February 2002 - Zope-Dev

ZCatalog - hiding query results
by Igor Stroh 02 Apr '02

02 Apr '02

Hi all, I don't know if it's the right list to post to, but I have the following problem: I have several objects (documents, folders etc) that are accessible only by a certain user role, this objects are cataloged. Now if I query the catalog the brains of these objects are returned correctly, but to _all_ users that issue a query. That means, users that don't have the permission to "View" or "Access Content Information" can see the brains as well... I tried to filter the result set by converting the brains into real objects (brain.getObject) in an external method (I thought, this way I should be able to exclude unauthorized users by adding the "skip_unauthorized" to the dtml-in), but that doesn't work since there are "brains" that are actually NoBrainer instances... Does anyone have an idea of how I could solve this problem? Actually I thought this kind of "information hiding" is supported by basic ZCatalog machinery, but now it looks like I'll have to hack a workaround... Any help greatly appreciated. Greetings, Igor

5 4

ZCatalog: hiding search results from unauthorized users - hack
by Igor Stroh 02 Apr '02

02 Apr '02

Hi all, in case someone have same problem as me (see "ZCatalog - hiding query results" thread for more info) - I got a solution: - create a product that subclasses ZCatalog - in this product overwrite ZCatalog.getobject with def getobject(self, rid): """foo""" obj = self.aq_parent.unrestrictedTraverse(self.getpath(rid),\ restricted=1) return obj - create a python script in your catalog (e.g. "filterCat") with a parameter that reoresents the catalog itself ("brains" here): retval = [] for brain in brains: try: obj = container.getobject(brain.getRID()) retval.append(brain) except: pass return retval - adjust your catalog query reports, so that they call "filterCat(_['<catalogname>'])" instead of <catalogname> Now your users see only those hits in a query which apply to objects they are allowed to "View". greetings, Igor

3 3

Zope 2.6 planning - call for contributors!
by Brian Lloyd 18 Mar '02

18 Mar '02

Hi all - Paul sent a note to zope-coders some time back fishing for some feedback regarding planning for a Zope 2.6 (excepted): > I propose that planning for a 2.6 focus on the following thoughts: > > 1) This release is more about community-contributed work than > ZC-contributed work. > ... > > Ultimately the things that go in 2.6 will be governed by what people in > the community are willing to contribute. > > So far the extent of contributions has been minor. Do we need to widen > the pool? Or do we instead try to get new contributors on the > Zope3 track? There wasn't much response to this when it was originally posted. Now that 2.5.1 is nearly out the door, it's time to start planning for a Zope 2.6. I've started a 2.6 plan on the dev site at: http://dev.zope.org/Resources/zope_260_plan.html I wholeheartedly agree that 2.6 needs to be significantly a community effort. While I know that many people are engaged in the Zope 3 effort, we also need to get some people engaged on defining and producing 2.6 in the interim. There is not much on the plan right now, so the possibilities are relatively wide open :) Let's get a discussion started to define 2.6. Brian Lloyd brian(a)zope.com Software Engineer 540.361.1716 Zope Corporation http://www.zope.com

40 55

Shallow copies/links/references
by Mario Valente 08 Mar '02

08 Mar '02

Hi: OK everyone, I've managed to get object links to work. As discussed previously by others (re: object references) and asked by myself: I had the need to be able to refer to objects from different points of the folder hierarchy without duplicating those objects. Yes I know that can be done *programatically*. That is not the idea. The idea is to have a folder with differente widgets/components and to be able to copy and paste references to those widgets throughout the folder hierarchy. Of course that the usual copy/paste is not OK, since that *duplicates* the objects and as such further changes to the original object wont be reflected in the copies. With something like this + Ordered Folders you are able to have an index_html that just renders the objects within a folder and you can then drop objects/widgets into the folder to produce a page. What I did: - edited CopySupport.py - copied the manage_pasteObjects method to a manage_pasteMonikers method - commented the #ob=ob._getCopy(self) line (the duplicate object part) - added a "Paste Ref" button to the lib/python/OFS/dtml/main.dtml file that calls the pasteMonikers method """ <input class="form-element" type="submit" name="manage_pasteMonikers:method" value="Paste Ref." /> """ It works. It does what I want/need. When you change a reference, the original also changes. When you change the original, the references change. You can delete either the reference or the original and all is OK. Issues/TODO - find a way to distinguish references from the original (tried to change the meta_type at paste time but no luck). At least the meta_type/icon should change to provide a visual cue. - provide tool(s) to find impact of changing a reference. Provide a link from a reference object to the original. Provide a link from an object to its several references. Comments and experiences are welcome. C U! -- Mario Valente

2 2

improved logging
by Romain Slootmaekers 01 Mar '02

01 Mar '02

Yo, questions wrt logging: -) What are the plans to improve the rather primitive logging facilities in zope ? I couldn't find anything in the plan for 2.6, nor on the 3.0 homepage. I think we need at least an extendibl framework with following types of components: - Loggers (fi, file logger, db loggers, remote logger, nulllogger,...) - Filters (fi on severity, on subsystem, ...) - LogBus (central accesspoint for the logging framework, where you can (dynamically) hook your loggers, filters etc... if time is an issue, we could just copy the design of fi Log4J which is a good logging framework for apache. -) If there are no such plans, can we hack something up ourselves and add/donate it to the product ? I hate writing stuff that gets replaced by something else afterwards .... input appreciated. Sloot.

6 6

RE: [Zope-dev] Zope 2.6 planning - call for contributors!
by sean.upton＠uniontrib.com 28 Feb '02

28 Feb '02

Hmm... would this still work with Squid or Apache caching in front of Zope? I assume that since each browser can accept different transfer-encodings, this has to be done as close to the browser as possible, otherwise content sent in one transfer encoding would be sent to every user if it was to be cached (in other words, instead this would have to be done using the experimental Squid TE code)... Sean -----Original Message----- From: Chris McDonough [mailto:chrism@zope.com] Sent: Thursday, February 28, 2002 2:36 PM To: bkc(a)murkworks.com; zope-dev(a)zope.org Subject: Re: [Zope-dev] Zope 2.6 planning - call for contributors! > I've modified HTTPResponse and ZServer/HTTPResponse.py to allow for gzip content > encoding on a response-by-response basis. I'm mostly using this with xml-rpc, but it > could be generalized and combined with a gzipper- cache manager. I'd like this. It would help with the lack of transfer-encoding by Squid. _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

1 0

Online BTrees documentation released
by Andreas Jung 28 Feb '02

28 Feb '02

FYI, I have set up a Wiki that should provide a usable documentation of the Zopes BTrees package. The Wiki is still evolving but it explains (hopefully) the most important datatypes, their API and other helper functions. URL: http://www.zope.org/Members/ajung/BTrees/FrontPage Cheers, Andreas --------------------------------------------------------------------- - Andreas Jung Zope Corporation - - EMail: andreas(a)zope.com http://www.zope.com - - "Python Powered" http://www.python.org - - "Makers of Zope" http://www.zope.org - - "Life is too short to (re)write parsers" - ---------------------------------------------------------------------

1 0

still segfaults, this time no ZMySQLDA
by Leonardo Rochael Almeida 28 Feb '02

28 Feb '02

Hi, It's me and my instability problems again :-) The system: Zope-2.4.4b1 (binary linux-x86 from zope.org) Python-2.1.2 (see above) Products (excluding Zope defaults and ZClass based ones): LocalFS Pagina0_Base (Hiperlógica product) Pagina1_Base (Hiperlógica product) Renderable exUserFolder It has an 800+MiB Data.fs (when packed) that is crammed full of python scripts. I'm still looking for a way to recompile them all without sending the machine (1GiB physical RAM) into a swap storm which would ultimately crash Zope or the machine and keep it from commiting the transaction that caused all the trouble in the first place (one of these days I'll refactor the subtransaction code out of the ZCatalog and into a ZopeFind that will accept an action parameter, along with a subtransaction one, to perform these kinds of global maintenance in a reasonable way). None of the products mentioned above use C compiled modules. I disabled all the use of mysql on this instance so that I could remove ZMySQLDA and faked the authentication system so that it's usage pattern remained the same even without mysql. After that I reenabled the cycle-gc. The system started crashing about every 5 minutes. As much as I'd have liked pointing a finger at ZMySQLDA, start the process of migration to PostgreSQL and consider this problem solved once and for all, I have finally come to the conclusion that there is no one else to blame but Zope and Python themselves. I have since reenabled ZMySQLDA use by the site and disabled the cycle-gc. The options I think I have left: * Try the new ExtensionClass.h * Run Zope under a memory analiser such as Valgrind (which might not be feasible if the runtimes are too slow): http://devel-home.kde.org/~sewardj/ * Try migrating to Zope-2.5.1b1 The situation is starting to look desperate. We now have to restart the server twice a day to keep the machine from swapping. This can't go on any longer. Any suggestion is apreciated. -- Ideas don't stay in some minds very long because they don't like solitary confinement.

4 11

FieldIndex unindex_object could not remove... This should not happen.
by Florent Guillaume 28 Feb '02

28 Feb '02

Playing with workflow switching in CMF, I sometimes have this message: 2002-02-28T18:33:06 ERROR(200) FieldIndex unindex_object could not remove documentId -862940561 from index review_state. This should not happen. Traceback (innermost last): File /home/zope/test-zope/lib/python/Products/PluginIndexes/common/UnIndex.py, line 168, in removeForwardIndexEntry (Object: review_state) KeyError: -862940561 I gather that this happens when I do self.unindexObject() on an object that had a review_state attribute (actually a workflow variable made available to the catalog through a wrapper) in the past (being in a reviewing workflow) but at the time of the unindexing this variable does not existe anymore because the current workflow followed by the object doesn't have it. Does this ring any bell ? Thanks, Florent -- Florent Guillaume, Nuxeo (Paris, France) +33 1 40 33 79 10 http://nuxeo.com mailto:fg@nuxeo.com

2 5

Help Securing new ftpFolder product.
by Tim Ansell 28 Feb '02

28 Feb '02

Hi I'm currently developing a product called "ftpFolder". This product is designed to make Zope easier to use with webDAV and ftp. It tackles a few common problems that occur when using these tools to edit Zope. Firstly Zope prefers to have no extension on the files it stores, this breaks alot of Windows programs (such as Web Folder and Dreamweaver). The ftpFolder tackles this problem by providing a "virtual mapping" onto the real zope tree. In the virtual mapping the objects gain extensions. This mapping is accessed through 'cd'ing into a virtualFTP object found in the FtpFolder. For example FtpFolder | + DTMLDocument + DTMLMethod + Image | + virtualFTP | + DTMLDocument.ddtml <- This is the above DTMLDocument object + DTMLMethod.ddtml <- This is the above DTMLMethod object + Image.jpeg <- This is the above Image object Extensions are provided using a mapping table and "plugins" which can dynamic create the extension depending on contents. (ie the Image would have a plugin to tell if it was a .jpeg or .gif or .png etc) It does this by providing "virtualObjects" which map properties onto a real object. I need a way to define the security so that the virtualObject takes on the security of the real object it is wrapping. One way that was suggested to me was to "copy" the security properties from the real object to the virtualObject in __init__. Would this work? If so what would i have to copy? Another problem the ftpFolder solves is the lack of the ability to edit Zope properties. It does this py providing a "virtualProperties" object which acts as xml representation of the objects properties. This objects appear in the virtualFTP folder as the <document>.prop and can be uploaded and downloaded to access and change the documents properties. This works well but i need help to make sure this doesn't open up any security holes allowing unprivledged people from changing properties. The final and most complex problem is that the ftpFolder allows you to ftp into "versions objects". In the virtualFTP tree version objects become "folderish", this allows people to 'cd' into them, and access the the tree as if they where in that version. How this works is in 3 steps a "versionFolder" object is created to "hold" the version. When anybody accesses the versionFolder is xml-rpc calls a "do" method on the local zope with the correct headers to cause the version to be entered. The "do" method then calls the correct method on the object (because the methods don't have doc strings and can't be called directly - plus REQUEST isn't picklable so can't be send across xml-rpc). versionFolder <- XML-rpc -> virtualObject.do <- function call with "mapply" -> virtualObject.<function> This might seem a horrible way to do it but it's the only way i have found to do this. It works suprisingly well, the problem is that it's horribly unsecure, i need help to secure this and the other problems. The source can be found on sourceforge cvs -z3 -d:pserver:anonymous@cvs.iiiserver.sourceforge.net:/cvsroot/iiiserver co ftpFolder If you are intrested in helping me, or can offer some suggestions could you please email me (as well as the list if you feel it's approiate). Hope to hear from you all soon. Mithro PS BEWARNED the source isn't exactly the kindest :(

1 0