July 1999 - Zope-Dev

RE: [Zope-dev] Serious bug with gadfly transactions?
by Martijn Pieters 28 Jul '99

28 Jul '99

At 13:55 28/07/99 , Paul Everitt wrote: >Yes. Jim was able to fix it but I don't remember what he did. > >Also, the Browse tab on Gadfly connections is broken. > >The longer answer...this happened to me yesterday on my Win98 laptop. >It worked fine on Jim's Win95 laptop and Ken's Win98 laptop. So it's a >rather odd situation. > >Point is, file it as a bug and note that I also had the same experience. > >--Paul Okidoki. The solution seems quite simple. Just add _begin, _abort and _finish methods to db.py that handle the transactions: *** db.py 1999/07/22 16:10:23 1.9 --- db.py 1999/07/28 12:13:11 *************** *** 204,206 **** --- 204,215 ---- }) return items, result + def _begin(self): + pass + + def _abort(self): + self.db.abort() + + def _finish(self): + self.db.commit() + Watch it: This is my first stab at transaction coding... YMMV. But, it works for me, and the browse tab also works. I'll post this to the Collector then, shall I? -- Martijn Pieters, Web Developer | Antraciet http://www.antraciet.nl | Tel: +31-35-7502100 Fax: +31-35-7502111 | mailto:mj@antraciet.nl http://www.antraciet.nl/~mj | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 ------------------------------------------

1 0

RE: [Zope-dev] Serious bug with gadfly transactions?
by Paul Everitt 28 Jul '99

28 Jul '99

Yes. Jim was able to fix it but I don't remember what he did. Also, the Browse tab on Gadfly connections is broken. The longer answer...this happened to me yesterday on my Win98 laptop. It worked fine on Jim's Win95 laptop and Ken's Win98 laptop. So it's a rather odd situation. Point is, file it as a bug and note that I also had the same experience. --Paul > -----Original Message----- > From: Martijn Pieters [mailto:mj@antraciet.nl] > Sent: Wednesday, July 28, 1999 7:36 AM > To: Zope Development > Subject: [Zope-dev] Serious bug with gadfly transactions? > > > I'm looking for confirmation on this: > > In Zope 2.0b1 (and the latest CVS): > > - When using a gadfly database, nothing is committed, ever. > When shutting down Zope, all transactions to gadfly are > aborted, and all > data is gone. > > - When doing multiple SQL update/insert/create calls, and > making an error > in any but the first call leaves any previous call in the DB, > they are not > rolled back. > So, when, in one request, you do an insert and an update, and > the update > raises an error, the insert is not rolled back. > > Does anyone else see this? > > -- > Martijn Pieters, Web Developer > | Antraciet http://www.antraciet.nl > | Tel: +31-35-7502100 Fax: +31-35-7502111 > | mailto:mj@antraciet.nl http://www.antraciet.nl/~mj > | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 ------------------------------------------ _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://www.zope.org/mailman/listinfo/zope-dev (To receive general Zope announcements, see: http://www.zope.org/mailman/listinfo/zope-announce For non-developer, user-level issues, zope(a)zope.org, http://www.zope.org/mailman/listinfo/zope )

1 0

Serious bug with gadfly transactions?
by Martijn Pieters 28 Jul '99

28 Jul '99

I'm looking for confirmation on this: In Zope 2.0b1 (and the latest CVS): - When using a gadfly database, nothing is committed, ever. When shutting down Zope, all transactions to gadfly are aborted, and all data is gone. - When doing multiple SQL update/insert/create calls, and making an error in any but the first call leaves any previous call in the DB, they are not rolled back. So, when, in one request, you do an insert and an update, and the update raises an error, the insert is not rolled back. Does anyone else see this? -- Martijn Pieters, Web Developer | Antraciet http://www.antraciet.nl | Tel: +31-35-7502100 Fax: +31-35-7502111 | mailto:mj@antraciet.nl http://www.antraciet.nl/~mj | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 ------------------------------------------

1 0

ANNOUNCE: CVS access to XML Document
by Amos Latteier 28 Jul '99

28 Jul '99

Thanks to Ken Manheimer you can now follow the bleeding edge Zope/XML developments. You can now check out the XML Document Product from the public CVS repository. Use the following command from within your Zope '/lib/python/Products' directory: cvs -z7 -d :pserver:anonymous@zope.org:/cvs-repository \ checkout -d XMLDocument Products/DC/XMLDocument (You will have to log in, as instructed on http://www.zope.org/Community/CVS_public_access , if you haven't previously.) Happy xml-hacking. -Amos P.S. Currently XML Document has seen a major overhaul, but I think that it works ;-) You need the latest ZDOM.py from CVS for it to work. P.P.S. I love patches. -- Amos Latteier mailto:amos@digicool.com Digital Creations http://www.digicool.com

2 1

oooh. Zope-1.10.2-src.tgz != CVS 'Zope-1_10_2-src'
by Anthony Baxter 28 Jul '99

28 Jul '99

I doubt that this will affect anyone else, but just in case - the files in the Zope-1.10.2-src.tgz are not the same as the ones tagged as Zope-1_10_2-src in CVS. As far as I can see, there's no tagged version in CVS that matches the .tgz. The one in CVS has version 0.9.4 of the license, the one in the tgz is 0.9.7. I could find no version of, eg, LICENSE.txt, in CVS with 0.9.7. Why do I care? I'm finally trying to apply some decent revision control to the stuff here - for this, I need to be able to track the hacks^W changes that have been made locally. Like I said, I doubt this will affect anyone else, but just in case... Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

Gadfly version 1.0?
by Martijn Pieters 28 Jul '99

28 Jul '99

Hello all, and especially DC =) Am I right in assuming that you will update Gadfly to version 1.0 before the next beta? And could you take the PC line-endings out of the documentation files... -- Martijn Pieters, Web Developer | Antraciet http://www.antraciet.nl | Tel: +31-35-7502100 Fax: +31-35-7502111 | mailto:mj@antraciet.nl http://www.antraciet.nl/~mj | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 ------------------------------------------

1 0

RE: [Zope-dev] Owner Role -- clarification needed
by Brian Lloyd 27 Jul '99

27 Jul '99

> Hi, > > I'm playing around with building a cookie-based > authentication Zope product, and > I've been learning a lot about users, roles, local roles and > proxy roles ... > So I was wondering if my understanding of the proposed Owner > role (given that > documentation is very scanty) is correct, incorrect, or > simply needs clarification. > > The thing is, my setup is working, but who knows what bugs > may lie just around > the corner, merely because I misunderstand the concepts... (and since > I'm dealing with an authentication product, is *_specially_* > important). > > I'm using the Owner role in the context of allowing a user to > change his/her > passwords. I suppose I could create another role to fulfill > this, so its really > not a big deal if I shouldn't be using the Owner role for > this purpose: > > So this is my setup : > > 1. For a given Folder for which I am creating my > cookie-based UserFolder > (named acl_users, of course) I create a role known as > a cookieLoggedUser. > All users that are created in acl_users have the > cookieLoggedUser > role automatically added to their roles profile (and > cannot be deleted). > > 2. In this Folder, there are dtml methods to allow you > to login/logout etc. > (they are working fine and are of no importance to > the issue at hand) > When users log in, they acquire the role of > cookieLoggedUser (along with > the other roles defined for their user id, of course). > > 3. the acl_users permissions are modified to allow the > 'Owner' role > the privilege to "manage_users". (Is this advisable > or is this a big > security hole?) > > 4. I have a DTML method that displays the Change > Password form (it submits > the page to itself and I use a hidden form variable > to check whether > it should process the form or not). > > 5. This method has its permissions > set so that only users with the cookieLoggedUser role > can 'view' it or > 'access contents information'. This means that > Anonymous users can't see > this page unless they log in first, in which case > they acquire the > cookieLoggedUser role. > > 6. The processing DTML code calls the acl_users methods > to change the > password (and has safeguards against logged-in users > from changing > anybody else's passwords except their own). Because > they access > the acl_user's methods which require 'manage_user' > privileges, > I gave this method a proxy role of 'Owner' so that it > can execute > these privileged methods. > > Some notes: > > a. I don't *_have_* to use the Owner role for this > purpose. (I could easily > create another role expressly just for accessing the > acl_users privileged > methods and my system would still work) but I do want > to understand > if the 'Owner' role is meant to be used in this > context or not. > > b. If you give a user the Owner role, (along with the > view management > screens, of course), you allow him/her the privilege > to 'manage_users'. > My understanding is that you normally *_dont_* give > this role out to > any ordinary user? > > If this is incorrect, then my whole theory sinks down > the drain... > OTOH, if I'm incorrect, then just what the heck is > the 'Owner' role for? > > c. I've thought about possible security holes and think > (given the levels > of security HTTP protocols can give, of course) it's > fairly secure. It > could be made more secure by encrypting the cookie > better and providing > a secure channel (i.e. SSL). > > d. I'd really like to hear the opinions of those in the > know, especially about > how we should use the 'Owner role' (of course, we can > use it for any purpose > we want to, but I want to know the *_right_* way to > use it, i.e., the way it's > meant to be used). > > Thanks in advance, > > Butch Landingin Butch, The theory behind the "Owner" role is that: o when a user creates a new object, he/she automatically gets the local role "Owner" for that object. o As a site manager, you can set reasonable permissions for the "Owner" role at the top of your site, which will be acquired when folks work with objects that they have created. This means basically that you can reasonable laws of ownership (what people can do with objects that they have created), without having to visit every object that someone creates *and* without necessarily giving them the ability to modify security settings themselves. For example, lets say that you create a folder called "home" on your site. For the security settings for "home" you say that the "Owner" role can Create Documents Images and Files, Edit Docs Images and Files and Delete objects. Now you can create a new Folder inside of "home" for each user who should have a home area, and give them the local role "Owner" in that Folder. Having done that, your users can each create, edit and delete document in their own folders - but they *can't* go over and mess with their neighbor's Folder, because they only have the "Owner" role locally in their own Folder. The situation you describe above doesn't sound like it needs to use any of this. In your situation, the best (and most secure) approach would be to avoid giving any of your users "manage users" permissions directly. Just give the "Manager" proxy role to your password-changer form and make sure that "Manager" has the manage users permission. This way, it is effectively actually your *form* that has the permission to fiddle with user data, not the users themselves. The form logic itself should be able to ensure that a user can only change his own password. Hope this helps! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

BUGFIX XMLDocument upload tab
by Martijn Faassen 27 Jul '99

27 Jul '99

Hi there, zope-dev people and Amos, There was a small bug in XML Document that prevented file uploads from working. I think I fixed it. :) Diff at the bottom (do I do that right? I used diff -c, but I'm new to diffs). Regards, Martijn *** XMLDocument.py Mon Jul 26 13:07:11 1999 --- XMLDocument.py~ Thu Jul 22 19:09:11 1999 *************** *** 184,193 **** def manage_upload(self,file='', REQUEST=None): """Replace the contents of the document with the text in file.""" ! if type(file) is not type(''): file=file.read() ! ! try: ! self.parse(file) except ParseError, message: if REQUEST: return MessageDialog( title ='XML Parsing Error', --- 184,191 ---- def manage_upload(self,file='', REQUEST=None): """Replace the contents of the document with the text in file.""" ! try: ! self.parse(data) except ParseError, message: if REQUEST: return MessageDialog( title ='XML Parsing Error',

2 3

Owner Role -- clarification needed
by Butch Landingin 27 Jul '99

27 Jul '99

Hi, I'm playing around with building a cookie-based authentication Zope product, and I've been learning a lot about users, roles, local roles and proxy roles ... So I was wondering if my understanding of the proposed Owner role (given that documentation is very scanty) is correct, incorrect, or simply needs clarification. The thing is, my setup is working, but who knows what bugs may lie just around the corner, merely because I misunderstand the concepts... (and since I'm dealing with an authentication product, is *_specially_* important). I'm using the Owner role in the context of allowing a user to change his/her passwords. I suppose I could create another role to fulfill this, so its really not a big deal if I shouldn't be using the Owner role for this purpose: So this is my setup : 1. For a given Folder for which I am creating my cookie-based UserFolder (named acl_users, of course) I create a role known as a cookieLoggedUser. All users that are created in acl_users have the cookieLoggedUser role automatically added to their roles profile (and cannot be deleted). 2. In this Folder, there are dtml methods to allow you to login/logout etc. (they are working fine and are of no importance to the issue at hand) When users log in, they acquire the role of cookieLoggedUser (along with the other roles defined for their user id, of course). 3. the acl_users permissions are modified to allow the 'Owner' role the privilege to "manage_users". (Is this advisable or is this a big security hole?) 4. I have a DTML method that displays the Change Password form (it submits the page to itself and I use a hidden form variable to check whether it should process the form or not). 5. This method has its permissions set so that only users with the cookieLoggedUser role can 'view' it or 'access contents information'. This means that Anonymous users can't see this page unless they log in first, in which case they acquire the cookieLoggedUser role. 6. The processing DTML code calls the acl_users methods to change the password (and has safeguards against logged-in users from changing anybody else's passwords except their own). Because they access the acl_user's methods which require 'manage_user' privileges, I gave this method a proxy role of 'Owner' so that it can execute these privileged methods. Some notes: a. I don't *_have_* to use the Owner role for this purpose. (I could easily create another role expressly just for accessing the acl_users privileged methods and my system would still work) but I do want to understand if the 'Owner' role is meant to be used in this context or not. b. If you give a user the Owner role, (along with the view management screens, of course), you allow him/her the privilege to 'manage_users'. My understanding is that you normally *_dont_* give this role out to any ordinary user? If this is incorrect, then my whole theory sinks down the drain... OTOH, if I'm incorrect, then just what the heck is the 'Owner' role for? c. I've thought about possible security holes and think (given the levels of security HTTP protocols can give, of course) it's fairly secure. It could be made more secure by encrypting the cookie better and providing a secure channel (i.e. SSL). d. I'd really like to hear the opinions of those in the know, especially about how we should use the 'Owner role' (of course, we can use it for any purpose we want to, but I want to know the *_right_* way to use it, i.e., the way it's meant to be used). Thanks in advance, Butch Landingin butchland(a)yahoo.com _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

COM initialization
by Toby Dickenson 27 Jul '99

27 Jul '99

I've been using the code below to initialize COM correctly in a threaded ZServer. Without something like this, COM objects are unlikely to be thread safe, and COM itself may deadlock. It should also avoid any CO_E_NOTINITIALIZED errors when creating COM object. Has anyone else noticed this kind of problem before? Relative to alpha 4, add "import zcom; zcom.init()" in the midde of z2 py, "import zcom; zcom.start_of_another_zope_thread()" as the first line of __init__ in ZServerPublisher.py, and the module zcom.py as below. I hope this helps, Toby Dickenson """ COM support for Zope. This module initializes COM. Nothing more. Author: Toby Dickenson """ # We have to use MTA threads since it is possible that a variable # referring to a COM object might be used by multiple threads. After # this, COM will take care of all concurrency issues automatically. import sys COINIT_MULTITHREADED = 0 def init(): """Call this in the main application thread. It determines whether COM support is available, and imports the pythoncom module for the first time. The first import of pythoncom triggers some 'convenient' magic, so we get that over with too.""" # Set the value in sys module that is used by pythoncom # when first imported sys.coinit_flags=COINIT_MULTITHREADED try: import pythoncom except ImportError: pass else: assert COINIT_MULTITHREADED==pythoncom.COINIT_MULTITHREADED # This thread is now registered with COM as an MTA def start_of_another_zope_thread(): """Call this at the start of every thread that enters Zope.""" pythoncom=sys.modules.get('pythoncom',None) if pythoncom: pythoncom.CoInitializeEx(COINIT_MULTITHREADED) # This thread is now part of the MTA

1 0