August 2001 - Zope-Dev

WebDav and access of content of a folder
by Eric Brun 31 Aug '01

31 Aug '01

Hi, I work on Zope 2.4.1b1, ZEO1.0b4 Server-side I test webdav with a Win98 machin with webfolders. Problem: I create a folder in Root Folder of zope I fix permissions (WebDav access, Webdav Lock /Unlock, View, Add Images FIles, Change Image Files, access content infomation) to Owner on the folder. I drag a file (Word2000 file) into the webfolder (after open the webfolder and authentication with the Owner of the folder Zope): that's ok. Then I try to open the Word file by double-clicking on. Word runs and then , an authenticate-box come. But, at this point, I am already authenticated to Owner of the folder ! What is the problem ??? I can read somethings like that in the Z2.log file : 193.47.140.12 - eric [date-..] "PROPFIND /myfolder HTTP/1.1" 207 2468 "" "Microsoft Data Access Internet Publishing Provider DAV" => Open webfolder 193.47.140.12 - Anonymous [date- ....] "OPTIONS /myfolder HTTP/1.1" 200 434 "" "Microsoft Data Access Internet Publishing Provider DAV" 193.47.140.12 - Anonymous [date- ...] "LOCK /myfolder/test.doc HTTP/1.1" 401 1772 "" "Microsoft Data Access Internet Publishing Provider DAV" Why these transactions take the Anonymous User ??? Anybody can help me ? Thanks ! -- Eric Brun Mission TIC Savoie Technolac France E-mail : Eric.Brun(a)univ-savoie.fr

1 0

manage_access problems
by Johan Beauce 30 Aug '01

30 Aug '01

Hello, I would like find a function like "manage_acces" which can give me the roles cheked for a permission. Example : I have a folder "myFolder" and I use this function : <dtml-let folderPermissions="folderEditing.rolesOfPermission('Access contents information')"> <dtml-var folderPermissions> </dtml-let> the variable folderPermissions return me this list : [{'selected': '', 'name': 'Anonymous'}, {'selected': 'SELECTED', 'name': 'Manager'}, {'selected': '', 'name': 'Member'}, {'selected': '', 'name': 'Owner'}, {'selected': 'SELECTED', 'name': 'Reviewer'}, {'selected': '', 'name': 'User'}, {'selected': '', 'name': 'publisher'}] With this list I can see "Manager" and "Reviewer" roles are checked because the string SELECTED appears. if I use <dtml-var folderPermissions[4]>, that's give me {'selected': 'SELECTED', 'name': 'Reviewer'}. But I can't access in this object if I want 'Reviewer' ??? it isn't a list or a string because I canp't use : <dtml-var folderPermissions[4][3]> for access to the 3th element, and I can't use <dtml-var expr="_.string.find(folderPermissions[4],'SELECTED',0)"> because it isn't a string .... Can you help me and tell me how I can use this object. Regards, Johan Beaucé.

4 3

E-market? What's happening? Latest Code, etc
by James 30 Aug '01

30 Aug '01

Hi, I thought that E-market was still being worked on. I thought it was sort of put on the back burner. Are there plans to revive it, and can where can I get the latest code? Thanks,

2 1

REQUEST problems
by jonathan 30 Aug '01

30 Aug '01

Hi All, am reletively new to zope, and in particular to products, so please accept my appologies if I am asking silly questions. I have in fact nearly completed my first ever product. The product was developed on a installation of Zope 2.4.0 and is giving errors when used with Zope 2.3.2. The error only occours when a method of the product is called directly from the web. The error does not occour when a dtml method is called that contains a reference to a method of the product. The error itself is that it can not find the object AUTHENTICATED_USER. Printing out REQUEST confirms this. There is no AUTHENTICATED_USER. Again this only happens when calling a method of the product directly. e.g. browsing http://zope-site/product/method generates an error but http://zope-site/dtml_method does not, even when dtml_method contains <dtml-var expr="product.method(REQUEST)"> Is this some sort of bug that was fixed in Zope 2.4.0 or has the way things should be done changed between versions? tia.. JOn. -- Jonathan Stoneman - Development Programmer - Frontier Internet Services Limited Tel: 029 20 820 045 Fax: 029 20 820 035 http://www.frontier.net.uk Statements are made at all times subject to Frontier's Terms and Conditions of Business, which are available on request.

2 1

unsliceable object
by Homan Els 30 Aug '01

30 Aug '01

Hi, Does somebody know why, I am getting an error on this function (inside a zope-product): def CreateProcessDirs(self,proposalid,runid): for i in self.objectValues(): id=i.id if callable( id ): id = id() RequestDir=os.path.join(dir,proposalid,runid,'process',id) if os.path.exists(RequestDir): print 'pathname ( file or directory) exist',path else: os.system('mkdir -p '+RequestDir) print "Make Directory: ",RequestDir return i The error message is: Error Type: TypeError Error Value: unsliceable object Thanks, Els _______________________________________________________________________ Els Homan European Molecular Biology Laboratory (EMBL) 6, rue Jules Horowitz, B.P.181 38042 Grenoble cedex 9. France homan(a)embl-grenoble.fr (Email) 04 76 20 74 66 (Phone) 04 76 20 71 99 (Fax) ______________________________________________________________________

3 3

Re: [Zope-dev] CST not really... :-)
by Anthony Baxter 30 Aug '01

30 Aug '01

>>> Chris McDonough wrote > Though it would be kind of neat to play around with persistent > connections in conjunction with session tracking, it's not too high on > the list right now for CST.. that's not to say, however, that an > alternate session id manager could not be written to do this. > > I thought, however, that persistent HTTP connections were meant more to > avoid TCP connection costs than to identify sessions. That's right. Using a persistent connection to identify a session is way way bogus. In particular, note that _many_ proxies do not support persistent connections properly, if at all. Anthony

1 0

Re: [Zope-dev] CST not really... :-)
by Oliver Bleutgen 30 Aug '01

30 Aug '01

> Hi everyone, > But we think a really good CORE session tracking should be transparent > and independent of this cookies/forms options. This means be able > to install zope and have somewhere an option to turn on/off > zope "really core session tracking". This means zope > having the ability to do sessions using http1.1 persistent connections > which > medusa allready implements and also most current > browsers. Then no need to generate Tokens and pass them with cookies > or forms, there is allready a unique identifier between the server > and the client and that is in medusa socket_map. Nope, persistent connections are _not_ unique. RFC 2616 proposes that the client SHOULD implement no more then 2 persistent connections (i.e. it can use more than 1). And nowhere do I find a guarantee that the requests from the client have to use always the same persistent connection - i.e. they may close that connection and reopen another one. And how does the client know when to close the connection - it surely will not hold the connection open as long as the browser runs. So how does one handle the user which goes to a side, takes a break of 10 minutes and the continues there? Another data-point, there is an rfc, 2965, which explicitly deals with HTTP state management, and it doesn't mention http/1.1 persistent connections I think. cheers, oliver

2 1

xml-rpc/soap errors
by Andy McKay 29 Aug '01

29 Aug '01

Anyone got an elegant way of catching xml-rpc/soap errors so that they dont go to standard_error_message and return a whole bunch of html to the client as the error value? I really can only think of a <dtml-if> in standard_error_message, which doesn't count as elegant. Cheers. -- Andy McKay.

6 14

RE: [Zope-dev] CST not really... :-)
by sean.upton＠uniontrib.com 29 Aug '01

29 Aug '01

I really like the idea of persistence in the HTTP transport, but Chris is right... Keepalives are not at all reliable through proxies, and any well designed app that can take advantage of it ideally should be designed to be cache-enabled and cache-safe, not to mention proxy safe. The very fact that most corporate users go through trans-proxies shoots the persistent connection idea down, not to mention that it means that one cannot use a caching http accelerator like Squid or mod_proxy. The burden of session tracking should be at the application level, or just below, not at the transport level. HTTP is a stateless protocol, which is something we are going to have to live with, unless persistent connection id HTTP headers are supported by all browser clients and at least Squid, if not all the commercial proxies... Something along those lines would have to be an official ratified w3c recommendation with major vendor support for that to happen any time soon. Such a standard would have to support maintaining an _application_ session across multiple _transport_ sessions. If something like this was made possible in the future, it might be very good for XML-over-HTTP RPC protocols like SOAP and XML-RPC, but for now... The best we have for the practical time being is going to have to be cookies, etc... Sean -----Original Message----- From: Chris Withers [mailto:chrisw@nipltd.com] Sent: Wednesday, August 29, 2001 1:44 PM To: JXlio Dinis Silva; zope-dev(a)zope.org Subject: Re: [Zope-dev] CST not really... :-) > Any comments? someone thought about this before? someone from CST > development thought or is thinking on this possibility, i.e, zope > really core session tracking using http1.1 and no need for > cookies/forms/url_rewriting? What happens when your persistent connection breaks for some reason beyond your control? What about users going through caching proxies? cheers, Chris _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

1 0

CST not really... :-)
by J�lio Dinis Silva 29 Aug '01

29 Aug '01

Hi everyone, We have been looking at Core Session Tracking. >From the name of this product we thought this means this product enabled zope to track zope requests grouping some requests has a unique session, i.e, some way of zope tracking all requests from a specific client/browser/session. But no, this is a session managment product, i.e, data_manager/container and a programming api. The core doesnt stands for a code leaving on zope core, i.e, somewhere between Zserver and Zpublisher, but this word core is more related to the physical place where sessions data are stored which goes from standard FileStorage to BerkeleyStorage on a ZODB3 model basis. There were/are other alternatives SQL, FileSystem, RAM, etc. This product offers a good api for one to implement sessions using either cookies, url rewriting or form hidden fields, and it is allready prepared to scale in a zeo cluster. But we think a really good CORE session tracking should be transparent and independent of this cookies/forms options. This means be able to install zope and have somewhere an option to turn on/off zope "really core session tracking". This means zope having the ability to do sessions using http1.1 persistent connections which medusa allready implements and also most current browsers. Then no need to generate Tokens and pass them with cookies or forms, there is allready a unique identifier between the server and the client and that is in medusa socket_map. What we think is that with zope one dont need to use cookies, or url rewriting, or forms hidden fields. We should be able to simply call a method in a standard_html_header which activates sessioning. And no need for cookies, or forms, or heavy code writing. We have actually made a small test using zserver/medusa/asyncore socket_map which is a list of all persistent connections (open zchannels) in a zope server. Of course there are technical considerations to implement a consistent solution but we have made a consistent proof-of-concept. Any comments? someone thought about this before? someone from CST development thought or is thinking on this possibility, i.e, zope really core session tracking using http1.1 and no need for cookies/forms/url_rewriting? Best Regards, JS PS.For reference: See the section "A Better Solution to Session Tracking: HTTP/1.1" on: http://www.internettg.org/newsletter/mar00/workshop_session_management.html _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

2 1