April 2001 - Zope-Dev

Security Management
by Andre Schubert 14 Apr '01

14 Apr '01

Hi all, I have a question on the security system of zope. First i have a folder called foo in the root with acl_users and a doc called foo_doc: root/ bar_doc foo/ acl_users/ joe foo_doc If Anonymous users could'nt view the foo_doc. This means only logged in users like joe could wie the foo_doc. Now my question is: When joe is logged in in foo to view the foo_doc, and after that he view bar_doc he is authenticated as Anonymous in the bar_doc REQUEST (right??). But is there a way to find out that the current REQUEST comes from joe and joe has no user object in the root acl_users. I played with getSecurityManager, but it doesn't work Can anybody help please as

2 1

Re: [Zope-dev] memory leak
by Karl Anderson 13 Apr '01

13 Apr '01

Marco Nova <nova(a)tera-it.com> writes: > I've replaced ParsedXML's ExpatBuilder with the pyXML package and I used the > sax parser without modifing the code (except for the import), this is the > refcounts results. > > Class April 12, 2001 11:55 am April 12, 2001 12:00 > > xml.dom.NodeList.NodeList 2103 3678 +1575 > xml.dom.Text.Text 1263 2208 +945 > xml.dom.NamedNodeMap.NamedNodeMap 507 885 +378 > xml.dom.Element.Element 499 871 +372 > xml.dom.Attr.Attr 339 591 +252 > xml.dom.DocumentType.DocumentType 7 10 +3 > xml.dom.Document.Document 7 10 +3 > > xml.dom.Document.Document increments by 1 each time an xml is procesed (I > tried to add a del doc at the end but it's ineffective). > > So the problem is not ParsedXML but Zope itself or my bad methods. Not necessarily - it's been mentioned that PyXML requires releasing nodes after they're done, so I'd expect this if you replaced ParsedXML's DOM with PyXML's without adding the release. -- Karl Anderson karl(a)digicool.com

1 0

general ZMySQL question-wierd results
by sean＠horse101.com 13 Apr '01

13 Apr '01

I am just trying to learn to use mysql and zope together (relatively new at both) . Can can create tables, but when I view them I only see the first character of any given value. If the table is named farm, I can see it listed with show tabled from my_database at "f". Likewise, when I select * from my_table, I see the fields listed with value of single chars in each one and they appear to be the chars that make up the text of my very last field value. P r o v i d e s (each char is the value of a colum) I am not sure how to even focus this question more than this, but what is goin on? When I create a second table named farm_test and then BROWSE MYSql connection object I see two things there... F and F. Each one has the word table under it when expanded. Here is how I created the tables: CREATE TABLE farm ( owner_id int primary key not null auto_increment, farm_name char (40), discipline char (30), owner_fname char(30), owner_lname char(30), farm_address1 char(50), farm_address2 char(50), city char(30), state char(2), zip char(5), country char (20), phone_area_code char(3), phone_no_area char(10), fax char(13), url char(30), email char(15), nearest_city char(15), nearest_city_distance int, add_date date, edit_date date, details char (250)) Here is how I populate the first record: insert into horse101.farm (owner_id,farm_name,discipline,owner_fname,owner_lname,farm_address1,farm_addr ess2,city,state,zip,country,phone_area_code,phone_no_area,fax,url,email,nearest_cit y,nearest_city_distance,add_date,edit_date,details) values(0,'Riverbed Farm','dressage','Vicki','Wall-Kelley','Volkerts Rd.','','Sebastopol','CA','95472','USA','707','829-5824','425-123- 1234','http://www.dressage.to','webmaster(a)dressage.to','San Francisco',60,2001-04- 10,2001-04-10,'Providing dressage instruction, training, judging as well as offering for sale imported and domestic dressage prospects.') Here is how I attempt to see the records: select * from farm Here are my results: Owner id= P Farm name=r Discipline=o Owner fname=v ,etc. You see, the last field is being inserted into the other fields one char at a time. Any help would be GREATLY appreciated.

2 1

RE: [Zope] REQUIRING Python 2.1??
by anser 13 Apr '01

13 Apr '01

> You may have more than one Python installation on a machine. This in no > way forces you to move "all of your applications" to 2.1. The binary > releases in particular make this drop-dead easy; they come with a bundled > Python, and do not affect any other Python you may have in any way. right, but by the same token the binary releases won't require special warnings to people about upgrading to 2.1. > And > note that Zope is a pretty diverse community - just because i18n > is not very important to _you_ does not mean it is not important. > There are plenty who consider it hugely significant, and who > are at least as perturbed that we _haven't_ done this yet. The question is not whether i18n ought to be done, but whether you ought to require upgrading to Py 2.1 to achieve it. >> On the basis of prior performance I do not expect this objection to make >> any difference in what DC does, but I needed to express it anyway. > > You may find that making your objections in a less inflammatory > way will give them more impact. I do not know how one would measure "impact" in order to test this proposition. If "impact" means changing DC policy or software in any way, then I suspect as previously stated that hearts+flowers wouldn't get it done either. If "impact" means that the question would get a response, well, this thread's existence may be a counterexample. What I do know is that requiring an upgrade to a not-yet-gold Py release as a prerequisite to the next Zope release is unwise software policy.

4 3

RE: [Zope-dev] un-own an object
by Tim McLaughlin 13 Apr '01

13 Apr '01

I meant create an instance of a ZClass owned by a user who no longer exists (if my 'construct' word made no sense - haven't had coffee yet ;-) ). -----Original Message----- From: Tim McLaughlin Sent: Friday, April 13, 2001 7:31 AM To: 'Chris Withers'; R. David Murray Cc: Tim McLaughlin; 'zope-dev(a)zope.org' Subject: RE: [Zope-dev] un-own an object you can always do a copy and delete to take ownership... (albeit that may cause other probs...) my problem is that I need to be able to construct a zclass built by a user who no longer exists. My suspicion is that "nobody" does not have those privileges, and so it seems that I may be SOL :-( -----Original Message----- From: Chris Withers [mailto:chrisw@nipltd.com] Sent: Friday, April 13, 2001 5:50 AM To: R. David Murray Cc: Tim McLaughlin; 'zope-dev(a)zope.org' Subject: Re: [Zope-dev] un-own an object "R. David Murray" wrote: > > Like I said (and the docs say), it is the interesection of the two > sets of privileges, so it is effectively just the permissions of > user nobody. This isn't very useful though ;-) I ended up re-creating a whole folder tree just because I wanted to delete the user who created them, and Zope 2.2.4 doesn't appear to have a 'Take Ownership' button :-( *grumbling* Chris :-)

2 1

Query on ZODB handling of class variables
by Bob Weiner 13 Apr '01

13 Apr '01

Hi all: I'm doing some prototyping using the standalone version of ZODB from AMK (March 30, 2001 release, the latest). Things generally work as AMK has documented them but one issue has cropped up on which I could use your feedback. My reading of the ZODB code is that it uses pickling to store objects and the Python documentation on pickles say that classes are not pickled, only their names are. I have a counter class which inherits from Persistent and contains a class attribute which needs to be persistent but seems to be the only thing in my system not restored when I reload my ZODB instance (and this jives with the pickle documentation). (If it matters, this class has an __getinitargs__ method but now __getstate__ or __setstate__ methods.) So how does one get class attributes (one attribute instance per class) stored into and restored from ZODB? If this is not automatic, it would seem that a __getclassargs__ type method might be required. Or am I just doing something wrong? Also, if there is any documentation on how to debug ZODB sessions (I know there are debugging conditionals built in but I haven't found any documentation.), I could use a pointer. Thanks, Bob

1 0

REQUIRING Python 2.1??
by anser 13 Apr '01

13 Apr '01

[ First of all, I wish people (including Digicoolers) would title their messages descriptively, not just say "Important notice" or whatever. I'm sure many of us consider our words important :) ] Second, I am MYSTIFIED (there's no better word) that DC is in such a rush to REQUIRE the use of Python 2.1 for Zope 2.4, when we're still waiting for Py 2.1 final to even come out. Why put all your eggs in that basket, and why force the community to choose between changing to a bleeding-edge Python or retiring to a frozen Zope rev? Does DC not realize that Python has OTHER applications besides Zope? and that for a given community site, changing Pythons might have unexpected side effects in systems whose developers are less gung-ho about rushing to 2.1 than DC is? I thought I'd set my mind at ease by reading the wiki Brian referred to -- which is called "SupportPython21" although it should apparently have been named "RequirePython21" -- but all I could glean from their justifications was [1] it'll make i18n easier (wow, that's huge), [2] there's some other things with strings and such that "may" be useful, and [3] of course there's a raft of other potentially disruptive differences, but hey, at least we found a way to make i18n easier! I can't quite help wondering whether someone at DC has maybe gotten so "into" the development of Py 2.1 that they just can't wait to use its new stuff, whether it's objectively what's best for Zope or not. The prudent thing to do would have been to add features as needed using 1.5.2-compatible code, or at best to offer a "new18n" branch that requires 2.1, which people who are THAT desperate for i18n could choose to follow if they wanted. Then, say 6-12 months after 2.1 is gold, you could unify and require it for 3.0. Instead, for the sake of being able to let the Python developers stick a Zope logo on the 2.1 release, we are risking a boatload of trouble. On the basis of prior performance I do not expect this objection to make any difference in what DC does, but I needed to express it anyway. That gives me a thought - anyone for "Rope"? :)

6 5

Re: [Zope-dev] getattr'ing proxy object's methods
by Dieter Maurer 13 Apr '01

13 Apr '01

Kent Polk writes: > .... I do not understand your goal precisely... However, the surrogate technique used in "CMFCore.DirectoryView.DirectoryView" may come near to your proxie objects. Dieter

2 1

Re: [Zope-dev] How do I call an HTMLFile in context provided by a path?
by Dieter Maurer 13 Apr '01

13 Apr '01

Itai Tavor writes: > I have a method that receives a path: > '/MyApp/SomeSpecialist/some_id/edit_html' and has to call edit_html > in the context of some_id. If edit_html is a DTML Method, I can do > this: > > obj = REQUEST.traverse(path) I would use "restrictedTraverse" instead of "REQUEST.traverse" as it uses less magic. > ... > > But when edit_html is an HTMLFile in a Python Product, obj.aq_parent > doesn't work. Why not? This would mean that either your product is not derived from ExtensionClass.Base or that "HTMLFile" is not derived from "Acquisition.Implicit". Dieter

3 4

RE: [Zope-dev] un-own an object
by Tim McLaughlin 13 Apr '01

13 Apr '01

you can always do a copy and delete to take ownership... (albeit that may cause other probs...) my problem is that I need to be able to construct a zclass built by a user who no longer exists. My suspicion is that "nobody" does not have those privileges, and so it seems that I may be SOL :-( -----Original Message----- From: Chris Withers [mailto:chrisw@nipltd.com] Sent: Friday, April 13, 2001 5:50 AM To: R. David Murray Cc: Tim McLaughlin; 'zope-dev(a)zope.org' Subject: Re: [Zope-dev] un-own an object "R. David Murray" wrote: > > Like I said (and the docs say), it is the interesection of the two > sets of privileges, so it is effectively just the permissions of > user nobody. This isn't very useful though ;-) I ended up re-creating a whole folder tree just because I wanted to delete the user who created them, and Zope 2.2.4 doesn't appear to have a 'Take Ownership' button :-( *grumbling* Chris :-)

1 0