January 2001 - Zope-Dev

Re: [Zope-dev] How would I keep _v_* attributes from getting thrown away?
by Dieter Maurer 22 Jan '01

22 Jan '01

John D. Heintz writes: > I am using ZODB along with CORBA to expose peristent objects. Some of > my objects have per-connection/session state. > ... > My initial idea is to have a _v_position attribute ... Using "_v_" attributes for session state is a very bad idea. They are thread(!) local and not session local. This means, if a following request of your user (in the same session) happens to get assigned a different thread, it will read and update a different position. Chaos is garanteed (though you will see it only, if your site is loaded). Use a session product (-> zope.org) for session data. Dieter

2 1

DTML block parsing - Patch
by Casey Duncan 22 Jan '01

22 Jan '01

Ok here goes: Install these patches on a 2.3.0b1 installation. The files to patch are found in {Zope Dir}/lib/python/DocumentTemplate. Thus far it seems stable, and I would like for anyone willing to test it out. WHY SHOULD YOU? Although the original purpose of this patch is solve my own problem, it also solves a behavioral bug in <dtml-comment>. That is you no longer need correctly formed and balanced dtml code inside of a <dtml-comment></dtml-comment> pair. This allows them to function as you would expect. Code inside the comment tags is simply ignored. If you develop your own dtml tag class that you want to use to create blocks of something other than dtml, simply add the class attribute disable_dtml_block_parsing=1 along with blockContinuations=() in the tag's class definition. Here are the patches: *** DT_String.old Mon Jan 22 13:06:33 2001 --- DT_String.py Mon Jan 22 15:55:57 2001 *************** *** 272,277 **** --- 272,308 ---- sname=stag sstart=start sa=sargs + + if hasattr(scommand, 'blockContinuations') and\ + hasattr(scommand, 'disable_dtml_block_parsing'): + # Tag doesn't want the block parsed as dtml, so just find the + # end tag and don't parse what's inside + + while 1: + l=tagre.search(text,start) + if l < 0: self.parse_error('No closing tag', stag, text, sloc) + + try: + tag, args, command, coname= self._parseTag(tagre,scommand,sa) + except: + start = l + 1 # Skip malformed tags without raising exceptions + else: + start = l + len(tag) + + if not command and not coname: + # Block end tag + section = String(text[sstart:l], __name__=sname) + section._v_blocks = section.blocks = [section.raw] + section._v_cooked = None + blocks.append((tname, sargs, section)) + try: + r=scommand(blocks) + if hasattr(r,'simple_form'): r=r.simple_form + result.append(r) + except ParseError, m: self.parse_error(m[0],stag,text,l) + + return start + while 1: l=tagre.search(text,start) *** DT_Var.old Mon Jan 22 15:27:30 2001 --- DT_Var.py Mon Jan 22 15:28:14 2001 *************** *** 461,466 **** --- 461,467 ---- ''' name='comment' blockContinuations=() + disable_dtml_block_parsing = 1 def __init__(self, args, fmt=''): pass Feedback on this is definitely welcome. If it is generally well-liked, I will submit it to the collector. -- | Casey Duncan | Kaivo, Inc. | cduncan(a)kaivo.com `------------------>

1 0

dtml-in batching
by richard＠bizarsoftware.com.au 22 Jan '01

22 Jan '01

The dtml-in batching mechanisms are quite difficult to debug - the DTML documentation I have has examples which break it and there's no indication of why. It turns out the DT_In renderwb() code gobbles all exceptions from the rendering of the previous and next blocks. I've hacked my code so that there's no try/except clause any more. I'm not sure what exception it's trying to catch, but could it perhaps be made a little more picky? Richard -- Richard Jones richard(a)bizarsoftware.com.au Senior Software Developer, Bizar Software (www.bizarsoftware.com.au)

2 3

Re: [Zope-dev] ZCatalog scalability
by Dieter Maurer 22 Jan '01

22 Jan '01

Steve Alexander writes: > Michael Bernstein wrote: > > > > Also, is there a way to disable wildcards in full text > > searches? > > Do not allow direct queries to search the catalog. Instead, make > searches go through an external method (or a PythonScript with Proxy > permissions) that uses string.replace to change '*' and '?' to ''. Simply do not use a globbing vocabulary is another alternative. Dieter

1 0

SiteAccess and Catalog
by Toby Dickenson 22 Jan '01

22 Jan '01

Has anyone got a ZCatalog working with SiteAccess? Ive tried 2.2.0 through 2.2.5, and Im seeing that it is storing paths to objects that it cant later traverse. Any help greatly appreciated, Toby Dickenson tdickenson(a)geminidataloggers.com

2 1

Annouce Developer Version DTML-Page-Contract
by ender 22 Jan '01

22 Jan '01

hello zen masters i just finished documenting a developer version of a port of the ACS's (arsdigita community system) acs_page_contract to dtml. test it out, i'm pretty sure everyone will be happy with the simplification of the resulting dtml. feed back and thoughts welcome. if no bugs are found in the next week or so i'll make it a general release, new filters are always welcome. available at http://www.zope.org/Members/k_vertigo/PageContract.tgz kapil readme included below. README.txt INSTALL: extract PageContact.tgz in your zope directory. it will create a python product in lib/python/Products. you will need to restart zope before you can use dtml-contract UNINSTALL: remove the PageContract directory from lib/python/Products and restart zope. I. What Page-Contract is a python product that adds a new type of dtml-tag to your zope installation. dtml-contract is a multi-purpose tag that is designed to provide documentation, marshalling and filtering of request data, and custom error handling of the request data. the documentation comes from a read only section of the contract which should describe the purpose of the object, its author, and some information about its parameters. the marshalling and filtering is done by naming variables expected in the request and associating one or more filters with those variables. PageContract comes with a set of prebuilt filters although it can easily be extended by writing new filters. lastly it allows association of different error handlers to different variables. II. Why Zope already includes facilties to perform simple marshalling of REQUEST values submitted via GET/POST into python data_types. This facility is built into ZPublisher. There are a couple of problems with this facility in real world usage. First, ZPublishers marshalling isn't secure because it retrievesmarshalling info from the REQUEST, a cracker could perform url surgery to by pass the marshalling. Second, ZPublishers marshalling isn't easily extensible to provide application level support of. The marshalling is buried square in the guts of the Publishing process, even if you did extend it would be too early in the Publishing of the object to perform any meaningful application specific processing (ie you don't know where you're going so how do you know what you'll see when you get there). Third ZPublisher has no concept of excluding parts of the REQUEST that aren't needed, this is mitigated by Zope placing the REQUEST on the bottom of the namespace stack, however it still provides a means for accidents (ie. you're expecting this object to have this attr, but it doesn't but the REQUEST has that attr). dtml-contract can optionally strip the REQUEST of variables not explicitly named within it. Fourth, ZPublisher is inflexible about how it handles errors. ZPublisher has hardcoded return values whenever it hits a bad input AND it short circuits the evalutation. Users don't get informative messages regarding their errors other than they made one. dtml-contract differs in that it collects all errors and associates them with their variables and provides the option of custom error pages on a variable by variable basis with information passing about the errors. (The current implementation is limited in that it only passes a list of filter errors to the error handler via a url string.) The dtml-contract also hopes to offer a standardized form of documenting your zope objects (DTML_METHODS, DOCUMENTS, and the like) by standardizing on a documentation format and a location for that documentation. III. How So how do you use it? <dtml-contract> Documentation about this object @author Kapil Thangavelu <k_vertigo(a)yahoo.com> @params myobj_id the id of the object where after @params title we'll set the object's title to this value @params thedate should be the range of the bada and bing @params foobar optional integer value that tells us whats going on <dtml-params> myobj_id:objid foobar:integer,optional thedate:range(date, 1.1.1, 11/11/11) title:string <dtml-exceptions> myobj_id:my_error_page generic_error_page </dtml-contract> Generally dtml-contracts should be used at the start of a dtml page. why? so they can be easily referenced for documentation and knowledge of the expected parameters. Caveats. Note that there are no strict enforcements of the documentation section. Although some future documentation extraction utility would benefit from it:) Also note other dtml tags are not allowed within the dtml-contract, trying to do so will have it abort. this is done mainly as a security feature to prevent malicious code from doing bad things (TM) to your zope server. I have made some attempts to make this code fast. it will ignore obviously alike filters such as :integer,naturalnum and it will execute only naturalnum since it is the more exclusive of the filters. it will short circuit on an optional variable if its not in the request. Full Documentation on the syntax is in README_SYNTAX So how do you write a filter? see the README_FILTER document for more info on filter interfaces. IV. Who @author Kapil Thangavelu <k_vertigo(a)yahoo.com> thanks to Petru Paler for the seed. thanks to the members of Hayholt, AU for testing an alpha version and offering feedback on this documentation. thanks to ArsDigita.com for putting out a quality open source community-toolkit and acs_page_contract upon which this is based. and of course thanks to Digital Creations for creating and releasing Zope PAGE_CONTRACT IS RELEASED UNDER THE GPL. V. When (this section included for completeness:) Where do you want to go tomorrow? www.zope.org, ZopeDealers to the Internet

1 0

OpenBSD 2.8 and Zope - thread errors
by Alexander Limi 22 Jan '01

22 Jan '01

Hi, I stumbled across a problem when trying to run Zope on our brand new OpenBSD 2.8 installation - Zope crashes when you try to access it. I did a search of the mailing lists, and found out that there is something wrong with libc_r in OpenBSD that prevents it from running Zope. The message can be found here: http://lists.zope.org/pipermail/zope/2001-January/038400.html Does anybody here know if anything has been done about this? I tried the OpenBSD mailing lists, but couldn't find anything. And is running Zope 2.3beta2 on Python 2.0 an option? Will that work? Or is Python 2.0 also suffering from this bug? The LD_LIBRARY "hack" mentioned in the mail I referred to above doesn't sound like a good idea to me. Not a lasting one, anyway :) Regards, Alexander Limi

1 0

CSS file serving
by richard＠bizarsoftware.com.au 21 Jan '01

21 Jan '01

I've ended up hacking a version of special_dtml / ClassicHTMLFile that serves up CSS. Has anyone got a better way of doing it (that detects changes in the file and serves it up with the correct Content-Type)? Richard -- Richard Jones richard(a)bizarsoftware.com.au Senior Software Developer, Bizar Software (www.bizarsoftware.com.au)

2 2

Re: [Zope-dev] skinscript and URL traversal question
by Aaron Payne 21 Jan '01

21 Jan '01

At 09:38 AM 1/19/01 -0500, Phillip J. Eby wrote: > >>This is probably a permissions issue. During __bobo_traverse__, the user > >>has not yet been authenticated, and is effectively anonymous. > > > >I was logged in as a manager. > >That would not make any difference. As I said, when __bobo_traverse__ is >called, nobody is "logged in", because Zope hasn't gotten around to >checking who you are yet. > > > >>Thus, your > >>SkinScript is running as anonymous, and probably doesn't have rights to > >>access the SQL method. > >>You might need to change the proxy roles setting on > >>the SkinScript method so that when the SkinScript runs it always has > >>appropriate roles to do what it needs to do. > > > >I gave the skinscript trigger a proxy role of manager. Actually, I gave > >all methods involved a proxy of manager. The same error was produced. > >What version of Zope are you using? Zope version: Zope 2.2.1 Platform: freebsd4

2 2

LoginManger: multiple LoginMethods
by John Eikenberry 20 Jan '01

20 Jan '01

Just got a basic loginmanager setup working with an SQL backend based off the howto. Very simple once I figured out a couple things (thanks dlpierson whoever you are). Anyways... I want to be able to support both cookie based auth and basic auth. With cookie based auth being the default unless they don't have cookies (either because they have them turned off, behind a proxy filter, etc), in which case they should use basic auth. The problem is I'm not sure how to get it to use something other than cookie based auth. The default setup tries to use cookie auth whether or not cookies are in use. Any tips on how to get this working? I know there is no great way of detecting cookies, besides setting one and testing for it. But even if I did this, how do I say I want basic auth if the test cookie isn't found. Thanks in advance for any tips/advice. -- John Eikenberry [jae(a)zhar.net - http://zhar.net] ______________________________________________________________ "A society that will trade a little liberty for a little order will deserve neither and lose both." --B. Franklin

2 1