June 2003 - Zope-Dev

os.system problem
by Arjan Huizer 19 Jun '03

19 Jun '03

Hi, I have created an external method that is called when I upload a file. This external method will execute the validate_file function from my python file in the Extensions directory. The script creates a file and tries to see if it contains a virus. It does run, but after creating the file, the os.system and os.remove commands do not seem to do anything. When I copy the relevant code from the script to a python file and run it on the server directly, the code works. Does anyone know what could be wrong? Thanks in advance! p.s. I am running Zope 2.6.1 with CMF 1.3 on a Linux box. ============= import os def validate_file(file): ''' Check is file contains a virus. ''' filename = "/usr/local/Zope/temp/temp.bin" # Write the file to the local filesystem temp = open(filename, "wb") temp.write(file.read()) temp.flush # Call virus checker error_level = os.system("f-prot " + filename) # Delete temp file os.remove(filename) return error_level;

2 1

Clarification regarding acl_user
by Harish Ramanathan 19 Jun '03

19 Jun '03

Hi I am finding problem in controlling the user list in open flow. Hoe to access the acl_user folder placed in the root directory from a sub directory. I have a code which fetches me the user present in the same directory. But I need to access the user present in the acl_user folder in the root directory. I am using a user account which is created in the root directory . Hence i assume that i have the permission to access the contents of acl_user folder in the root directory. looking forward for a quick reply. Harish. SMS using the Yahoo! Messenger;Download latest version.

1 0

Domain Auth
by Andrew R. Halko 19 Jun '03

19 Jun '03

Does any one know about or have an alternate user folder implementation that has a faster domain auth mode? Andrew

1 0

RE: [Zope-dev] Domain Login Slowness at certain location
by Chris McDonough 18 Jun '03

18 Jun '03

On Wed, 2003-06-18 at 17:38, Andrew R. Halko wrote: > > Sorry for not understanding and thank you for all the help... Not a problem, although I suspect you're going to be disappointed with the answer. ;-) The domain auth feature was turned off by default because it's fairly severely broken, as you've found out. Unfortunately, you found it and turned it back on, despite our best efforts to prevent you from doing so by not providing a knob for this feature within the Zope ZMI. ;-) > How do you create another user folder? You write a Zope Product that allows you to install an alternate "acl_users" object (e.g. write something like ExUserFolder, UserDB, or LDAPUserFolder that improves the domain auth mode feature). > What do you mean by "keep users like this > around in a different data structure"? This would only matter if you were going to write a Zope product. The basic user folder implementation of this feature is too slow. You'd need to create another implementation that is faster by operating against a different arrangement of data in your code. > I currently am only using one user that is called "Intranet User", is > there an easy way to setup so that it just looks at that Users domain > and not any other. I am not good enough with Zope to understand a lot > of these concepts. No, unfortunately. The only way to do this is to write another user folder or improve the current user folder domain auth implementation in a backwards-compatible way. Sorry, - C

1 0

RE: [Zope-dev] Domain Login Slowness at certain location
by Chris McDonough 18 Jun '03

18 Jun '03

The only real solution is to create a different user folder implementation that doesn't handle domain auth so stupidly. For instance, designate a user as a "domain user" and keep users like this around in a different data structure so you don't need to iterate over all users to find one that matches the domain spec. On Wed, 2003-06-18 at 17:07, Andrew R. Halko wrote: > > Any other suggestions on how to implement domain based access? Or is > the only solution to make users create accounts and login. For a large > organization, this is tough. > > Andrew R. Halko > > -----Original Message----- > From: Chris McDonough [mailto:chrism@zope.com] > Sent: Wednesday, June 18, 2003 5:03 PM > To: Andrew R. Halko > Cc: plone-users(a)lists.sourceforge.net; zope-dev(a)zope.org > Subject: Re: [Zope-dev] Domain Login Slowness at certain location > > On Wed, 2003-06-18 at 16:07, Andrew R. Halko wrote: > > > > Hello All, > > > > I set up an Intranet that is based on visitors IP Address. I made a > > tutorial at Plone.org > > (http://plone.org/documentation/howto/HowToDomainIntranet) Now my > > problem is that I am experiencing a lot of slowness for someone that > is > > within the domain, but it is only within this one location. So, if I > > set the site to check my address and log me in, there is not slowness. > > But if I change the site to log people in automatically if they have > the > > ip address for the gateway at the location, it is very very slow > loading > > for all of them. > > > > Does anyone know the processes that the domain attribute goes through > to > > log people in? Or maybe have an idea what could cause it? I am > trying > > to diagnose and I am not sure what could cause it. It is the mixture > of > > the automatic login and firewall or something else at the location. > Any > > ideas? Thanks > > The code to support this "domain auth" feature is perhaps the stupidest > part of Zope.access control. I am disappointed that it is still > supported. Here is the code to support this mode of authentication, > ripped directly from the AccessControl.User module: > > # we need to continue to support this silly mode > # where if there is no auth info, but if a user in our > # database has no password and he has domain restrictions, > # return him as the authorized user. > if not auth: > if self._domain_auth_mode: > for user in self.getUsers(): > if user.getDomains(): > if self.authenticate(user.getUserName(), '', > request): > if self.authorize(user, a, c, n, v, roles): > return user.__of__(self) > > > So this means, in essence, on each request, *for each user in the > system*, check if he he has domain restrictions, if so is able to get in > to the site with a blank password. For a site with many users, > iterating over each user, checking for his domain restrictions, and so > on can take a long time. And note that this doesn't just happen on one > request, it happens on *every* request. Worse, it doesn't just happen > for requests that happen to come from the domain upon which you've > placed domain restrictions, it happens for *all* requests except the > ones that pass in auth credentials via HTTP (from people who have > already presented a valid username/password). This is almost certainly > the cause of the slowness you see. > > I have been trying to remove this feature for quite some time. I can > see its utility but the implementation is just way too stupid to be used > for anything but tiny user databases. > > One possible hack that might make things much faster *for the people in > the domain you're trying to allow access from* is to make sure that the > *first* user returned by getUsers is the user that has the domain > restrictions and blank password. A simple way to do this is to name > that user "AAAA User" (because the default user folder's getUsers sorts > the users by the lexical order of their names). This way the loop above > will at most be gone through once for browsers in the domains you > mention in that user's domain spec. > > This will not be the case for anonymous users. They will go through the > whole user database for every request and only fall off the end of the > userlist once they've tested every user. It will thus be just as slow > for them. > > HTH, > > - C > > > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://mail.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope )

2 1

Re: [Zope-dev] Domain Login Slowness at certain location
by Chris McDonough 18 Jun '03

18 Jun '03

On Wed, 2003-06-18 at 16:07, Andrew R. Halko wrote: > > Hello All, > > I set up an Intranet that is based on visitors IP Address. I made a > tutorial at Plone.org > (http://plone.org/documentation/howto/HowToDomainIntranet) Now my > problem is that I am experiencing a lot of slowness for someone that is > within the domain, but it is only within this one location. So, if I > set the site to check my address and log me in, there is not slowness. > But if I change the site to log people in automatically if they have the > ip address for the gateway at the location, it is very very slow loading > for all of them. > > Does anyone know the processes that the domain attribute goes through to > log people in? Or maybe have an idea what could cause it? I am trying > to diagnose and I am not sure what could cause it. It is the mixture of > the automatic login and firewall or something else at the location. Any > ideas? Thanks The code to support this "domain auth" feature is perhaps the stupidest part of Zope.access control. I am disappointed that it is still supported. Here is the code to support this mode of authentication, ripped directly from the AccessControl.User module: # we need to continue to support this silly mode # where if there is no auth info, but if a user in our # database has no password and he has domain restrictions, # return him as the authorized user. if not auth: if self._domain_auth_mode: for user in self.getUsers(): if user.getDomains(): if self.authenticate(user.getUserName(), '', request): if self.authorize(user, a, c, n, v, roles): return user.__of__(self) So this means, in essence, on each request, *for each user in the system*, check if he he has domain restrictions, if so is able to get in to the site with a blank password. For a site with many users, iterating over each user, checking for his domain restrictions, and so on can take a long time. And note that this doesn't just happen on one request, it happens on *every* request. Worse, it doesn't just happen for requests that happen to come from the domain upon which you've placed domain restrictions, it happens for *all* requests except the ones that pass in auth credentials via HTTP (from people who have already presented a valid username/password). This is almost certainly the cause of the slowness you see. I have been trying to remove this feature for quite some time. I can see its utility but the implementation is just way too stupid to be used for anything but tiny user databases. One possible hack that might make things much faster *for the people in the domain you're trying to allow access from* is to make sure that the *first* user returned by getUsers is the user that has the domain restrictions and blank password. A simple way to do this is to name that user "AAAA User" (because the default user folder's getUsers sorts the users by the lexical order of their names). This way the loop above will at most be gone through once for browsers in the domains you mention in that user's domain spec. This will not be the case for anonymous users. They will go through the whole user database for every request and only fall off the end of the userlist once they've tested every user. It will thus be just as slow for them. HTH, - C

2 1

Domain Login Slowness at certain location
by Andrew R. Halko 18 Jun '03

18 Jun '03

Hello All, I set up an Intranet that is based on visitors IP Address. I made a tutorial at Plone.org (http://plone.org/documentation/howto/HowToDomainIntranet) Now my problem is that I am experiencing a lot of slowness for someone that is within the domain, but it is only within this one location. So, if I set the site to check my address and log me in, there is not slowness. But if I change the site to log people in automatically if they have the ip address for the gateway at the location, it is very very slow loading for all of them. Does anyone know the processes that the domain attribute goes through to log people in? Or maybe have an idea what could cause it? I am trying to diagnose and I am not sure what could cause it. It is the mixture of the automatic login and firewall or something else at the location. Any ideas? Thanks Andrew R. Halko

1 0

RE: [Zope-dev] storing passwords
by sean.upton＠uniontrib.com 18 Jun '03

18 Jun '03

Or SimpleUserFolder: create a user folder class in a Zope product that subclasses both SimpleUserFolder and OFS.Folder. Then put ZSQL methods and a few TTW python scripts in the folder contents of an instance of this class to make it work. I've done something similar to this with relative success. Sean > -----Original Message----- > From: Andreas Jung [mailto:andreas@andreas-jung.com] > Sent: Sunday, June 15, 2003 1:34 PM > To: Markus Bengts; zope-dev(a)zope.org > Subject: Re: [Zope-dev] storing passwords > > > exUserFolder is your friend. > > -aj > > --On Sonntag, 15. Juni 2003 23:28 Uhr +0300 Markus Bengts > <markus(a)qvd.fi> > wrote: > > > > > Hello, > > > > I want to use the same usernames and passwords in Zope and > some other > > servers. The usernames and password digests are stored in a > PostgreSQL > > database, and a given username and password -pair can be > checked with a > > simple SQL-query. > > > > I need to modify Zope to look up and to save passwords in > PostgreSQL. > > > > Has someone done this before? Can someone tell me which source file > > contains the method that reads or saves passwords? Can this > be done by > > modifying only one source file? > > > > Markus > > > > _______________________________________________ > > Zope-Dev maillist - Zope-Dev(a)zope.org > > http://mail.zope.org/mailman/listinfo/zope-dev > > ** No cross posts or HTML encoding! ** > > (Related lists - > > http://mail.zope.org/mailman/listinfo/zope-announce > > http://mail.zope.org/mailman/listinfo/zope ) > > > > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://mail.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope ) >

3 4

Re: Renaming a product
by Morten W. Petersen 18 Jun '03

18 Jun '03

> Somebody correct me please, if I'm wrong, but > > 1. tinkering with __class__ is the only way to do this. > 2. you can not tinker with __class__ of an ExtensionClass, i.e. all > Persistent objects. It's not easily doable, no. I settled on converting each instance (copying properties) from the old product name to the new, and it worked. Thanks for your help everybody. :) Regards, Morten W. Petersen -- Technologies: Zope, Linux, Python, HTML, CSS, PHP Homepage: http://www.nidelven-it.no Phone number: (+47) 45 44 00 69

1 0

Renaming a product
by Morten W. Petersen 18 Jun '03

18 Jun '03

Hi all, does anyone know how to rename a product, so that instances of the product stored in ZODB will work (with the new name) after the rename? Thanks, Morten W. Petersen -- Technologies: Zope, Linux, Python, HTML, CSS, PHP Homepage: http://www.nidelven-it.no Phone number: (+47) 45 44 00 69

4 3