January 2000 - Zope-Dev

Some apparent limitations of the Zope security model
by Ross Boylan 07 Jan '00

07 Jan '00

For some work I am doing I need to have a security model, and my initial take is that Zope's security model will not meet my requirements. So I should just implement my own, and bypass Zope's. I'd like to throw this out for discussion, since I could be overlooking something, or this could be a useful comment on the security model. My decision is driven by 3 concerns, 2 of which are fundamental to the architecture. 1) The concept of ownership I have seems different from Zope's. If I have a person object P with a part A, I want the owner of part A to be P. But I believe that the owner of A will in fact be whoever created A. So if an administrator, or an administrative program, creates A, the "owner" of A is the administrator. Obviously my premise is that I want some access controlled by person, rather than some larger group. 2) Also, I have some permissioning that I want to do in a way broader than person, but more narrow than a particular role I would think appropriate to create in Zope. Specifically, several people may be in the same family. I want the family to have certain access rights (not the same as those for an individual family member). This is easy to implement in code, but does not seem to fit the Zope security model. The only thing I can think of would be to create named family roles on the fly ("familySimpson", "familyFlintsone", etc) but--even if name collisions were finessed--this seems ugly. I also have my doubts that the Zope permission model would work will with the many roles such a scheme would produce. The 3rd reason is practical, rather than fundamental: 3) If I do it myself, I don't have to worry about getting my classes, which I may want to do as simply python objects, to play in the somewhat hard to grasp Zope framework. I welcome comments.

1 0

Calling a stored function with the Oracle DA
by Jim Cain 07 Jan '00

07 Jan '00

All, The "begin procedure (x, y, ..); end;" syntax works for procedures okay, but how do I call a function? The typical quick & dirty way in sqlplus is variable x number -- or whatever begin :x := function (a, b, ...); end; This function actually does updating, so I can't use the pragmas to make it acceptable in a select. Thanks, Jim

1 0

ODMG compliance?
by Kenneth Y.K. YOUNG 07 Jan '00

07 Jan '00

ODMG Compliance On June 14, 1994, the ODMG Board ( http://www.odmg.org/ ) approved a list of object databases as ODMG Compliant and ODMG Certified. ZODB doesn't appear on that list. Ditto for CORBA integration. Anyone knows how standards compliant we are and will be? I can't find any info on that in the FAQ. Kenneth Young

3 3

Showing the "SQL Used"
by David Symons 06 Jan '00

06 Jan '00

Hello. I have been trying to find the way to display the actual SQL query that has been run (in the same fashion as the "SQL Used" displayed while testing an SQL Method). Can anyone help? TIA, David. -------------------------------------------------------- David Symons email: david_symons(a)hotmail.com Canberra, Australia The message below is inserted by the mail provider ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

SybaseDAv2 and identity columns
by Bill Anderson 06 Jan '00

06 Jan '00

OK, so I have an identity column many of my tables. For osme of what I do, I need to select some stuff, and then provide links to search further, based upon this unique id field (identity is a numeric). Normally not a problem...however, the number is returned as: "1L" or "2L", as opposed to "1" or "2". FWICS, this is somehow being reported as a 'long' int, hence the 'L'. Unfortunately, the breaks things, since you cannot get a list of rows, and then serach on the database using the identity section form the result (The actual entry doesn't contain any alpha characters). I have encountered this on HPUX and Linux, and on multiple servers. Anyone have a workaround or fix? Preferable one that does not involve using DTML to strip out the 'L'? TIA, Bill -- In flying I have learned that carelessness and overconfidence are usually far more dangerous than deliberately accepted risks. -- Wilbur Wright in a letter to his father, September 1900

3 3

BTW on ZCatalog Bug
by Jason Spisak 06 Jan '00

06 Jan '00

Using this code: <dtml-in "Catalog(id=id)"> <dtml-var url> <dtml-var absolute_url> <dtml-var "getpath(data_record_id_)"> </dtml-in> I get this response: staff/Companies/19 http://superman:8080/Catalog /staff/Companies/19 Hope that helps. -- Jason Spisak webmaster(a)hiretechs.com

1 0

More on the Absent id bug
by Jason Spisak 06 Jan '00

06 Jan '00

More findings on the extra backslash. The url stored in the Catalog when I ask for: <dtml-in "Catalog(id=id)"> <dtml-var url> </dtml-in> is correct. It has no leading slash. However under the 'Cataloged Items' tab as well as when I use getpath() I get a leading slash. This screws up unindex_object because it's looking for an object without the forward slash, and I guess it doesn't see one. Michel, is this fixed in 2.1.2? Is it related to having old Catalaog Aware ZClasses? It's really drving me crazy. An app that was working yeasterday, is pretty useless today. :( All my best, -- Jason Spisak webmaster(a)hiretechs.com

1 0

RE: [Zope-dev] multiple ZODB files?
by Michel Pelletier 06 Jan '00

06 Jan '00

> -----Original Message----- > From: Anthony Baxter [mailto:anthony@interlink.com.au] > Sent: Thursday, January 06, 2000 2:27 AM > To: zope-dev(a)zope.org > Subject: [Zope-dev] multiple ZODB files? > > > Is it possible to set up a site such that as well as the single > Data.fs file, a seperate folder (say, /foo) is loaded from a different > ZODB file? In particular, changes to stuff inside /foo should > be written > to the foo ZODB file. Not yet, we have not fully thought about this problem of multiple databases, but ZODB was architected to be multi-DB aware. -Michel

3 2

RFC: Possible change to PythonMethod restrictions
by Evan Simpson 06 Jan '00

06 Jan '00

I've been thinking about submitting some changes to PythonMethods, but now that they're going to be part of Zope, I thought I should put the idea out for discussion first. A minor annoying side-effect of the safety restrictions on PMs is that you can't manipulate local data structures directly. For example, if you create a dictionary or list to hold some objects, you can't scan through and delete items from it. You have to build a new list or dict instead. I think it should be possible to safely allow some normally illegal operations as long as Zope can verify that you created the target object. When a PythonMethod compiles its code, the following steps would take place: 1. A dict flagging local names as 'safe' or 'unsafe' (0 or 1) is created, defaulting to 'safe' for all. 2. When a local variable is set to a list or dict literal (BUILD_LIST or BUILD_MAP sequence followed by STORE_FAST) the variable name is left alone. 3. When a local variable is set to anything else the name is flagged 'unsafe'. 4. Index and slice assignment and deletion are allowed on a bare name if the name is still flagged 'safe' at the end. This isn't by any means smart enough to allow all 'safe' cases to be allowed, but it will never let you perform an 'unsafe' operation. It provides just enough leeway for you to create local lists and dicts and do whatever you want to them, so long as you keep them in a local variable. The allowed operations in (4) are, more formally, STORE_SUBSCR, DELETE_SUBSCR, STORE_SLICE*, and DELETE_SLICE* where the first operand is the result of a LOAD_FAST of a 'safe' name. Thoughts? Evan @ 4-am

2 1

url is taking on a '/'
by Jason Spisak 06 Jan '00

06 Jan '00

I'm looking deeper into this problem, and the url() method is not getting rid of the last slash after the host. Cataloged objects end up with addresses like '/FolderA/FolderB/myobject' not 'FolderA/FolderB/myobject'. Has anyone else encountered this bug. I'll bet I'm not the only one. Desprately seeking Susan, uh I mean help... -- Jason Spisak webmaster(a)hiretechs.com

1 0