June 2002 - Zope-Dev

ZCatalog and not registered clasees
by Vincenzo Di Somma 04 Jun '02

04 Jun '02

Hi all, I have a product with a main class (registeredin the __init__.py) and some utility classes I don`t want to register, does the ZCatalog have problem finding istances of not registered classes ? I`m not able to index them. -- Vincenzo Di Somma - Responsabile Ricerca e Sviluppo - Icube S.r.l. Sede: Via Ridolfi 15 - 56124 Pisa (PI), Italia E-mail: e.disomma(a)icube.it WWW: www.icube.it Tel: (+39) 050 97 02 07 Fax: (+39) 050 31 36 588

1 1

login method problem
by Aseem Mohanty 04 Jun '02

04 Jun '02

Hi All, I wrote a simple UserFolder application that did not use any cookies or the session management stuff. The UserSource was a MySQL db. ( Tried mysqlUserFolder but it was too restrictive interms of database structure for my purposes ). I then used ZSession to handle session and cookie management and it works great. When I have a Authenticated-View only folder the browser pops up a box and I need to login. It authenticated from the db and I go on my merry way. What I am trying to do is to is to have a logon form that allows the user to logon, verifies the user and redirects it to a members page. However it doesnt seem to do that. The login and the logout functions are given below. 'validate' is the method that is called everytime Zope decides on the roles and whther the role by the user has access to the resource. user_login__roles__ = None def user_login (Self, REQUEST, RESPONSE, username, password, create_global = 1, login_goto_path = "../../members/"): # Create authorization variable ac = encodestring('%s:%s' % (username, password)) auth = 'Basic %s' % ac Self.validate(REQUEST, auth) return RESPONSE.redirect (login_goto_path) user_logout__roles__ = ['MySQLUserRole'] def user_logout (Self, REQUEST,RESPONSE): """ Terminates user session """ user = Self.check_valid_mysql_user (REQUEST) Self.__terminate_session(REQUEST) realm=RESPONSE.realm RESPONSE.expireCookie('__ac',path='/') RESPONSE.expireCookie('_ZSession',path='/') RESPONSE.setStatus(401) RESPONSE.setHeader('WWW-Authenticate', 'basic realm="%s"' % realm, 1) RESPONSE.setBody("""<html> <meta http-equiv="refresh" content="0; URL=http://kandinsky:8080/test_folder/logged_out"> <head><title>Logout</title></head> <body> <p> You have been logged out. </p> </body> </html>""") return The problem is that even when I login and 'validate' accepts the credentials, the browser still pops up a box. What am I doing wrong?? . The logout works fine but there is a minor problem in that too which I had posted earlier. TIA. Aseem -- ================================================================== Aseem Mohanty Neurobehavioral Systems Inc, 828 San Pablo Ave, Albany, CA 94706 (R) 510 7696011 (M) 510 3014871 (O) 510 5279231 ================================================================== "I saw `cout' being shifted "Hello world" times to the left and stopped right there!!" -- Steve Gonedes ==================================================================

1 0

fsrecovery in Zope 2.4 ?
by Julián Muñoz 03 Jun '02

03 Jun '02

In Zope 2.5 CHANGES.txt is said "Provided a much more robust tool for recovering data from damaged FileStorage files" I would like to know what tool it is. Is it lib/python/ZODB/fsrecovery.py ?? As I can't upgrade to Zope 2.5 now, I would like to know if it is possible to install and use this tool on Zope 2.4, because the gain in case of a catastrophe seem very interesting. Thank you very much for you atention, -- Saludos de Julián EA4ACL -.-

2 2

Dynamically add an external method at startup
by Emile van Sebille 03 Jun '02

03 Jun '02

I'm trying to exploit a product's initialize method and have it add external methods to a zope installation. What I've cobbled together so far is: import Zope import ZODB from Products.ExternalMethod.ExternalMethod import ExternalMethod import OFS def addExternalMethod(self, id, title, module, function, REQUEST=None): """Add an external method to a folder""" id=str(id) title=str(title) module=str(module) function=str(function) i=ExternalMethod(id,title,module,function) #self._setObject(id,i) def initialize(context): """Initialize the product""" addExternalMethod(None, "MethID", "MethTitle", "Module", "Function") I don't get errors at start up, and of course my "product" isn't registered, but can anyone tell me what self wants to be in addExternalMethod and how I could get there from initialize(context)? Thanks, -- Emile van Sebille emile(a)fenx.com ---------

2 3

[Zope] Security and external methods
by Thierry Florac 03 Jun '02

03 Jun '02

Hi... I have a question with a security related problem. I've written a script to produce PDF output from any HTML output, as described in http://www.zope.org/Members/mjablonski/howtoPDF My problem is that with this simple script, I can get access to protected pages without giving any authentication... Is it normal, and how could I avoid this ?? Thanks for any help or advise... Thierry P.S. : I didn't subscribe to this list, but send this message to it because I thought it was the best one for this. So please reply to me as well as to the list...

1 0

Zope 3 Installation
by Eddie Moench 03 Jun '02

03 Jun '02

Can someone tell me, how to get the Zope 3 (from the CVS) up and running? After correcting the verify-import (there was a case-problem), I get the error message "cannot import name Interface" by the command "from Interface import Interface" - which is called by many scripts. Does anyone had the same problem and knows a solution? Thanks, Eddie. Eddie Mönch Pre-Sales Consulting & Software Development moench(a)ontoprise.de ontoprise GmbH phone: +49 721 - 665 79 - 13, fax: +49 721 - 665 79 - 11 Haid-und-Neu-Str. 7, D-76131 Karlsruhe, Germany

3 2

logout and IE6 problems
by Aseem Mohanty 03 Jun '02

03 Jun '02

Hi All, Pardon the cross post, since I dont know where exactly my problems lie... I am running Zope 2.5.0 (binary release, python 2.1, win32-x86), python 2.1.2, win32 on a Win2k machine with a MySQL server. I just wrote my first UserFolder based on the mysqlUserFolder product, but with some customized stuff to suit my needs. I basically did not use mysqlUserFolder's session and cookie management and instead, am using ZSession for session management. Finally after several days work I have everything running, barring two problems, one doesnt matter much, the other is a gift of the evil empire which I havent figured out as yet. The first problem: For logout purposes I used the function that handles the logout in ZMI and call it from a form; the function is as follows: def user_logout (Self, REQUEST,RESPONSE): """ Terminates user session """ user = Self.check_valid_mysql_user (REQUEST) Self.__terminate_session(REQUEST) realm=RESPONSE.realm RESPONSE.expireCookie('__ac',path='/') RESPONSE.expireCookie('_ZSession',path='/') RESPONSE.setStatus(401) RESPONSE.setHeader('WWW-Authenticate', 'basic realm="%s"' % realm, 1) RESPONSE.setBody("""<html> <meta http-equiv="refresh" content="0; URL=http://xxxx:8080/test_folder/logged_out"> <head><title>Logout</title></head> <body><p>You have been logged out.</p> </body></html>""") return It basically does the job beutifully and I have no problems. What I would like to do however is to be able log back in when prompted for a login and password as a result of this call. I tested the ZMI interface and it does the same too : once you log-out you have to cancel the prompt box and then try and access a protected resource to get logged back in. I tested the control flow and as a matter of fact when I enter the right username/password combo it goes through 'validate' and authenticates it all right but just doesn't accept it and sends another 401. Any ideas as to hwo to get around that would be great....!! The second problem: All of the above works nicely with all versions of Netscape. On IE versions 5.01 and above however, it behaves exceptionally badly. In that I can login and a nice little session variable is created, and the cookies are set up, and when I log out, the sessions are cleared and cookies thrown out and I get prompted to log in which if I cancel, I get booted to the logged out page. All nice and clean. However if I press the back button or type in the URL of a protected resource it sends the authentication information back and I am not prompted to log back in. On looking at the session and cookie info, I found that a new one had been created with the same auth information. "It just ignored the HTTP 401 !!!" Now I dont know if that is a bug in IE ( I am inclined to believe it is!! ), but I have tested my package pretty exhaustively and it works without fail in all NS and upto IE 5.0. If anybody has encountered the problem before and has figured out how to deal with it 'without' closing all IE windows, I would be immensely grateful if s/he could pass on the information. Thanks for you collective patience. Aseem ================================================================== Aseem Mohanty ================================================================== "I saw `cout' being shifted "Hello world" times to the left and stopped right there!!" -- Steve Gonedes ==================================================================

1 0

Weird permission happenings: Is Manager magic?
by Lennart Regebro 01 Jun '02

01 Jun '02

This is the situation: Zope 2.5.1/Python 2.1.3 I'm calling index_html on an object. Index_html in turn finds a template and calls "template.view(self)" on it. The template.view pushes itself on the context inbetween the object and the objects parent, thusly: object.aq_parent thetemplateobjects object It then calls "DTMLMethod.__call__( context, REQUEST, RESPONSE)" to render the DTMLMethod that contains the template itself, and thereby render the object. This works very well, for all purposes except when it comes to security. In the DTMLMethod that contains the HTML I can for example do this: <dtml-var "AUTHENTICATED_USER.has_permission('View', this)"> And here comes the weird part: If I am logged in as a user who has the Manager role, the result will be "1" of the above dtml-var, as expected. However, if I log in as a user who is not Manager, the result will be "None", no matter if the user has the permission or not! I have create a role that has all permission in the root. All permissions are aqcuired over the whole site (which is a very small development site), and still the above returns "None"! So, is there something magic about the Manager role? Best Regards Lennart Regebro Torped Strategi och Kommunikation AB

1 1

__setattr__ and acquisition
by Nicholas Henke 01 Jun '02

01 Jun '02

ok -- this has to be a stupid question that I should have RTFM somewhere -- but I couldn't find the FM for the life of me. Given the following code, I can see why access to self.thing fails in Inner::__setattr__, but the question is how do I do that -- can I not use __setattr__ and have to use a setAttr that is accessed via O.I.setAttr('help','me rhonda') ? Nic import ExtensionClass, Acquisition class Outer(ExtensionClass.Base): thing = ('help','donthelp') class Inner(Acquisition.Implicit): def __setattr__(self,name,value): if name in self.thing: self.__dict__['name'] = value else: print "Bad attribute" O = Outer() I = Inner() O.I = I print O.I.thing # is ok --> gives ('help','donthelp') O.I.help = 'me rhonda' # AttributeError: thing

1 0