January 2001 - Zope-Dev

Re: [Zope-dev] protocol accesibility
by Chris Withers 05 Jan '01

05 Jan '01

Toby Dickenson wrote: > > > That's not been my experience, but maybe that How-To would help :-) > > Care to write it? ;-) > > It is on my todo list cool :-) > > Protocol independence is not necessarily a good thing in this case. > > Different protocols have different capabilities. > > The zope way of modelling different capabilities is through roles. The right > way to achieve this is to allocate different roles based on protocol. how do you do that? (refs to how-to's, docs, etc all good, just that I never knew you could do that :-) > You could do this today using LoginManager, which allows for roles to be > *computed* during authentication. Give your users different roles depending > on whether they use http or https. ( or ftp? > Indeed, I would be keen to see this > feature in the standard user folder) Maybe that's what I should haev said in my proposal ;-) > Note that protocol is not a key factor here: you might also trust them more > if the socket connection comes from localhost. very true > > http://www.zope.org/standard_html_header > > Can you explain *why* this is a problem? While I agree it's untidy, its only > an untidyness seen by people who go looking for it. Some people (or am I the only one ;-) don't really find that acceptable. The paranoid part of me also wants to know that it isn't possible to find this, as it should only be used by other stuff inside zope, why should stuff outside of zope get to play with it? > > http://www.cbsnewyork.com/objectIds are left hanging out. > > I propose securing the 'access contents information' permission, and you > havent explained why this is flawed. Securing the permission? perhaps you could explain that a bit more :-S > > http://www.cbsnewyork.com/rubbish ain't none too nice either, likewise > > That document has since been removed. Nope, that's the point, it give a yucking Zope Error which lowers user confidence, rather than saying 'that page wasn't found, perhaps you'd like to look here or here', but, to be fair, that's because whoever built that site didn't bother to make standard_error_message useful (don't get me started on tacking tracebacks on the end of html generated by that page ;-) > > http://www.cbsnewyork.com/manage... > > I get an authentication dialog.... so? Hit cancel. Again, a yucky Zope error rather than saying 'sorry, your username or password were wrong', or, in reference to this thread, not actually being _visible_ to this protocol at all. eg: should raise a 404, as standard_html_header should ;-) cheers, Chris

1 0

Re: [Zope-dev] protocol accesibility
by Chris Withers 05 Jan '01

05 Jan '01

Toby Dickenson wrote: > > IMO their goals are achieved better, and simpler, with a HOWTO > that explains how to configure the 'access contents information' permission. That's not been my experience, but maybe that How-To would help :-) Care to write it? ;-) > I think perhaps you havent appreciated the simplicity of the current > arrangement - all protocols work the same. That remains to be proved, even given the DTML wart you mentioned ;-) > Your word 'accidentally' is a good hint as to the reason. A better (IMO) > principal is 'protocol independance' - a method should behave the same no > matter how it is called. Protocol independence is not necessarily a good thing in this case. Different protocols have different capabilities. For example, you might trust someone a lot more if they were using HTTPS rather HTTP. So, there is a disagreement here. What I proposed would enable us both to be happy, without anymore work on your part thanks to defaults that leave things as they are now. Your point of view leaves only you happy ;-) > > How would you hide things like standard_html_header and _footer from > > users? > > Im not sure why they need to be, please explain. I dont think 'tidyness' is > a sufficient reason. I do, and I'm sure others do to. It's doesn't look very professional when things like http://www.zope.org/standard_html_header and http://www.cbsnewyork.com/objectIds are left hanging out. http://www.cbsnewyork.com/rubbish ain't none too nice either, likewise http://www.cbsnewyork.com/manage... cheers, Chris

1 0

Re: [Zope-dev] Product dev
by Dieter Maurer 05 Jan '01

05 Jan '01

Tim McLaughlin writes: > I'm building a Product in Python and seem to be having some issues with the > new registerClass method of Product registering. If I build it all fine as > noted in Shane's recent HowTo, the product does not show up in the control > panel. Then after much other chasing, I make a purposeful syntax error in > the code, and the Product shows up to reflect its brokenness and shows me > the syntax error. Then when I try to fix the error, and do a restart, the > error still shows as if I had not changed the code. I checked _many, many_ > times, and now the code is different, but Zope seems not to recognize the > changed code in spite of my deletion of the pyc files. I have seen this several times: For some problems during product import, Zope decides to keep the old state rather than show the error. This is *very* confusing. If you have a sufficiently recent Zope version (I think, at least Zope 2.2.2), then enabling the "stupid logging mechanism" should give you an error indication in the log file. You activate this logging through a parameter: STUPID_LOG_FILE=zope.log for your start script. Dieter

3 5

Objects with multiple parents and storage flexibility, ZPatterns?
by Chris Withers 05 Jan '01

05 Jan '01

Hi, Once again I'm back at trying to solve this problem, hopefully with a little more knowledge this time ;-) What I'd like: 'Zope' objects of type 'X', which can have multiple parents and can contain other objects of type 'X', where storage isn't necessarily tied to the ZODB but where the objects have a normal properties page (in terms of use, again, it'd be nice if it could be stored anywhere) and participate in all the normal Zope security and management interface processes, and they need to be catalogable. This sounds like ZPatterns to me, am I right? If so, it appears there are two choices: 1. Folder w/Customiser Support (FwCS ;-) and DataSkins 2. Specialist with one or more Racks and DataSkins Which one of these would be most appropriate? FwCS containg DataSkins that also mix in the Folder class sound like they'd give a closer approximation to 'real Zope objects', but Racks sound like the only way that objects of the same metatype can come from different sources (eg, some objects of type 'X' from ZODB, some from SQL, some from LDAP ,etc) and seem to be more flexible in general, but can I have DataSkins that nest stored in a specialists' rack, eg: http://server:8080/specialist/dataskin1/dataskin2 How about doing something like: http://server:8080/specialist/dataskin1/dataskin2/manage ? Any help is good help, sorry this is a bit rambling, if you need mroe info, I'll be happy to supply it :-S cheers, Chris

4 7

ZPatterns question
by cs＠comlounge.net 05 Jan '01

05 Jan '01

Hi there! Finally I managed to get a basic understanding of how to do things with ZPatterns ;-) So seems quite cool :) (and hopefully I find some time to write some basic howto about it) But I have some little questions: 1. Is it possible to retrieve the set of known IDs from a specialist? Or would I need to add my own method to it which does this (and change it accordingly if I switch to another storage method)? 2. Is it planned to provide something like a virtual folder which acts like a normal object manager but is controlled via ZPatterns (so actually something like Folder with Customizer Support just without the "anchor" in ZODB. (would also require some mechanism asked for in 1.) 3. Is it possible to use ZPatterns also without some exta ZClass defined in a Product? At least if I don't need methods for my objects but simple want to define the attribute they know. Would be nice as I could then hold everything together in one place (the specialist that is) without requiring to install something also in the Products folder of the Control Panel. That's it for now, I will keep experimenting then.. :) cheers, Christian -- Christian Scholz MrTopf@IRC COM.lounge http://comlounge.net/ communication & design cs(a)comlounge.net

4 9

RFE: Make PythonScripts.standard available from DTML _.standard
by Steve Alexander 05 Jan '01

05 Jan '01

This is an RFE for Zope 2.3. I'm posting it here for discussion, rather than in the Collector. In the new PythonScripts product (that is a standard part of Zope 2.3) there is a standard utility module that can be imported into a Python Script with import Products.PythonScripts.standard or from Products.PythonScripts.standard import * It contains useful functions such as those for text formatting (html_quote, url_quote_plus, and so on). It also contains the DTML class for creating temporary chunks of restricted DTML. These functions would be really useful as part of the DTML _ namespace variable. I sometimes find myself wanting to use html_quote in a DTML expression. I'd also be able to use these functions from ZPatterns SkinScript. The PythonScripts product could add these functions to the _ namespace variable at product init time, so there would be no need to change the DocumentTemplate modules. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

2 4

Re: [Zope-dev] protocol accesibility
by Chris Withers 05 Jan '01

05 Jan '01

Toby Dickenson wrote: > > On Fri, 05 Jan 2001 12:18:07 +0000, Chris Withers <chrisw(a)nipltd.com> > wrote: > > >http://www.zope.org//Wikis/DevSite/Proposals/ProtocolAccessibility > > > >So it is :-) > > > >Comments are still welcome... > > Comments provided as requested With sensible defaults, what I was proposing would be just as simple as things are now, but explicit and flexible. For example, if you start a method name with _, it's not URL traversable, or available in DTML. I have no idea about FTP but it probabyl won't be accessible through DAV. Alternatively, if you give a method in a python a doc string, it will be URL traversable. Take that doc string away and it won't be url traversable but will be accessible in DTML. Again, don't know about FTP or DAV. I agree the wording might be bad (that proposal is very old now), but how can something that seeks to clearly define and document something that has already been partially and accidentally implemented (as was often the Zope way ;-) be a bad thing? cheers, Chris PS: How would you hide things like standard_html_header and _footer from users? Access Contents Information is needed by a lot of methods (some of which aren't available to give proxy roles to) that using it to prevent peole from sniffing around in your site isn't feasible.

1 0

objectIds -- accesible for everyone -- why?
by morten＠esol.no 05 Jan '01

05 Jan '01

If you type in http://www.zope.org/Members/objectIds you get a list of all Members. Although it is a useful feature.. ;) .. I can't really see why objectIds should be available for everyone, at any given time. Is this a bug or a feature? -Morten

10 15

Re: [Zope-dev] case insensitive sorts
by Dieter Maurer 05 Jan '01

05 Jan '01

Chris Withers writes: > Andrew > bart > David > sophie > Wayne Why in hell do you switch caseness for similar objects? If you apply some naming conventions, such as "objects start with a Capital letter, verb with a lowercase letter", you may find Python's sorting order usefull. Dieter

3 5

Internationalization
by Keith.Larson＠Spatial.Com 05 Jan '01

05 Jan '01

Hello, Has anyone translated a site within Zope ? I have tried the ZBabel Translation System (http://www.zope.org/Members/TheJester/ZBabel) and didn't think it did really what I was after. I need to translate the site into French , German , and Japanese . I assume the best way is to pull the different languages from a database via a python external method or just Zmysql Any help would be appreciated Keith Larson

2 1