October 1999 - Zope-Dev

Lax 'manage_access' practice?
by Tres Seaver 29 Oct '99

29 Oct '99

I was tweaking with adding some of the functionality of 'manage_access' to a custom form/method, and discovered what seems to be a hole in it: the form embeds the edited user's password (in plaintext) as the text of the password/confirm fields (either text or hidden fields). In either case, "View | Page Source" shows the plaintext. "Normally", administrators are not be able to see users' passwords, but can only reset them. Is this a real problem, or is BasicAuthentication so weak that we shouldn't care, anyway? Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

2 1

Manage all user folders from one screen?
by John Fohrman 28 Oct '99

28 Oct '99

Is there a way to hook into user folders so that an Administrator could manage them from one screen? Thanks, John

3 3

how to pass 'self'
by Joerg Wittenberger 28 Oct '99

28 Oct '99

Hi folks, I'm trying to create an object in a way very simillar to some working code, but it refuses to work. Any help? The working code read:  <dtml-call "fsmirror(_)">   Now I wrote a python product, which is pretty folderish, it has a method like this: def manage_addFeature(self, id, file='', REQUEST=None): """ Create a Feature """ self._setObject(id, Feature(id, data=file, REQUEST=REQUEST)) return self.manage_main(self, REQUEST, update_menu=1) and I'm trying to substitute the manage_clone from above. Whatever I do, I can't get this working: <dtml-with "Control_Panel.manage_addProduct.docstore.Feature.createInObjectManager('f' + REQUEST['number'], REQUEST=REQUEST)"> When I compare the definition the whole thing becomes even blured. Both mange_clone and manage_addFeature have 'self'. The former has two required and one key arg, the latter has one required and one key arg. I'd expect zope to either complain when I pass manage_clone no self (as in the working code above) or neither complain with the none-working code. What am I missing? Thanks a lot /Jerry -- You can have it done fast, you can have it done cheap, and you can have it done well. --- But you can only have two of those at once.

1 0

Security Extensibility?
by John Fohrman 28 Oct '99

28 Oct '99

Along the lines of my previous questions, how extensible is Zope Security in the release version? For instance, can I access and expand user information so that I can include Company they work for, address, etc., essentially as if this was a database table? Thanks.

2 1

About Zope security management!
by Victor.Zhai＠ogilvy.com 28 Oct '99

28 Oct '99

Greeting! I am Victor, and I'm a programmer and developer for an Interactive agency in China. This is my first time working on a Zope-based project. Due to my lack of Zope experience, I've been getting into some problems, and I hope your experience can help me. My problem is: In my simple HR system,I want different people to manage my HR system Using their Password through diffrent Role. I know that Zope can do that easily,But I try it for serveral times and get no result. 1.I want to add some Role using zpasswd.py,Then The user can login to Zope management interface by their Username and Password. 2.Add Role in A Project's Security interface.But How can I log onto Zope management interface? 3.Other.. Please give me some advice and help. Thanks advance. Victor. "WorldSecure Server <ogilvy.com>" made the following annotations on 10/28/99 04:24:57 ------------------------------------------------------------------------------ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Please advise immediately if you or your employer does not consent to email for messages of this kind. Opinions, conclusions and other information in this message that do not relate to the official business of the Ogilvy Group shall be understood as neither given nor endorsed by it. ==============================================================================

1 0

Role Inheritance? Timeout?
by John Fohrman 28 Oct '99

28 Oct '99

I'm a newcomer to Zope, coming into the middle of a project using Zope. We've been looking at security requirements for a commercial Extranet. It appears Zope meets all of the requirements except for two: 1. Role Inheritance: Currently, the permissions associated with "Role A" and "Role B" can be assigned to a single user. However, they can't be assigned to "Role C" (ideally along with additional permissions). 2. Timeout: If I walk away from my computer while using Zope, and return an hour later, someone could use Zope without my permission. With a timeout, I could say "log me off if you haven't heard from me in (specified number of) minutes. Please let me know if these features actually do exist, or if there is a way to create them. (I realize I can also submit these as feature requests to Zope.org) Thanks for any feedback, John

2 1

XMLRPCMethod product
by Andrew M. Kuchling 28 Oct '99

28 Oct '99

In Amos's XML-RPC HOWTO, he writes: It would be an interesting project (hint, hint) to write an XML-RPC Method Zope Product that was smart about caching, etcetera. This would make XML-RPC available from DTML in a safe form. I can take hints, and have a need for easier access to XML-RPC. So, what should an XMLRPCMethod look like? One idea is that it has a single property, the URL for an XML-RPC server. You would set this to http://othersite/zope/ or whatever. Assuming your method was given an ID of 'rpcserv', you could then write DTML like:  <dtml-var "rpcserv.standard_html_header()"> <dtml-in "rpcserv.listUsers()"> ... </dtml-in> This would be better named XMLRPCServer than *Method. Alternatively, by analogy with ExternalMethods, an XML-RPC Method could pin things down to a single method; you might create one for listUsers() on a given server, another for standard_html_header() on that site, etc. I don't like this, because it means you may have lots of different method objects, and when a server moves, a lot of updating is required. Too inflexible for my taste. You could make updating server URLs easier by doing something similar to DAs and SQLMethods, having XMLRPCMethods use a given XMLRPCServer object, just as SQLMethods use a given database object. This strikes me as over-engineering the problem, though, resulting in two new object types, and is still rather inflexible. Caching is an interesting problem. Who can know whether a given XML-RPC method is returning relatively static data that's constant for several hours, or transient data that changes a lot? Only the XML-RPC server, and maybe the caller, can know this. I don't think a solution is possible until XML-RPC supports some way to signal whether a method's results are cacheable or not, so I don't think caching is possible at this point in time. -- A.M. Kuchling http://starship.python.net/crew/amk/ Aristocrats need not be rich, but they must be free, and in the modern world freedom grows rarer the more we prate about it. -- Robertson Davies, "Osbert Sitwell"

5 11

ZClass inside a ZClass
by Martijn Faassen 27 Oct '99

27 Oct '99

Hi there, I'm having some problems with ZClasses within an ObjectManager ZClass. [later: ahum, I *had *some problems. I'll leave this mail as an interesting debugging artifact; it perhaps also points out some bugs in Zope] * What am I trying to do? I have a FormulatorForm ZClass. Instances of FormulatorForm can contain instances of ZClasses (IntegerField, StringField, etc). Those field ZClasses should only be able to create inside FormulatorForm instances, nowhere else. * How far did I get? I have created a ZClass FormulatorForm. Inside I've created my Field ZClasses (4 of them right now). I've also let Zope autogenerate the constructor methods. This all appears to work. * What is wrong then? First I had created the Field ZClasses as global ZClasses; they could be created anywhere. I tried to move them inside the new FormulatorForm ZClass, and this worked; only the permissions wouldn't move from the root of the Product. It all seemed to work, but the field ZClasses show up *twice* each in the add list of a FormulatorForm instance. I messed around a bit with creating and disabling factories, permissions, I forget what. I had one field ZClass show up only once then, but then I got an error when trying to add it. Not daunted, I removed all Field ZClasses and added them again from scratch (not a big deal as they were mostly inheriting from Python base classes). My experimenting, I thought, showed that this would fix the problems. Nada. They still show up twice. What do I do now? * What did you do to solve the problem? (added after I wrote the above and I started figuring things out on my own) Ooh, wait, I have just noticed that when I add a ZClass by hand which doesn't inherit from any Python base class, the problem does not occur. And *now* I have figured out that I should not name the Python base classes the same as the ZClasses (my Python base class is called StringField, while the ZClass inheriting from it is also called that). This seems to be the source of the problem. Do not give your ZClass the same name as the Python base class it inherits from! This appears to be, if not a Zope bug, at least a severe Zope unclarity. Having created a ZClass with a different name, all works, except that I run into the resource not found bug (I did *not* run into that one before with my other bug! :). Luckily there's a howto on how to fix that, which worked: http://www.zope.org/Members/gtk/containers Phew. I hope the Zope version in CVS fixes both problems. :) Regards, Martijn

2 2

ZClass.manage_subclassableClassNames
by Joerg Wittenberger 27 Oct '99

27 Oct '99

Hi folks, I'm trying to get my first Zope product working. It shall: * manage dublin core meta data with each object (works) * deliver rdf/dc meta data info (works) * have both content (like a file but editable like DTMLDocument) and children nodes like a folder (works) * mirror the document hirarchy and meta data in the file system (half working) * don't evaluate DTML (for various reasons) (easy) * replicate hirarchy based on a subscription mechanism (not yet started) and be subclassable as ZClass and searchable. The latter two are the problem. I can't find how the ZClass.manage_subclassableClassNames() method collects which classes are subclassable. Furthermore the PrincipiaSearchSource() method is never called for some reason. I append the 0.0.0.0.0.0.0.1 ;-) version of my code, any help appreciated. /Jerry -- You can have it done fast, you can have it done cheap, and you can have it done well. --- But you can only have two of those at once. ---------------------------------------------------------------------------- """ We add documentation here the other day. """ from OFS.Folder import Folder import Globals import ExtensionClass import DocumentTemplate from Globals import HTML, HTMLFile, MessageDialog from DateTime import DateTime import os, string from zLOG import LOG def manage_addDCDocument(self, id, file='', REQUEST=None): """ Create a DCDocument """ if type(file) is not type(''): file=file.read() self._setObject(id, DCDocument(id, data=file, REQUEST=REQUEST)) return self.manage_main(self, REQUEST, update_menu=1) manage_main=HTMLFile('documentEdit', globals()) manage_addDCDocumentForm=HTMLFile('addDCDocumentForm', globals()) # This should be somewhere else! def _dropPathSep(path): if path[-1] == os.sep: return path[:-1] return path the_publisher = 'XYZ Deutschland GmbH' the_rights = 'all rights reserved' class DCDocument(Folder): """ jojo """ meta_type = 'DCDocument' description = '' _properties=({'id':'title', 'type':'string', 'mode':'w'}, {'id':'creator', 'type':'string', 'mode':'w'}, # The subject should better be 'tokens' type {'id':'subject', 'type':'string', 'mode':'w'}, {'id':'description', 'type':'text', 'mode':'w'}, {'id':'publisher', 'type':'string', 'mode':'w'}, #{'id':'contributor', 'type':'string', 'mode':'w'}, #{'id':'date', 'type':'date', 'mode':''}, #{'id':'type', 'type':'string', 'mode':'w'}, #{'id':'format', 'type':'string', 'mode':'w'}, {'id':'identifier', 'type':'string', 'mode':'w'}, #{'id':'source', 'type':'string', 'mode':'w'}, #{'id':'language', 'type':'string', 'mode':'w'}, #{'id':'relation', 'type':'string', 'mode':'w'}, #{'id':'coverage', 'type':'string', 'mode':'w'}, {'id':'rights', 'type':'string', 'mode':'w'}, ) _dc_properties = _properties def __init__(self, id, data=None, REQUEST=None): self.id=id if REQUEST: self.data=REQUEST['data'] else: self.data=data if type(self.data) is not type(''): self.data=self.data.read() self._setPropValue('creator', `REQUEST.AUTHENTICATED_USER`) self._setPropValue('date', DateTime().Date()) self._setPropValue('publisher', the_publisher) self._setPropValue('rights', the_rights) self._setPropValue('identifier', '') self.manage_changeProperties(REQUEST) path=REQUEST['PATH_INFO'] path, drop = os.path.split(_dropPathSep(path)) self._saveData(path=path, fn=id) self._saveProperties(path=path, fn=id) return '' def _SavePath(self, path=None, fn=None, REQUEST=None, ext='.sgml', base='/tmp'): if REQUEST: path = REQUEST['PATH_INFO'] path, drop = os.path.split(_dropPathSep(path)) path, fn = os.path.split(path) dirname = base + path if not os.path.exists(dirname): os.makedirs(dirname) return os.path.join(dirname, fn) + ext def _saveData(self, path=None, fn=None, REQUEST=None, ext='.sgml'): if REQUEST: path = self._SavePath(REQUEST=REQUEST, ext=ext) else: path = self._SavePath(path=path, fn=fn, ext=ext) try: f=open(path, 'wb') except: raise f.write(self.data) f.close() def _saveProperties(self, path=None, fn=None, REQUEST=None, ext='.rdf'): if REQUEST: path = self._SavePath(REQUEST=REQUEST, ext=ext) else: path = self._SavePath(path=path, fn=fn, ext=ext) try: f=open(path, 'w') except: raise f.write(self.RDF()) f.close() def get_size(self): return len(self.data) def PrincipiaSearchSource(self): "Support for searching - the document's contents are searched." LOG('Hier', 0, self.data) return self.data _rdf_header= """<?xml version="1.0" ?> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:dc="http://purl.org/dc/elements/1.0/" > """ def RDF(self, REQUEST=None): ' retunrs the properties as xml ' md=self._rdf_header md = md + ' <rdf:Description about="' + self.id + '">\n' for p in self._dc_properties: n = p['id'] try: v = getattr(self, n) except AttributeError: v = None if v and v != '': md=(md + ' <dc:' + n + '>' + DocumentTemplate.DT_Util.html_quote(v) + '</dc:' + n + '>\n') md = (md +' <dc:date>' + self.bobobase_modification_time().Date() + '</dc:date>\n') if REQUEST is not None: REQUEST.RESPONSE.setHeader('Content-Type', 'text/xml') return md+' </rdf:Description>\n</rdf:RDF>\n' _size_changes={ 'Bigger': (5,5), 'Smaller': (-5,-5), 'Narrower': (0,-5), 'Wider': (0,5), 'Taller': (5,0), 'Shorter': (-5,0), } def _er(self,SUBMIT,dtpref_cols,dtpref_rows,REQUEST): dr,dc = self._size_changes[SUBMIT] rows=max(1,string.atoi(dtpref_rows)+dr) cols=max(40,string.atoi(dtpref_cols)+dc) e=(DateTime('GMT') + 365).rfc822() resp=REQUEST['RESPONSE'] resp.setCookie('dtpref_rows',str(rows),path='/',expires=e) resp.setCookie('dtpref_cols',str(cols),path='/',expires=e) def manage_edit(self, data, SUBMIT='Change',dtpref_cols='50', dtpref_rows='20', REQUEST=None): """ tbc """ if self._size_changes.has_key(SUBMIT): self._er(SUBMIT,dtpref_cols,dtpref_rows,REQUEST) if type(data) is not type(''): data=data.read() self.data=data self._saveData(REQUEST=REQUEST) if REQUEST: REQUEST.RESPONSE.redirect(REQUEST['URL1'] + '/manage_editForm') def manage_editProperties(self, REQUEST): """ eit the PRoperties and write the copy into the meta file """ Folder.manage_editProperties(self, REQUEST) self._saveProperties(REQUEST=REQUEST) def index_html(self, REQUEST=None): """ render the document, i.e., give away the plain text """ # if REQUEST: REQUEST.RESPONSE.setHeader('Content-Type', 'text/plain') return self.data manage_editForm=HTMLFile('documentEdit', globals()) manage_options=( {'label':'Contents', 'action':'manage_editForm'}, {'label':'Children', 'action':'manage_main'}, {'label':'View', 'action':'index_html'}, {'label':'Properties', 'action':'manage_propertiesForm'}, {'label':'Import/Export', 'action':'manage_importExportForm'}, #{'label':'Security', 'action':'manage_access'}, {'label':'Undo', 'action':'manage_UndoForm'}, #{'label':'Find', 'action':'manage_findFrame', 'target':'manage_main'}, ) __ac_permissions__=( ('View management screens', ('manage_editForm', 'manage', 'manage_main', 'manage_uploadForm', 'PrincipiaSearchSource')), ('Change DCDocuments', ('manage_edit', 'manage_upload', 'PUT')), ('View', ('__call__', '')), ) Globals.default__class_init__(DCDocument)

1 0

Code contribution
by Carlos Henrique Bauer 27 Oct '99

27 Oct '99

Hi, I sent on September, 22th a message to the Zope list about a problem I was having with the Navigate product. The only way I could solve the problem is adding two functions to ObjectManager and SimpleItem. If the Zope team wish I can send a patch for inclusion in the Zope code. Best regards, -- Carlos Henrique Bauer

2 1