are not making a strong recommendation one way or the other about whether GC should be turned on until we have a clearer picture of the performance characteristics.

New Syntax Support

Python 2.1 includes a number of new syntax elements since 1.5.2. All of the new syntax should work as expected in DTML expressions, Python Scripts and other "through the web" code objects.

A note to component developers - as of Zope 2.4 ExtensionClass has not been updated to support all of the new "magic protocols" that Python classes support (we're hoping that EC will go away soon).

For example, ExtensionClass does not support the new "augmented assignment" (+=, *=, etc.) magic protocol, which means that ExtensionClass subclasses cannot currently support __iadd__, __isub__, etc. This is not expected to be a big issue in practice. The same has been true of the "right-hand operator" protocols (__radd__, __rsub__, etc.) for some time now.

New WebDAV Access Permission

A number of people have expressed a desire to prevent exposing the structure of a site via WebDAV when they are not using any of the WebDAV functionality. Until Zope 2.4, this was not possible because the mechanisms used to generate WebDAV listings was protected by the "Access contents information" permission. That meant that it was not possible to turn off DAV browsing by anonymous users without removing that permission (which often made other use of the site impossible as a result).

Zope 2.4 introduces a new "WebDAV Access" permission that controls the ability to browse sites via WebDAV. Removing this permission for a role effectively prevents PROPFIND requests, making DAV clients unable to browse the site. The default roles assigned the "WebDAV Access" permission are Manager and Anonymous. Those defaults were chosen so that upgraded Zope sites will continue to work as they have with earlier versions with regard to WebDAV, until you take explicit action to change the "WebDAV Access" permission.

**New Authenticated Role***

A new Authenticated role has been added in Zope 2.4 as one of Zope's standard roles. A user's possession of this role indicates that he or she has been authenticated by the Zope security machinery. It is an implicit role, and cannot be provided to users within the user management screens or the local roles management screens. It is provided to all authenticated users. Another way to think of the Authenticated role is that it is possessed by all users except the Anonymous User.

WebDAV Level 2 Locking

The WebDAV implementation in Zope 2.4 now support DAV level 2 locking. This should improve DAV interoperability with clients (such as MS Office 2K) that expect to be able to lock documents before editing.

Product Refresh Without Restart

Zope 2.4 now integrates the capabilities provided by Shane Hathaway's "Refresh" product, enabling developers to reload filesystem based products without restarting Zope.

More Information

This document is evolving and will continue to be updated as we approach the final release of Zope 2.4. For more detailed information on various aspects of the changes in Zope 2.4, see the Python 2.1 Migration project on dev.zope.org.