April 2001 - Zope-Dev

ZPatterns AttributeProvider question
by cs＠comlounge.net 21 Apr '01

21 Apr '01

Good evening everybody! I have some question regarding attribute and agent programming for ZPatterns. I have some provider which is registered for the "handlers" and "attributes" methods and some attributes. My problem is when trying to create a new object and directly editing it, e.g. obj=newItem() obj.propertysheets.data.manage_changeProperties(foobar=13) the propertysheet is defined and my provider is also registered for handling the property "foobar". Unfortunately my SetAttributeFor() method is never called. Also defined in my provider are _objectAdded(), _objectAdding(), _objectChanged() (but not _objectChanging()). Here's what they do: _objectAdded() is storing the data collected via SetAttributeFor() into an sql database as new record _objectAdding() is doing the same as the original method but also committing the transaction as otherwise the new record will not be stored into the database (basically it calls _objectAdded() via the transaction mechanism). I needed to do that as otherwise a getattr on the primary key (==loadAttrib) failed as I try to retrieve the record inside the _AttributeFor() method. _objectChanged() doing the same as objectAdded() but updating the sql database. So what's happening is that _objectAdding() and _objectAdded() get called from the newItem() call but _SetAttributeFor() is not called. When doing the manage_changeProperties() inside a new method which is called manually (and does a getItem()) everything is fine. I've also tried to do obj=newItem() newid=obj.id obj2=getItem(newid) obj2.propertysheets.data.manage_changeProperties(foobar=13) but this also did not call _SetAttributeFor(). So does any ZPatterns wizard has any idea on what I might do wrong? (I can also send someone the source code if this message seems too confusing ;-) regards, Christian Scholz PS: What I am trying to create is an sql attribute provider for ZPatterns which is some replacement for manually creating the zsql method and SkinScript methods. Unfortunately it seems more difficult than I thought at first ;-) -- COM.lounge http://comlounge.net/ communication & design info(a)comlounge.net

3 3

Allowing secure 'import' access in zope folder hosting
by Ivo van der Wijk 21 Apr '01

21 Apr '01

Hi all, I tried to ask this on the standard zope list, but noone seemed to know anything about it. Perhaps you do? We provide zope hosting, both folder based (where people have access to their own folder, mapped to a domain, and no access to the zope server / source / var / import / lib directories) and pure zope hosting (i.e. an entire own zope server for this customer) In the folder case, one of our customers whishes to upload his locally developped site as .zexp to our zope server and import it there. Can this be done safely? I.e. withouth compromising the other customers security? >From some discussions where had on #zope I understand that expecialy proxy roles may be a problem which may be fixed by requiring the user to take ownership. Would this fix all security issues? Or are there any other unforseen problems? Would anyone know another solution to achieve the same functionality? (ftp won't work, as you can't, for example, upload userfolders) Would it be possible to perform a scan on an xml exports for unwanted proxy roles and other security issues? Thanks, Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam -=- Tel: +31-20-4688336 Linux/Unix based corporate Fax: +31-20-4688337 and Web: http://www.amaze.nl/ Internet Solutions Email: ivo(a)amaze.nl -=-

3 3

RE: [Zope-dev] ZSQL and Normalized databases (or why ZSQL sucks)
by Adrian Hungate 20 Apr '01

20 Apr '01

May be I am misunderstanding your problem here, but are you suggesting that SELECT tab1.col1 col1, tab2.col1 col2 FROM ... etc ... Does not expose 'col1' and 'col2' in the namespace for you? This is not my experience. Ok, I only have about 50 ZSQL methods on my intranet but they are all complex queries with column naming clashes. If it failed to work as you are suggesting, I would not have continued using Zope - Database connectivity was one of my criteria. The normality (or abnormality) of your databases should make no difference, (Except to how complex your individual SQL statements become). What database are you running against? Maybe you have hit a database connector bug? I have the following query that our sales-reps use to check how much product we sold in the last 'n' days/weeks/months etc... ----- PARAMS: dDate, sOffsetSize, nOffset SELECT DISTINCT Order_.Shipped_Date Date, Region.Region_Name Region, Employee.Number_ ID, Territory.Territory_Name Territory, Currency_Exchange_Rate.From_Currency_Code Currency, SUM(Order_.Sub_Total - Order_.Order_Discount_Amount) Local, Currency_Exchange_Rate.Current_Exchange_Rate * SUM(Order_.Sub_Total - Order_.Order_Discount_Amount) Dollar FROM Region INNER JOIN Territory ON Region.Region_Id = Territory.Region_Id INNER JOIN Company ON Territory.Territory_ID = Company.Territory_ID INNER JOIN Order_ ON Company.Company_ID = Order_.Bill_To_Company_ID INNER JOIN Currency_Exchange_Rate ON Order_.Currency_ID = Currency_Exchange_Rate.From_Currency_ID INNER JOIN Employee ON Order_.Account_Manager = Employee.Employee_Id <dtml-sqlgroup where> (Currency_Exchange_Rate.To_Currency_Code = 'USD') <dtml-and> (Order_.Status IN ('Invoiced', 'Billed', 'Shipped')) <dtml-and> (Order_.Shipped_Date IS NOT NULL) <dtml-and> (Order_.Sub_Total <> 0) <dtml-and> (datediff(day, Order_.Shipped_Date, '<dtml-var dDate>') >= 0) <dtml-and> (datediff(<dtml-var sOffsetSize>, Order_.Shipped_Date, '<dtml-var dDate>') < <dtml-var nOffset>) </dtml-sqlgroup> GROUP BY Order_.Shipped_Date, Region.Region_Name, Employee.Number_, Territory.Territory_Name, Currency_Exchange_Rate.From_Currency_Code, Currency_Exchange_Rate.Current_Exchange_Rate ORDER BY Region.Region_Name, Employee.Number_, Territory.Territory_Name, Currency_Exchange_Rate.From_Currency_Code ----- This exposes 'Date', 'Region', 'ID', 'Territory', 'Currency', 'Local' and 'Dollar' to the calling script. I use this from a Python product, python scripts and from DTML all the time (10's or 100's of times per day at least). As far as the 'foo=0' example, if you set foo to 0, and do nothing in between to change it, of course a test for not equal to 0 will fail, what would you expect? Adrian... -----Original Message----- From: The Doctor What [mailto:docwhat@gerf.org] Sent: Thursday, 19 April 2001 23:22 To: Paul Erickson Cc: zope-dev(a)zope.org Subject: Re: [Zope-dev] ZSQL and Normalized databases (or why ZSQL sucks) * Paul Erickson (erickson(a)kaivo.com) [010419 17:02]: > The Doctor What wrote: > > > * Loosing the variable between the form and dtml-if > > I don't understand this. I'm assuming that you are losing values that > are not in your argument list. All you have to do is add the arguments. That isn't what I mean. Try this (typed in, so it may need to be adjusted): <param>foo=0</param> <dtml-if expr="foo != 0">Life is good</dtml-if> You'll NEVER get Life is good to print out. EVER. This is because ZSQL is setting foo to 0. But dtml-var and dtml-sqlvar both work. > > > * Inability to handle table.field names for variables > > > * And enough flexibility to work around the above problems > > > > > > This makes ZSQL extreamely nasty, and impossible to use with a > > > normalized database. > > Database normalization isn't really an issue. It sounds like you're > really just having problems with the syntax of joins. Nope, can do joins. Been doing joins (mainly inner). Not the problem. The problem is that if I have tables like: Table1 ------ id name desc Table2 ------ id Table1ID <-- Foreign Key thrown in for fun. name desc And I join them, then I MUST rename all the selects using AS: select Table1.id as id1 Table1.name as name1 ...etc.... Because I can't have zsql put the variables in the caller's namespace as "Table1.id". It puts them in as "id" (without the AS). Fortunately, I found the column for sqltest (which is the other end of ZSQL): <dtml-sqltest id1 column="Table1.id" .... > > > > > > What's the point? ZSQL sucks, how do I talk to the DB directly? > > Grab the Python database adapter and write some python classes or > external methods to do what you need. Can I use them from a python script? If not, what's the point? I mean: External methods are nice to have when you have *no other choice*, but they aren't something I'd want to debug and deal with for object. > > This makes things work MUCH better. So there are work arounds. > > This isn't a work-around, it is the way that it is intended to be used. I didn't see a single example of it. The Zope Book didn't mention this at all (except as a single line reference). I would *never* have gone looking for the word column. Why? It's a field! > Again, I think that it's a matter of understanding how ZSQL works, > rather than a limitation of ZSQL. If you have column name conflicts, > you can always use something like: > > SELECT a.field as a_field, b.field as b_field FROM ... > > Then refer to them in dtml like &dtml-a_field; or <dtml-var > name="a_field"> Right, but you still have to do extra work to get them back into a ZSQL object. column lets you do that. It's got no examples to help out with. It's documented once. I didn't see it. Life is better now. > > I still would love some examples. Do people end up with 4 ZSQL > > objects per thing they manipulate in their database?: > > UPDATE, SELECT, INSERT and DELETE? Or do they mix them somehow? > > I typically wind up with a ZSQL method for each of the CRUD operations. > Sometimes I have separate selects methods for more complex joins, if the > DTML code gets too ugly when I try to combine them into a single method. > > > Example of a fairly typical join statement (for MySQL database): > > Arguments- > begin_date:date end_date:date="2037-01-01" > > SELECT search_string, search_result, search_date, result_category, > legal_category.name > FROM search_log LEFT JOIN legal_category ON > search_log.result_category=legal_category.code > > <dtml-sqlgroup required where> > <dtml-sqltest name="begin_date" op="gt" type="nb" > column="search_date"> > <dtml-and> > <dtml-sqltest name="end_date" type="nb" op="lt" > column="search_date" optional> > </dtml-sqlgroup> Hey! An example! > Good Luck Thanks. So I'm still having trouble. I can't get any of the list examples to work. I build a select multiple list, and then try to dtml-in on it. It doesn't seem to work. REQUEST shows in it th other and form namespaces, as a list, but I can't actually dtml-var it or anything. Example: q<dtml-var dalist>p <br> <dtml-in VirtualRootPhysicalPath> d<dtml-var sequence-item>b </dtml-in> <hr> <dtml-var REQUEST> If you call this with this URL (substitute as needed): http://docwhat.gerf.org:9673/links/test?dalist%0D%0A%3Alist=1&dalist%0D%0A%3 Alist=3&dalist%0D%0A%3Alist=8 Which is the URL pattern formed by a <SELECT name="dalist:list" multiple>.... Then you get errors on dalist. The examples at http://www.zope.org/Members/AlexR/SelectionLists Don't work as exactl above. Help? Ciao! -- Outside of a dog, a book is a man's best friend. Inside a dog it's too dark to read. -- Groucho Marx The Doctor What: Need I say more? http://docwhat.gerf.org/ docwhat(a)gerf.org KF6VNC

5 4

ANNOUNCE: Zope 2.3.2 beta 2 released
by Brian Lloyd 20 Apr '01

20 Apr '01

Hello all, Zope 2.3.2 beta 2 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.3.2b2/ Zope 2.3.2b2 contains only one fix for a catalog issue that was found to affect CMF (and probably some other uses). If no other surprises are found, we expect to make 2.3.2 final next friday (April 27). For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: http://www.zope.org/Products/Zope/2.3.2b2/CHANGES.txt http://www.zope.org/Products/Zope/2.3.2b2/HISTORY.txt Note that we have also posted "diff" updates as .tgz files that will let you easily upgrade an existing 2.3.x site. These updates are available for those currently using the 2.3.x source release or the 2.3.x binary releases. To apply a differential update to your site: - download the appropriate .tgz file from zope.org - shutdown your Zope process - copy the .tgz to your Zope directory and extract it - SEE THE NOTE ABOVE!! - run w_pcgi or wo_pcgi *if you are not using a binary release* - restart your process Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Re: [Zope-dev] Call me stupid (login form Howto & other Q)
by Dieter Maurer 20 Apr '01

20 Apr '01

Romain Slootmaekers writes: > I have a logon form with user & passwd, > but what do have to do after the user has submitted this? In order to use your own login form, you cannot use HTTP basic authentication (Zope's default and what the standard user folder supports). You need to use a cookie based authentication. There are several products (--> Zope.org) for this: * we use quite successfully GUF (Generic User Folder) * LoginManager is more modern (and a replacement for GUF) * Shane's Cookie Crumbler (part of CMF) can turn a cookie value into a "_auth" request variable that looks like being created for basic authentication and can therefore work with the standard Zope user folder * there are lots of furhter options one would be to make your own "UserFolder" object. Dieter

1 0

which development environment?
by Bernd Dorn 20 Apr '01

20 Apr '01

to all zope gurus ... wich development environment do you use on windoze I tried a few, but debugging zope is kinda hard what are your preferences when you write python products or extend zope ?? thx

1 0

RE: [Zope-dev] ZSQL and Normalized databases (or why ZSQL sucks)
by Adrian Hungate 20 Apr '01

20 Apr '01

I am using ZODBC talking to an MS-SQL7 database (Yack spit), so the syntax is a little different. As for the unchangeable defaults, I use defaults a lot, and I don't think I've ever seen your problem. What you appear to be trying to do with the ZSQL Method in your example strikes me as 'A Bad Idea'(tm). Having the schema of the returned data change depending on the value of a parameter seems to be asking for problems (IMHO). If you look back at the my last example, and replace the PARAMS with: dDate="2001/03/31" sOffsetSize="month" nOffset="1" This certainly does work, I just tested it. Interestingly, so does: PARAMS: testval:int=0 <dtml-if testval> select count(shipped_date) cnt <dtml-else> select count(shipped_date)/2 halfcnt </dtml-if> from order_ If you call it with testval=1, you get a column called cnt, with testval=0 you get a column called halfcnt. Isn't this just what you are saying doesn't work? Adrian... -- Adrian Hungate Manager, European I.S. Acucorp UK Limited -----Original Message----- From: The Doctor What [mailto:docwhat@gerf.org] Sent: Friday, 20 April 2001 15:21 To: zope-dev(a)zope.org Subject: Re: [Zope-dev] ZSQL and Normalized databases (or why ZSQL sucks) * Adrian Hungate (ahungate(a)acucorp.com) [010420 05:06]: > May be I am misunderstanding your problem here, but are you suggesting that > > SELECT tab1.col1 col1, tab2.col1 col2 > FROM ... etc ... > > Does not expose 'col1' and 'col2' in the namespace for you? This is not my > experience. Ok, I only have about 50 ZSQL methods on my intranet but they > are all complex queries with column naming clashes. If it failed to work as > you are suggesting, I would not have continued using Zope - Database > connectivity was one of my criteria. I mean that: SELECT tab1.col1, tab2.col1 FROM ... etc ... Does not expose 'tab1.col1' and 'tab2.col1'. In otherwords, it doesn't gracefully handle name clashes. I realize that calling out the variable 'tab1.col1' out of the namespace is a pain, but (hopefully) in the future it would be made easier. Perhaps like so: <dtml-var name='tab1.col1'> (note single quotes) > The normality (or abnormality) of your databases should make no difference, > (Except to how complex your individual SQL statements become). What database > are you running against? Maybe you have hit a database connector bug? Postgresql. I've tried all three of the DAs: Psyco, Popy and PostresDA [Nice Example Snipped] What DB was that? The syntax isn't what I expect from Postgres, Tandem and MySQL. > As far as the 'foo=0' example, if you set foo to 0, and do nothing in > between to change it, of course a test for not equal to 0 will fail, what > would you expect? Here is the example again, but better: <param>foo:int=0</param> <dtml-if expr="foo <> 0">Not Zero<dtml-else>Zero</dtml-if> If called like so: <dtml-var expr="zsql_example(foo=200)"> It will ALWAYS print 'Zero'. This makes it hard to do something with a param that defaults to nothing like: ---------------------------------------- <param>category_id=""</param> SELECT url.id, url.name <dtml-if category_id>, xref_url_category.categoryid as category_id, </dtml-if> FROM url <dtml-if category_id>, xref_url_category </dtml-if> <dtml-sqlgroup where> <dtml-if category_id> <dtml-sqltest category_id column="xref_url_category.categoryid" type="int"> <dtml-and> xref_url_category.urlid = url.id </dtml-if> </dtml-sqlgroup> ---------------------------------------- You can't even replace the param with "category_id:int=0" and then check for category_id <= 0 in the dtml-ifs. I finished my project, so I'm happy for the moment. I have another ZSQL project (a DVD, Comic Book and Video tracker for my Manga and Anime), so I'll be back. Thanks to everyone who spent time to help out. Ciao! -- Who are you going to believe, me or your own eyes? -- Groucho Marx The Doctor What: Guru to the Gods http://docwhat.gerf.org/ docwhat(a)gerf.org KF6VNC

1 0

Call me stupid (login form Howto & other Q)
by Romain Slootmaekers 20 Apr '01

20 Apr '01

Yo, you can call me stupid but I can't get this working: I have a logon form with user & passwd, but what do have to do after the user has submitted this? Do I have to create a new BasicUser and assign that to AUTHENTICATED_USER or what ? Normally I'd just create a Folder that requires some privileges, but this is not possible here (for other reasons) And something completely different: to be able to see the inside of a ZClass, I added an external method that just returns self.__dict__ . Is this the right approach, or is there something more direct ? TIA, Sloot.

1 0

WebDAV locking module?
by richard＠bizarsoftware.com.au 20 Apr '01

20 Apr '01

Colour me confused... I just downloaded the 2.3.2 beta tarball and tried to run our application against it. It appears that the locking module (webdav.Lockable) is missing from webdav. We develop against the CVS, and the file is there. It has been since 2.3.1 CVS - though the 2.3.1 tarball doesn't seem to have the module either... Can someone clue me in please? Richard -- Richard Jones richard(a)bizarsoftware.com.au Senior Software Developer, Bizar Software (www.bizarsoftware.com.au)

2 4

Zope options order sensitive
by Chris Gray 20 Apr '01

20 Apr '01

I'm just beginning my study of the zope source. Going through z2.py I noticed that order matters in specifying command line options. For instance: ./start -a 127.0.0.1 -P 8000 sets HTTP_PORT to: [('127.0.0.1', '8080')] but: ./start -P 8000 -a 127.0.0.1 sets HTTP_PORT to: [('', '8080')] I'm not far enough along yet to know if this makes a difference in the end. Does it? Chris

2 4