October 2000 - Zope-Dev

Getting all objectIds, recursively (ZODB)
by morten＠esol.no 15 Oct '00

15 Oct '00

Is there a method available that'll return a nested list of ids (or something similar) of the current object? -Morten

2 2

RE: [Zope-dev] (no subject)
by Gregor Heine 15 Oct '00

15 Oct '00

> I recently asked how to read in and render the contents of > an external file, which doesn't work anymore using > Zope 2.2.2 an LocalFS' xxx.read(), and You responded that > > > The quickest solution for you would be an external method > > that gets the file, performs the "read" and returns the result. > > Now I use in an external method fsreadin a .py-module with > > import sys > def readinfile (self, html): > """Ralf Herolds way to read in local file objects.""" > file = open(html, "r") > filecontent = file.read() > file.close() > return filecontent > > which is referenced in a DTML method by > <dtml-var "fsreadin('/tmp/var/thewantedtext.html')">. > > It works, but I almost cannot believe that this is that > simple - am I missing something, is security a concern? > It *is* that simple. The only problem is security. That way, you can read *any* file that has read permission for the user, the zope process is running on, e.g. everybody could use something like http://your.host/fsreadin?html='/etc/passwd' to view your password file. If you want to read files only from one directory, you could use: import sys, os, string def readinfile (self, file): """Ralf Herolds way to read in local file objects.""" file=file[max(string.rfind(id,'/'),string.rfind(id,'\\'),string.rfind(id,':' ))+1:] path=os.path.join('/tmp','var',file) file = open(path, "r") filecontent = file.read() file.close() return filecontent This would ensure, that only files from /tmp/var can be read. Cheers, Gregor!

1 0

Inconsistent behaviour in Zope's constructor security check?
by Stephen Simmons 15 Oct '00

15 Oct '00

I have just concluded an epic two day struggle with Zope's security machinery. I think I've won, and wanted to find out whether anyone else has had similar problems. I had defined a Python product that worked very nicely. I was able to add and delete my objects and edit, copy and export them perfectly well. But when I tried to rename, paste or import them, I got an exception saying that "The object X does not support this operation". It appears that security checks for permission to add an object to a Folder is done differently by the Product Add machinery and the CopySupport machinery that paste/rename/import use. I had defined my constructors slightly unconventionally in __init__.py. Redefining the constructors more normally solved my immediate problem, but it doesn't remove the source of Zope's inconsistent behaviour. More details of the diagnosis are at the end of this email, for those who are interested. Is this something I should put in the collector? One happy result of this mess is that I am now on a first-name basis with about 80% of the Zope source code! Stephen ___________________________________________ Stephen Simmons, stephen.simmons(a)healtharena.net HealthArena B.V., Amsterdam, The Netherlands phone +31 20 486 0555; mobile +31 6 1505 3086; fax +31 20 486 0559 Problem copying/pasting and renaming ------------------------------------ I was able to create new instances of my Element class, but whenever I tried to rename, cut/paste or import the objects, _verifyObjectPaste() in CopySupport.py raised a Copy Error (The object X does not support this operation). _verifyObjectPaste() performs three checks: (i) The container is happy having an object of this type being pasted into it (ii) The user is allowed to create new objects of this type (iii) The user is able to access the object being pasted or renamed All three conditions were true, so there is no reason why renaming, etc should be prevented. Especially when I could create objects as desired through the management screens. Solution -------- The problem was traced to the unusual way I had defined the constructors in __init__.py and the class's module. It appears that getSecurityManager().validateValue(meth) does not exactly duplicate the check done when adding a product instance. Originally, I removed the constructor definition tuple from __init__.py: def initialize(context): """Register Element""" context.registerClass( PlatformElement.Element, constructors = (PlatformElement.Element), # Specified indirectly! icon = element.gif ) and put it at the end of my class definition module, PlatformElement.py: class Element(Folder): ... def manage_addElement(self, id, name='', title='', REQUEST=None): """Create an Element""" ... Element_constructors = ( ('manage_addElementForm', HTMLFile('Element_add', globals())), ('manage_addElement', manage_addElement), ) In this case, check (ii) was failing at line 390 of CopySupport.py when trying to validate the constructor manage_addProduct/HAPlatform/manage_addElementForm. The problem was fixed by changing the constructor definition to the more conventional form: In __init__.py: def initialize(context): """Register Element""" context.registerClass( PlatformElement.Element, constructors = ( # Specify constructors explicitly! PlatformElement.manage_addElementForm, PlatformElement.manage_addElement, ), icon = element.gif ) In PlatformElement.py: ... manage_addElementForm = HTMLFile('Element_add', globals()) def manage_addElement(self, id, name='', title='', REQUEST=None): """Create an Element""" ... While this fixes the problem, it leaves unresolved the question of why Zope's security machinery was happy using the original constructors but barfed when checking whether it could use them.

1 0

New ZPatterns documentation on the Wiki
by Phillip J. Eby 14 Oct '00

14 Oct '00

There is a new document on the Wiki which explains in excruciating detail how triggers/rules work in ZPatterns: http://www.zope.org/Members/pje/Wikis/ZPatterns/HowTriggersWork I have also now completed the SkinScript reference documentation at: http://www.zope.org/Members/pje/Wikis/ZPatterns/SkinScriptSyntax In addition to a detailed definition of all SkinScript statements, variables, and syntax, the reference includes 19 short "real world" SkinScript examples ranging from very simple to very complex. Examples include data movement to/from SQL and ZCatalog, as well as other Specialists, and various kinds of "alert"-type triggers. Please note that the SkinScript syntax described is "slightly ahead of its time" in documenting a few features that are only available in an as-yet unreleased ZPatterns. I'm holding up the release of 0.4.3 for additional documentation and I'm also waiting on Ty to get a LoginManager 0.8.8 release together, as there were some changes that had to be made to LM for compatibility with ZPatterns 0.4.3, relating to my recent addition of ZClass support for PlugIns (yay!). Feedback on the above documentation is welcome. Thanks. _____ _/__) ___/

1 0

RE: [Zope-dev] (no subject)
by ralf.herold＠charite.de 14 Oct '00

14 Oct '00

Hello Dieter, dear list readers, I recently asked how to read in and render the contents of an external file, which doesn't work anymore using Zope 2.2.2 an LocalFS' xxx.read(), and You responded that > The quickest solution for you would be an external method > that gets the file, performs the "read" and returns the result. Now I use in an external method fsreadin a .py-module with import sys def readinfile (self, html): """Ralf Herolds way to read in local file objects.""" file = open(html, "r") filecontent = file.read() file.close() return filecontent which is referenced in a DTML method by <dtml-var "fsreadin('/tmp/var/thewantedtext.html')">. It works, but I almost cannot believe that this is that simple - am I missing something, is security a concern? Thanks for answering, Yours. Ralf Herold mailto:ralf.herold@charite.de http://www.knm-poh.charite.de/ > -----Original Message----- > From: Dieter Maurer [mailto:dieter@handshake.de] > Sent: Wednesday, October 04, 2000 1:46 PM > To: ralf.herold(a)charite.de > Cc: Zope-Dev(a)zope.org > Subject: Re: [Zope-dev] (no subject) > In earlier Zope versions, a method without a permission meant > "can be used freely". Now, it means "cannot be used via DTML/URL". >

1 0

Recursive Folders programatically
by Jason Spisak 13 Oct '00

13 Oct '00

Zopists, I forgot about the 'let' tag. It ain't pretty but it works. Here's the code in DTML for recursive folder generation: <dtml-in expr="_.range(0, 2)"> <dtml-let a=sequence-item> <dtml-call "manage_addFolder(_.str(a), _.str(a))"> <dtml-in expr="_.range(0, 2)"> <dtml-call "_.getitem(_.str(a), 1).manage_addFolder(_.str(_['sequence-item']), _.str(_['sequence-item']))"> </dtml-in> </dtml-let> </dtml-in> ugly. Sorry to mail when the answer was in the vaccum of my memory. All my best, Jason Spisak 444(a)hiretechs.com

1 0

Programatically trying to create recursive folders
by Jason Spisak 13 Oct '00

13 Oct '00

Zopists, In orderto get around the confliting writes issues I am experiencing, I would like to create recrusive folders like, /0/1, /0/2, etc., so that my objects will be in many different folders. I am trying to get DTML to create these pre-set drop folders automatically, but am unable to do so. The following code throws an id already in use error, because the 'with' tag is not letting the newly created object's namespace be used for the creation of the second folder. <dtml-in expr="_.range(0, 2)"> <dtml-with "manage_addFolder(_.str(_['sequence-item']), _.str(_['sequence-item']))"> <dtml-in expr="_.range(0, 2)"> <dtml-call "manage_addFolder(_.str(_['sequence-item']), _.str(_['sequence-item']))"> </dtml-in> </dtml-with> </dtml-in> Any ideas? All my best, Jason Spisak 444(a)hiretechs.com

1 0

Re: FW: [Support] [ZOPE Collector] Zope Bug entry: Ghost ZClasses
by Shane Hathaway 13 Oct '00

13 Oct '00

Brian Lloyd wrote: > > A new bug entry was added with the following information: > > > > Title: Ghost ZClasses > > > > At: http://classic.zope.org:8080/Collector/1676/sview > > > > Submitter: lalo > > > > Email: lalo(a)hackandroll.org > > > > Description: Some ZClasses in a ZODB migrated from 2.1.6 did not > > handle the migration well. Their instances were reported as > > broken, till I removed the Product, when the instances started > > working (but with no icon, factory or constructor). I would have to guess that the cause may be a product that was supplying a base class wasn't installed. > > I tried flushing the cache, packing the database and restarting > > Zope, to no avail. Then I found there was a global registry for > > ZClasses; looks like somehow, when the classes were deleted, they > > didn't _unregister(). > > > > I finally tired of not being able to create banners and manually > > removed the classes (via Python) from root()['ZGlobals']. Not > > that this is a fix, but it's something other people with the same > > problem can do if they're brave (insane?) enough. This is actually expected behavior: if the ZClass itself is broken, Zope can't even figure out what class ID it was supplying. ZClasses break when the base classes disappear. At that point, there's no way to unregister from ZGlobals. This is a Hard Problem. At the moment the only way I see fixing it is a big change to ZClasses. Shane

1 0

WriteLocking Proposal Revisited. Again.
by Jeffrey P Shell 13 Oct '00

13 Oct '00

WriteLocking <http://dev.zope.org/Wikis/DevSite/Proposals/WriteLocking> Revisited and rewritten again after some internal discussions and a decision to ensure that the proposed Write Locking for WebDAV behaves in a matter that the clients (particularly the more popular ones) expect. There's less architectural discussion in this revision of the proposal, intentionally. --jeffrey

1 0

more __call__ ...
by Chris Withers 13 Oct '00

13 Oct '00

(moving back onto list, hopefully my head/wall contact will save others braincells ;-) Jim Fulton wrote: > > On an (almost) related matter, are there any docs (other than the code > > ;-) for how __call__ is handles WRT to <dtml-var something>? > > I had a look at DTMLMethod.py and PythonMethod.py and ended up very > > confused... > > Currently, DTML looks at something that it is going to render > and tries to decide if it's callable. If it is, it checks to > see if it has a true isDocTemp attribute. If an object is callable > and has a true isDocTemp, then it is called with None and the DTML > namespace. Otherwise, if an object is callable, it is just called. So, if I give my product a class attribute of isDocTemp=1, what signature should I give my product's __call__ method so it picks up the DTML namespace? > We are going to provide an alternate interface, so that if > an object has a special method, then this will be called instead. okay... which proposal/project is this in? > > I think the 'client', rather than 'self' is what I'm after, but how can > > I get it inside my product's __call__ method? Hmmm... I don't suppose there's a nice definition of what the 'client' is, what's likely to be in the namespace stack and what self is likely to be in these circumstances lying around anywhere, is there? ;-) > You can't really. You should be able to infer it from the acquisition > context. For example, 'client' should be aq_parent. def __call__(self): """ """ print self.aq_parent.id This is called by a <dtml-var myObject> in standard_html_header which is also called with a dtml-var in, lets say, the DTML documnet: myDocument. The above code prints the id of this product instance's container. I was expecting it to print the id of myDocument. Is this me misunderstanding what the 'client' is, or is something else going on? In either case, what do I need to go to get hold of what would be PARENTS[0-1], if you see what I mean? > Note that subtemplates > are not invoked on the objects they are found in, but in the namespace > they are called in. This is a bit weird and not really intensional. :( I think I'm probably going to be relying on this, and I _think_ it makes sense to me. I presume subtemplate calls are things like doing <dtml-var myObject>? In which case it seems sensible to keep playing in the namespace and just popping myObject on top as an instanceDict. I'm note quite sure how you think this area should work adn what difference it would make, could you elaborate? :-S > > PS: In python product terms, whats' the difference between implementing > > __call__, __str__ or render? > > render? Yeah, that's what I thought, but a coupla people have mentioned it. Maybe they're thinking of DTML tags? > __call__ implements the () operator (in C++ terms). It is the method > you implement to make your object callable. > > __str__ is the method you implement to control how your object is > converted to a human readable string. So what's the difference in terms of doing <dtml-var myobject> and http://site.com/myobject, if there is any? cheers, Chris PS: What I'm actually looking for out of all of this is the getPhysicalPath() of the final object that was traversed through the URL. e.g: If the URL was http://www.nipltd.com/folder/somethingelse/myobject, I'm looking for something like: [<Application Instance at 0x000000> (Zope) , <Folder Instance at 0x000000> (folder) , <DTMLDocument Instance at 0x000000> (myobject)] If there's an easier way to get this from within the __call__ method of a python product, someone PLEASE tell me! ;-)

6 20