August 1999 - Zope-Dev

Re: [Zope-dev] Trying to design a PythonMethod Product
by Evan Simpson 13 Aug '99

13 Aug '99

From: Christopher Petrilli <petrilli(a)digicool.com> > I'll make some comments since we've tossed this around ENORMOUSLY in house > and just haven't had the time to write it. It's really not that hard I > think, but you do need to take into account some issues. I have working code going already, but I'm cleaning it up for general consumption. Any help getting the issues right is greatly appreciated. > Look at the expression machinery, it would be insane to duplicate security > already implemented, and frustrating to have two separate "paradigms" for > managing security. Surely! This consists of DT_Util, VSEval, and gparser, yes? As far as I can tell, these perform two tasks; They screen out restricted names and guard selected operations. You folks may want to seriously consider replacing gparser with something using bytecodehacks; Walking an AST is terribly opaque and complex compared to manipulating an EditableCode object. That's how I'm doing things, anyway, and I'll do my best to use the information and guard functions in DT_Util directly. Hmm. For that matter, I may try to generalize enough to offer a plug-in replacement for VSEval. > > 4. Restrict "import" to modules/packages found in a particular location, so > > that 'safe' modules can be used. > > Take a look at rexec for this. I have, and may use some bits of it. Should we allow import of standard modules, or even Extensions modules? I'm leery of that, and lean toward requiring explicitly exposing selected modules to import. Heck, I may even have 'import' bring in names from the Zope object hierarchy instead of external files! > Actually, we talked about just limiting the "instruction counter" so that > you could catch anything that was taking an excessively long period of time > to execute. Say 1M byte-codes? This avoids having to worry about > individual flow constructs. Sounds great! How? :-) > Not sure how I like this honestly. I'd probably just bind sys.stdout.write > to something new, that should cause print to work correctly. I've got this part working to my satisfaction already. > > 7. Either disallow "global", or redirect access to globals into a controlled > > namespace. > > Look at management of namespaces in expressions. This part is proving to be fairly deep. DTML objects require a client and mapping to operate on. I want PythonMethods to be a*lot* like External Methods, with any number of parameters (including zero) and the option to pass '_' or 'REQUEST' explicitly. Under this regime, global names can't refer to Zope namespace contents; So far, I've got them accessing a volatile private namespace. This has led me to extend my original idea. I *really* dislike requiring a separate Zope object for every method in a module of external methods, and I think it would be even more annoying when the actual code is web-managed. Now I'm thinking of creating a PythonModule product, which could define and expose any number of functions and classes. These would act like methods of the PythonModule. Perhaps defining an object named 'default' (or 'index_html'? <bleah>) would allow the PM to be called/rendered directly. Now, all the objects in the PM would have a meaningful shared global namespace, just as if they were in a regular Python module. So far, I've got restricted assignment, print interception (and retrieval), 'del' and 'exec' blocking, a safe global namespace, and I'm comfortable with mucking about in bytecodes. Import handling and operator guards should be straighforward (once I know what import should *do* <wink>). Keep those ideas rolling, Evan Simpson

1 0

Re: [Zope-dev] objectValues(spec) does not work!?
by Jonas Juselius 13 Aug '99

13 Aug '99

Does not work, and does not matter... If you look at the code in ObjectManager, objectItems() calls objectIds() with 'spec', and objectIds() tests whether 'spec' is a string or not, and if it is a string it converts it into a list. Sorry about the typo in my previous post, my code _actually_ read objectItems(['Folder']) not objectItems('[Folder]'). jonas On Fri, Aug 13, 1999 at 11:14:28AM -0400, Christopher Petrilli wrote: > > I have the following problem in dtml: > > > >  > > . > > . > > . > >  > > > > does not work! Neither does objectItems('[Folder]'), but a plain > >  works... I have looked at the code in ObjectManager.py > > and DT_Util.py, but can't figure it out... > > You're mispelling it: > >  > > objectItems, along with other such things expect a *list* of meta-types. > > Chris > > -- > | Christopher Petrilli Python Powered Digital Creations, Inc. > | petrilli(a)digicool.com http://www.digicool.com -- And what is good, Phaedrus, And what is not--- Need we ask anyone to tell us these things? [ PGP public key: finger jonas(a)radon.pc.helsinki.fi ]

1 0

quibble about directory structure
by Joel Berendzen 13 Aug '99

13 Aug '99

Dear Zope Developers, I'm manager of a development project for a scientific network-based compute appliance that will be Zope-based. I have only limited experience with Zope (starting with 2.0.0a2) but I'm an experienced programmer and sysadmin. I'm getting to be experienced with installing new Zope releases, which is where my quibble comes from. My quibble is that doing updates to Zope is harder than it should be because of the directory structure. Life would be sweet in Zopeville if everything that varies from installation to installation would be kept in var. This way, I could simply keep a var directory in a place outside the Zope tree itself and make a symlink to it as part of the install. Instead, I have var, Extensions, import (I think, haven't used this feature yet), and (the worst) parts of lib/python/Products that have to be moved with each install. I would like to suggest that the Extensions and import directory be moved to var in future releases, that var/Products be created and put on the search path, and that the rest of the tree be specified as read-only. I can of course do this myself with symlinks (and I will), I think a change in the official distribution might save us all a little trouble. Cheers, Joel -- Joel Berendzen Biophysics Group (P-21), D454 Phone: +1.505.665.2552 Los Alamos National Laboratory FAX: +1.505.665.4507 Los Alamos, NM 87545, USA. email: joelb(a)lanl.gov

1 0

Re: [Zope-dev] objectValues(spec) does not work!?
by Christopher Petrilli 13 Aug '99

13 Aug '99

> I have the following problem in dtml: > >  > . > . > . >  > > does not work! Neither does objectItems('[Folder]'), but a plain >  works... I have looked at the code in ObjectManager.py > and DT_Util.py, but can't figure it out... You're mispelling it:  objectItems, along with other such things expect a *list* of meta-types. Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

1 0

Re: [Zope-dev] Trying to design a PythonMethod Product
by Christopher Petrilli 13 Aug '99

13 Aug '99

I'll make some comments since we've tossed this around ENORMOUSLY in house and just haven't had the time to write it. It's really not that hard I think, but you do need to take into account some issues. > Basically, I plan to take an arbitrary chunk of Python code, wrap it in a > function definition, compile it, and then thrash the resulting bytecodes > with bytecodehacks (see http://starship.python.net/crew/mwh/bch/index.html) > This will serve the dual purposes of enforcing restrictions on what the code > can do, and bending the semantics for better Zope integration. Look at the expression machinery, it would be insane to duplicate security already implemented, and frustrating to have two separate "paradigms" for managing security. > 4. Restrict "import" to modules/packages found in a particular location, so > that 'safe' modules can be used. Take a look at rexec for this. > 5. Allow "while" and "for". Insert 'escape code' at the bottom of every > loop, to allow PythonMethods to 'time out' after some elapsed time or loop > count. Actually, we talked about just limiting the "instruction counter" so that you could catch anything that was taking an excessively long period of time to execute. Say 1M byte-codes? This avoids having to worry about individual flow constructs. > 6. Allow "print" to be used to generate rendered output by replacing it with > a function that accumulates text. If anything other than literal "None" is > returned, the collected "print" text is discarded, otherwise it becomes the > return value (on "return", "return None", and on implicit return, but not on > "x=None; return x", for example). Not sure how I like this honestly. I'd probably just bind sys.stdout.write to something new, that should cause print to work correctly. > 7. Either disallow "global", or redirect access to globals into a controlled > namespace. Look at management of namespaces in expressions. > 8. Provide the Zope standard builtins (and tags?) as builtins. Before carving that new wheel, take a look at the expression syntax. This would be very good starting point I think, as it already deals with crawling around the parse trees :-) Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

1 0

Zope 2.0B4 WebDav rename lockups on Win32
by Brad Clements 13 Aug '99

13 Aug '99

Can anyone else recreate this? On NT 4.0 SP4 server, with IE5 client running Zope 2.0B4, Z2.py manual-start server 1. Create a folder in Zope via management interface 2. Use WebDav to open the folder from IE5 (ie, open as folder) 3. Open a regular Windows Browser and find a directory with about 30 .gif files 4. Drag and drop those .gifs into the WebDav folder so IE5 copies them to the Zope server (isn't that great!) 5. After the webdav folder finishes copying and refreshes, begin renaming individual images by right-click/rename in the IE5 webdav folder view. 6. On the fifth rename, the server "hangs". IE5 still shows "renaming", but Z2 does not respond. 7. CTRL-C (not CTRL-Break) causes Z2 to shut-down ok with "keyboard interrupt". I can recreate this at will, 5 renames, boom, zserver locks up. Can anyone else recreate this? Maybe it's a win32 thing, or an IE5 thing. Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax netmeeting: ils://ils.murkworks.com ICQ: 14856937

2 3

Date
by Anderson Ami 13 Aug '99

13 Aug '99

I need display the date (today) in my html, what is the command ? <!--#var expr=" ?????????? "> thanks a lot Anderson Brasil ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Zope scheduler any one.
by Robin Becker 13 Aug '99

13 Aug '99

Any plans for a Zope scheduler ie a means of getting certain things done periodically. I would like to pack the database automatically fairly regularly, and periodically remove certain user folders and the like. -- Robin Becker

3 3

Images
by Anderson Ami 13 Aug '99

13 Aug '99

How to create an image, which name is a variable ( a field in sequence ) and how a randomize a image in my dtml code, which name is a variable too ? Thanks a lot. Anderson São Paulo - Brasil ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

(no subject)
by Anderson Ami 13 Aug '99

13 Aug '99

How to create an image, which name is a variable ( a field in sequence ) and how a randomize a image in my dtml code, which name is a variable too ? Thanks a lot. Anderson São Paulo - Brasil ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0