August 1999 - Zope-Dev

looking for ideas on access control...
by Anthony Baxter 09 Aug '99

09 Aug '99

For an application I'm building, I'm looking at trying to figure out a simple and robust method of doing access control - there's a bunch of different users who each have access to certain objects (stored in Oracle), and they should get different access based on which object ids they are trying to access. What I want to be able to do is have something I can call in standard_html_header which does something like * get AUTHENTICATED_USER. * get REQUEST['object_id']. * lookup in SQL the rights that this user has over the object with object id object_id. * set the roles of the user for this transaction, to either 'anonymous/none', 'readonly', 'readwrite', or some other variation, and let the permissions on the appropriate DTML and SQL methods control what they can do. What's the mechanism for editing the roles of a transaction? Is it even doable? Could I simply use a UserDb, add 'object_id' to the list of arguments for sqlListUser, and make the SQL magic supply the roles? Will this get called for each transaction? thanks, Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

3 2

ZSybaseDA: multiple sql-statements
by Frank Buhr 09 Aug '99

09 Aug '99

Hi, the new ZSybaseDA 1.0.1 seems to be very restrictive regarding multiple statements in one ZSQLMethod. Even simple cases as this one (inspired by the "auto commit hint" at the end of the README) don't work: ZSQLMethod: commit transaction  SELECT * FROM bar An error is signaled if there are multiple statements (queries) and at least one has a "select" in it: Zope-2.0.0b3-linux2-x86/lib/python/Products/ZSybaseDA/db.py: if len(queries) > 1: result=[] for qs in queries: if select_m(qs) >= 0: raise 'Query Error', ( 'select in multiple sql-statement query' ) I'am using temporary tables for some of my queries. With 1.0.1 it is impossible to do this: COMMIT TRANSACTION  SELECT * INTO #foo from something   other SELECTs with empty result set...   Only the result of this query should be displayed  SELECT * FROM #foo  DROP TABLE #foo The solution would be to take the result of exactly one select query if there are more than one. If all other selects have an empty result set, nothing is lost -- Even more: my queries start working again! To be concrete -- I would suggest to change the query() method in Products/ZSybaseDA/db.py like this: def query(self,query_string, max_rows=9999999, select_m=regex.compile('[\0- ]*select[\0- ]+', regex.casefold).match, try_again=1 ): global failures, calls calls=calls+1 db=self.db try: c=self.cursor self._register() queries=filter(None, map(strip,split(query_string, '\0'))) if not queries: raise 'Query Error', 'empty query' if len(queries) > 1: result=[] lastQueryWithSelect=None for qs in queries: if select_m(qs) >= 0: lastQueryWithSelect=qs if lastQueryWithSelect is None: # non-select queries only: execute them all for qs in queries: r=db.execute(qs) result.append([qs, str(`r`), calls]) desc=nonselect_desc else: # use cursor on last select, but execute the other queries for qs in queries: if qs is lastQueryWithSelect: r=c.execute(qs) result=c.fetchmany(max_rows) desc=c.description[0] c.close() else: r=db.execute(qs) if r and r[0]: raise 'Query Error', ( # explain... 'multiple selects with non-empty results in multiple sql-statement query' ) else: # one query only query_string=queries[0] if select_m(query_string) >= 0: r=c.execute(query_string) result=c.fetchmany(max_rows) desc=c.description[0] c.close() else: r=db.execute(query_string) result=[[query_string, str(`r`), calls]] desc=nonselect_desc failures=0 #c.close() except self.Database_Error, v: [no change below] -- Frank Buhr

1 0

Z Search not working?
by David Kankiewicz 08 Aug '99

08 Aug '99

Working with the current CVS checkout... Can someone test out creating a Z Search... I'm getting a nonexistent ZQueryIds error message when trying to create one with the management interface.. If someone else with the current CVS can reproduce it than its bug that needs to be looked into/ added to the Collector?. Please let me know if it does the same thing for you. David Kankiewicz P.S. Just got done catching up/checking through the Mailing list for this bug and reading the discussions on the latest topics, I think its awesome product and can't wait to see what ZEO is and how Zope builds on the current projects/developments...

1 0

Zope 2 Beta 3 win32 release and site update...
by Brian Lloyd 08 Aug '99

08 Aug '99

Hi all. I've updated the Zope.org site for Zope 2 beta 3 and made the win32 binary release available: http://www.zope.org/Download/Releases/Zope-2.0.0b3/ Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 2

AGENT CREATION - REMOTE SEARCHING - REMOTE FORM PROCESSING
by Theodore Patrick 07 Aug '99

07 Aug '99

One of the key elements of agent and spider creation is the ability to retrieve, parse and store remote objects. All of which Zope can handle very well. Has anyone explored Agent Creation and Remote Spidering in Zope? Here are my main questions? --------------------------------------------------- Can Zope interact with other servers as if it were a browser (crawler/spider/user)? Can Zope modify its identity(agent-detection parameters) to simulate a version of a browser? FACT: The interface to all of the current internet applications online are forms. How feasible is it to allow Zope to exchange data Server to Server via forms? --------------------------------------------------- Any ideas? Theodore Patrick http://www.ishophere.com

1 0

Cookie-Free Shopping Cart
by Josh Zeidner 07 Aug '99

07 Aug '99

hello, I just completed a simple cookie-free shopping basket product, if anyone is interested in using it, let me know. Steve Spicklemire is working on a similar project, using a slightly different technique for retaining session info from request to request( he used aquisition, I used the query string ). I would tend to believe that Steve's is simpler to use than mine, mainly in creating links from page to page( the session id must be maintained in the query string ). -Josh Zeidner _______________________________________________________________ Get Free Email and Do More On The Web. Visit http://www.msn.com

2 1

indexing dynamic sites with ZCatalog
by Pawel Logatschev 06 Aug '99

06 Aug '99

hello, does anybody happen to know how to index websites with dynamic content. when i try to index pages including data by aquisition, only the templates are indexed. regards, pawel

1 0

Accounting API
by Josh Zeidner 06 Aug '99

06 Aug '99

Does there exist any kind of API for accounting software? -josh z _______________________________________________________________ Get Free Email and Do More On The Web. Visit http://www.msn.com

2 1

WARNING: Zope 2.0b2 considered harmful to ZClasses
by Christopher Petrilli 05 Aug '99

05 Aug '99

Gang, Well, this is unusual, but unfortunately ZClasses seem to be largely broken in beta 2. How this happened we're not sure, and we sat and tried to fix it as quickly as possible, but the problem seems to be quite deep, and not due to any recent single change. What this means is that if you're using ZClasses you shouldn't even *think* about using Zope 2.0b2. This would be a bad idea. To prevent problems, I'll be removing it from the web site. Sorry for all the problems, and thanks to those who noticed. Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

3 2

Re: [Zope-dev] the birth of ZCommerce
by Christopher Petrilli 05 Aug '99

05 Aug '99

> Josh Zeidner wrote: > >> 2) Maybe we should agree on an accounting system to implement the API in ( >> Beachtree seems like a likely candidate ). > > No, we shouldn't. We want this done the Unix fashion, where you have > choice. An unfortunate reality for anyone who has not spent their entire life mired in accounting is that you have to have a *starting point* for all implementations. To design an API in a vacuum is a foolish thing indeed. It is best to try and look at what one instance requires and make it as generic as possible. It is not unreasonable to choose a commercial product for this given the fact that I know of no "Open Source" accounting packages, and even if they did exist, I'd hazard they have market share measured on a single hand. This wouldn't be the most prudent method to grain a scalable API. Chris -- | Christopher Petrilli Python Powered Digital Creations, Inc. | petrilli(a)digicool.com http://www.digicool.com

3 2