June 2001 - Zope-Dev

security question
by Tim McLaughlin 16 Jun '01

16 Jun '01

It seems to me that a User should not get to keep their roles in the acquired objects which are above the User Folder in which the user is defined... However, that does not seem to be true according my testing. This is what happens. Imagine a tree like this root-folder1-acl_users \folder2-object1 root has a role called 'User' with 'View' permissions (anonymous is disabled) and acl_users has a user called joe. joe can access objects in folder2 according to the permissions set on the root by using acquisition like this: http://server/folder1/folder2/object1 joe cannot however, access them directly: http://server/folder2/object1 Does this seem strange to anybody else, or have I just been working too long? _____________________________________________________ Tim McLaughlin iterationZERO - www.iterationzero.com 703-481-2233

2 1

Re: [Zope-dev] DCOracle2 Beta 3
by Andreas Repp 16 Jun '01

16 Jun '01

> On the far-out front, a few people have asked how you might do > user-specific connections to the database (ie instead of pooling by a > common connection, you individually authenticate to Oracle with your > own password). Clearly, cloning the base Connection object would be > fairly straighforward, but authenticating it to Oracle would not be, > as the user password wouldn't be available. If anyone feels strongly > about that (ie you have a notion on how you would make it work and/or > you need it),feel free to write me. From a performance standpoint it > would be terrible, but security auditors would love it. Hello Matthew, I think this feature would be most useful ! Since I am no (not yet ;-) zope-product developer I can't help you integrating this kind of stuff but I think I can give you some thoughts about it: Of course it would be a great advantage from a security point of view but it would also make it possible to use Oracle's transaction machinery. This would make it much easier for users of OR-mapping products (ie ZPatterns) to wrap insert, update, delete SQL methods into an user Oracle transaction. (I don't know witch impact it would have on products like OracleStorage ...) That way several of above mentioned SQL methods can be aborted in the end without interfering with other users´ actions. Without user based connections this would only be possible, if at all, with a high coding effort. To solve the performance problem I´d suggest to cache new user connections for a certain period of time. To be at all able to transfer the DB-user connection string I´d propose to use a structure similar to Pythonscript for the ZSQL methods. enhanced ZSQL-example: ##(new)connection_id=<dtml-var "username+','+password' or default_connection_id"> ##arguments=ID,NAME insert into SAMPLE (ID,NAME) values ( <dtml-sqlvar ID type="int">, <dtml-sqlvar NAME type="string"> ) (I know that dtml inside the pythonscipt-header is not evaluated but the product developer should be able to make it work that way ...) I assume that this might be a backward compatible approach to solve the issue until some greater spirit has thought about it. A session based connection would be useful as well, but I guess that are dreams of the future ;-) as allways: any comment is very appreciated Andy ---------------------------------------------------------------------- Andreas Repp andreas.repp(a)lrz-muenchen.de Leibniz Rechenzentrum Muenchen www.lrz.de ----------------------------------------------------------------------

1 0

New Release of Zope Developer's Guide
by Michel Pelletier 15 Jun '01

15 Jun '01

I'm happy to announce a new release of the Zope Developer's Guide, available in HTML format here: http://www.zope.org/Documentation/ZDG/ The new guide contains many improvements and elaborations over the previous HTML release, and has benefited from the review and contributions from many community members including well-known object-orienteers Jim Fulton, Guido van Rossum and Bruce Eckel. This will be the last "preview" release of the Dev guide before we release the first edition alongside the release of Zope 2.4. As usual, any problems suggestions should be noted in the SourceForge tracker for the dev guide: http://sourceforge.net/projects/zope-devel/ Thanks! -Michel

1 0

zope t-shirts available!
by Jens Vagelpohl 15 Jun '01

15 Jun '01

for those who haven't noticed the little link on zope.org... digital creations is now selling a very stylish zope t-shirt! details and a picture are at: http://www.zope.org/Resources/Store melissa light (melissa(a)digicool.com) is available to answer any questions and take shirt orders. jens

2 1

TypeError on FieldIndex
by Morten W. Petersen 15 Jun '01

15 Jun '01

Hia guys, running the GUM product on a fresh BerkeleyDB based 2.4.0a1 instance on Linux raises the following issue for the field index type: Site Error An error was encountered while publishing this resource. Error Type: ('type', 0, <type 'string'>, <type 'int'>) Error Value: None Troubleshooting Suggestions The URL may be incorrect. The parameters passed to this resource may be incorrect. A resource that this resource relies on may be encountering an error. For more detailed information about the error, please refer to the HTML source for this page. If the error persists please contact the site maintainer. Thank you for your patience. Traceback (innermost last): File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/ZPublisher/Publish.py, line 223, in publish_module File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/ZPublisher/Publish.py, line 187, in publish File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/Zope/__init__.py, line 226, in zpublisher_exception_hook (Object: CatalogAware) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/ZPublisher/Publish.py, line 171, in publish File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: index_html) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: index_html) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/App/special_dtml.py, line 127, in __call__ (Object: index_html) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/DocumentTemplate/DT_String.py, line 543, in __call__ (Object: index_html) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/DocumentTemplate/DT_In.py, line 681, in renderwob (Object: get_incoming_message_containers) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/Products/GUM/gum.py, line 591, in get_incoming_message_containers (Object: CatalogAware) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/Products/GUM/gum.py, line 858, in get_gum_message_containers (Object: CatalogAware) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/Products/ZCatalog/ZCatalog.py, line 582, in searchResults (Object: LockableItem) File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/Products/ZCatalog/Catalog.py, line 663, in searchResults File /home/morten/tmp/Zope-2.4.0a1-src/lib/python/Products/ZCatalog/Catalog.py, line 550, in _indexedSearch ('type', 0, <type 'string'>, <type 'int'>): (see above) I added an extra try except block: if request.has_key(index.id) : try: if len(request[index.id])>0: r=index._apply_index(request) except: raise str((index.id, request[index.id], type(index.id), type(request[index.id]))) The original exception was a TypeError, len() of unsized object. Cheers, Morten

1 0

SearchIndex/ZCatalog comments.
by Erik Enge 15 Jun '01

15 Jun '01

When writing the PossitionIndex, a bunch of questions arrised (Zope 2.3.2): This is from UnTextIndex.py Zope 2.3.2 line 250 (or there abouts). Why is the wordMap needed? """ def getEntryForObject(self, rid, default=None): """Get all information contained for a specific object. This takes the objects record ID as it's main argument.""" wordMap = self.getLexicon(self._lexicon)._lexicon.items() results = self._unindex.get(rid, None) if results is None: return default else: return tuple(map(self.getLexicon(self._lexicon).getWord, results)) """ I thought we didn't make it into a BTree 'till it was > 5?: """ else: if indexRow.get(documentId, -1) != score: # score changed (or new entry) if type(indexRow) is DictType: indexRow[documentId] = score >>>>>>>> if len(indexRow) > 3: # Big enough to give it's own database record indexRow=IIBTree(indexRow) index[entry] = indexRow else: indexRow[documentId] = score """ shouldn't "objects" be "object"?: """ def index_object(self, documentId, obj, threshold=None): """ Index an object: 'documentId' is the integer id of the document 'obj' is the objects to be indexed """ do we need this is ZCatalog.py?: """ from SearchIndex import UnIndex, UnTextIndex """ this isn't true? what about keywordindexes (only 'Field' and 'Text' mentioned)?: """ class ZCatalog(Folder, Persistent, Implicit): """ZCatalog object A ZCatalog contains arbirary index like references to Zope objects. ZCatalog's can index either 'Field' values of object, or 'Text' values. """ do we need this in UnTextIndex.py?: """ from Splitter import Splitter """ from ResultList.py: """ def __or__(self, x): return self.__class__( weightedUnion(self._dict, x._dict)[1], union(self._words, x._words), self._index, ) return self.__class__(result, self._words+x._words, self._index) """ two returns? Sorry if this is all mambo-jambo, or if it is already fixed in 2.4.

2 1

SiteRoot
by Andre Schubert 15 Jun '01

15 Jun '01

Hi, i have a question on working with siteroots. I have a zope server which serves content for various domains. Thatswhy i puted a SiteRoot in every Folder. But now i want to copy Objects from one Folder to another, but this don't work because of the different SiteRoots. If have read the SiteAccess-Docs and tryed the following. http://zopeserver/_SUPPRESS_SITEROOT/manage, but this also fails. How can i perform my copy's and cut's and paste's in a easy way thanks as

1 0

getItem() changed in 2.3.2?
by Bill Anderson 14 Jun '01

14 Jun '01

OK, the code below worked fine in 2.3.1 .. ======= user_ids=context.getUserNames() users=[] for i in user_ids: activity=context.UserSource.getItem(i).Active if activity==1: state='Active' else: state='Inactive' users.append([context.getItem(i).id,state,context.getItem(i).getFullName()]) return users ======= But now, in 2.3.2, it returns an AttributeError for __call__. I've been able to determine that context,UserSource.getItem(i) is returning i for some reason. IOW, if i is a username, call to getItem returns the username. now, of course, trying to get attributes from string is futile, but why is it now returning a string, as opposed to the object? Did I miss something? Bill -- Bill Anderson Linux Specialist Modular Network Storage R&D Random Redmond Quote: Portable: survives system reboot.

1 0

DCOracle2 & DCOracleStorage
by Matthew T. Kromer 14 Jun '01

14 Jun '01

I put up a source-only Beta 4 release of DCOracle2 at http://www.zope.org/Members/matt/dco2 Which includes a DCOracleStorage directory; I've tested it on ONE MACHINE only so YMMV. I didn't touch the DCOracleStorage docs so anyplace it says "make file that does 'import DCOracle'" interpret as "import DCOracle2." This version of DCOracle2 also fixes some stupid goofs on my part with Long handling, and the case of calling a stored procedure with zero arguments.

1 0

symbolic link to another object in the Zope DB
by Tim McLaughlin 14 Jun '01

14 Jun '01

Has anybody seen a product that lets you make the equivalent of a symbolic link in unix in the Zope DB? Thanks, Tim _____________________________________________________ Tim McLaughlin iterationZERO - www.iterationzero.com 703-481-2233

2 1