July 2001 - Zope-Dev

XXXPythonScripts release 1.0
by Evan Simpson 01 Jul '01

01 Jul '01

After seeing the demand for this in a thread on ZopeZen, I've decided to release XXXPythonScripts, at: http://www.zope.org/Members/4am/XXXPythonScripts This Product adds a new Script meta-type: "Script (Python, unsafe)". You can only create or edit these objects when your Zope has been started with a special environment variable set. The envar name is whimsical, but this isn't a joke; By using this Product you add a risk to your system equivalent to using Telnet to log in as the Zope user. If somebody sniffs/guesses your login and this is turned on, they can write Scripts to do whatever the Zope process user can do! These are compatible with Zope 2.3.x only. I have no immediate plans to make them work with 2.4.x, but it shouldn't be hard. Cheers, Evan @ digicool & 4-am

1 0

ZCatalog out of Zope
by Paulo M. Goncalves 01 Jul '01

01 Jul '01

Hi, I'm a Zope and Python newbie and I'm trying to work with Zope's ZCatalog in a Product coded in python. Can anyone give some intro or point to some links with info in this subject. Thanks, Paulo ----------------------------------------------------------------------- Paulo Marques Goncalves CDFtel, Lda Ph. No: +351.22.3389843 Rua Goncalo Cristovao, 347 - Sala 205 FAX No: +351.22.3389845 4000-270 PORTO E-mail: mailto:pmg@cdftel.pt Portugal -----------------------------------------------------------------------

4 3

ZCVSFolder not running on windows
by Robert Rottermann 01 Jul '01

01 Jul '01

Hi there, I installed the newest version of ZCVSMFolder on my windowsbox. As it uses fork it can not work. However I used a former version under windows. Is this not possible anymore? thanks for any insigth Robert

2 1

DTML sqltest tag and python expr. Bug in Zope Book?
by Yves-Eric Martin 01 Jul '01

01 Jul '01

Hello everyone, I was recently working on a quite big ZSQL method (around 100 lines). I was using only <dtml-if> and <dtml-sqlvar> tags and a lot of "like '%...%'", so thought I could make things look much nicer using <dtml-sqlgroup> and <dtml-sqltest ... op="like" optional>. But I ran into a big hurdle: I quickly searched through the archive and found the thread "[Zope-dev] ZSQL using LIKE operator", and in particular: http://lists.zope.org/pipermail/zope-dev/2001-February/009339.html which is exactly what I would like to do. But unfortunately, <dtml-sqltest "..."> does not seem to work. We get the following error: " The "..." shorthand for expr was used in a tag that doesn't support expr attributes., for tag <dtml-sqltest [...] " I checked sqltest.py (Zope 2.3.2): no support for python expr in there. Interestingly, the Zope Book mentions the use of python expressions with sqltest in its DTML Reference: http://www.zope.org/Members/michel/ZB/AppendixA.dtml Is there a patched sqltest.py that I don't know about or is this a bug in the book? Anyway, does anyone know of a good reason why the sqlvar tag supports python expr while sqltest does not? Some obscure security hole? Or is the functionality just missing? And in that case, is anyone up for a patch? It's not critical, but the following kind of defeats the purpose of sqlgroup: <dtml-sqlgroup where required> <dtml-if title> title like <dtml-sqlvar "'%%%s%%' % title" type="string"> </dtml-if> <dtml-and> <dtml-if author> title like <dtml-sqlvar "'%%%s%%' % author" type="string"> </dtml-if> </dtml-sqlgroup> The following would be much nicer: <dtml-sqlgroup where required> <dtml-sqltest "'%%%s%%' % title" op="like" type="string" optional> <dtml-and> <dtml-sqltest "'%%%s%%' % author" op="like" type="string" optional> </dtml-sqlgroup> Note: in this particular case, I could preprocess the variables and add the surrounding wildcards in the call to the ZSQL method. But that would restrict the way this method can be called (URL traversal is definitively a cool feature to impress newbies ;) ), and that's not the point here anyway: we would just like python expressions in sqltest tags. Cheers, -- Yves-Eric MARTIN yemartin(a)yve.net

3 4