March 2003 - Zope-Dev

Trying to understand the nuances of a VerboseSecurity report ..
by Jean Jordaan 04 Mar '03

04 Mar '03

Hi all (and Shane in particular :) I'm triggering this error: Unauthorized: The owner of the executing script is defined outside the context of the object being accessed. Access to 'basic' of (License_PropertySheetsClass instance at e204528) denied. Access requires Access_contents_information_Permission, granted to the following roles: ['Administrator', 'Manager', 'Owner', 'Supporter']. The executing script is (PythonScript instance at e208eb8), owned by jean. I can't understand why .. there is exactly one acl_users in this Zope instance, in the root, where user 'jean' is defined. The whole application normally works fine. Currently, the error is being triggered by a ZUnit unit test. All the other unit tests (adding, editing and deleting instances of various kinds) works fine. The code where the error is occuring is this: """ # Create a new License instance and grab its propertysheet license_id = context.ObjectCounters.newID('License') new_license = container.newItem(license_id) new_license_propertysheet = new_license.propertysheets.basic """ All I can think is that that object 'basic' lacks context for some reason (i.e. lacks an acquisition wrapper?). I can't think why it lacks context .. we use that idiom all over the app, and don't normally get any problems. I'm trying to see if reading VerboseSecurity's source will help, but all I've found so far is a suspect double negation: """ def userHasRolesButNotInContext(user, object, object_roles): '''Returns 1 if the user has any of the listed roles but is not defined in a context which is not an ancestor of object. ''' """ Surely either one of those 'not's should go? -- Jean Jordaan http://www.upfrontsystems.co.za

3 6

Prevayler and "Object Prevalence"
by John Ziniti 04 Mar '03

04 Mar '03

Any ZODB developers read this article at /. and the accompanying one at developerWorks? Would anyone care to comment about the relevance/comparisons of "prevalence" to the concepts of persistence used in ZODB and/or ZEO? http://developers.slashdot.org/article.pl?sid=03/03/03/1220222&mode=nested&… Just looking for some info. Thanks in advance, JZ

3 2

HTTP Response headers in ZPublisher.HTTPResponse
by Romain Slootmaekers 03 Mar '03

03 Mar '03

Yo, the response headers set in ZPublisher.HTTPResponse our not always RFC compliant. In case of exceptions you get: (round lines 670 in HTTPResponse.py) if ev.find( '<html>') >= 0: ev = 'bobo exception' self.setHeader('bobo-exception-value', ev[:255]) If the content is a xml,wml,whtml,... page, this results in exception headers like: Bobo-Exception-Value: <?xml version="1.0"?> <!DOCTYPE ... while most browsers will not barf on this, we encountered numerous problems with wap-gateways refusing to swallow this. Another question is whether it is wise to send things like the file and line numbers where the exception took place to the client. I can understand that it can be useful in debug mode, but I can't see a reason to do this in a production setup. The simplest way of fixing this is to change the code to something like: ev = 'bobo exception' self.setHeader('bobo-exception-value', ev) or to leave out these headers altogether. Romain.

1 0

Re: [ZODB-Dev] standalone ZODB for large Numeric arrays
by Mike Mueller 03 Mar '03

03 Mar '03

>> >>AFAICT, AdaptableStorage is designed to allow this kind of thing. >>Shane? Sounds interesting. I am going to search for this. >Yes, it is. I don't know anything about NetCDF, but it sounds >intriguing. I guess NetCDF is not just an encoding format, but also some >kind of database for large arrays. > >Shane http://my.unidata.ucar.edu/content/software/netcdf/index.html NetCDF (network Common Data Form) is an interface for array-oriented data access and a library that provides an implementation of the interface. The netCDF library also defines a machine-independent format for representing scientific data. Together, the interface, library, and format support the creation, access, and sharing of scientific data. Python interface is contained in Konrad Hinsens Scientifc package http://starship.python.net/~hinsen/ScientificPython/ Mike

1 0

emacs/pdbtrack users - enhanced to handle Zope's "Script (Python)"
by Ken Manheimer 03 Mar '03

03 Mar '03

For those of you that use emacs and pdbtrack, i've extended it a bit to be useful with non-local scripts - eg, through-the-web python scripts, or filesystem-based code on the server's filesystem, hence not findable in your filesystem at the compiled-in path. Pdbtrack is part of emacs python-mode which displays the source file and indicates the current line as you step through the code with the python debugger, pdb, in an emacs shell buffer. It uses information in the pdb trace to find the file and the line, but couldn't do anything if the path of the file isn't valid on your system - eg if the script was compiled on a different system, with the source in a different place or noexistent on your system, or if there is no valid path for the script, eg through-the-web scripts. With the changes, when pdbtrack can't find the file at the indicated path, it tries to find it in existing buffers. It uses the function name and looks through the buffers in your emacs session, from most to least recent, looking for a python-mode buffer that either is named for the function or has a definition (def or class) for that function. So to get source tracking for code that's not resident in your filesystem, you put a copy of the script in a buffer, and pdbtrack will find it. (It also allows an offset for the leading '##' meta-comment lines in filesystem copies of python scripts.) You can find the new version at: http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/python/python/dist/src/Misc/… It's pretty fresh - i'd be happy if people would give it a try, and let me know if you hit problems with it. -- Ken Manheimer klm(a)zope.com

1 1