December 2004 - Zope-Dev

Patch for attribute permisions problems in Zope 2.7.3
by Santi Camps 21 Feb '05

21 Feb '05

Hi all again, We have been written last week about some attribute permission problems with Zope 2.7.3 beta due to a patch applied by Tres. First of all, Tres, apologies for my too fast written test case and my too late test of Zope 2.7.3. Now, with some more time, I've tested and debugged on Zope 2.7.3 and found exactly what's happen. Supose we have a structure of objects like this: A.__of__(B) "A" inherits from Acquisition.Implicit, has security assertions, but has not __allow_access_to_unprotected_subojects__ We want to access, from a Zope Page Template, an attribute of "B" that is not present in "A" Accessing B.our_attribute attribute works fine. But accessing A.__of__(B).our_attribute fails, and should work. The problem is the call to "validate" done in "guarded_getattr" method of ImplPython.py. The actual call is "if validate(inst, inst, name, v)", but the validate function says: Arguments: accessed -- the object that was being accessed container -- the object the value was found in name -- The name used to access the value value -- The value retrieved though the access. roles -- The roles of the object if already known. Now, "accessed" and "container" are always the same, and in some cases should be different. I attach a patch to solve this case that works for me. I'm not sure if my code is the best way to solve the problem but, as I said, it seems to work fine. Of course, If the patch is accepted, the same change should be done in the C version. Thanks Santi Camps http://www.earcon.com --- ImplPython.py 2004-08-07 19:15:48.000000000 +0200 +++ /usr/local/zope273/lib/python/AccessControl/ImplPython.py 2004-10-29 10:56:11.000000000 +0200 @@ -534,6 +534,12 @@ # exceptions are caught early. try: v = getattr(inst, name) + container = inst + while hasattr(container,'aq_explicit') and \ + not(hasattr(container.aq_explicit, name)) and \ + hasattr(container, 'aq_parent'): + # Find real container when attribute is acquired + container = container.aq_parent except AttributeError: if default is not _marker: return default @@ -551,6 +557,6 @@ return v validate = SecurityManagement.getSecurityManager().validate - if validate(inst, inst, name, v): + if validate(inst, container, name, v): return v raise Unauthorized, name

2 2

encrypted _ac_name & _ac_password
by Declan Shanaghy 30 Dec '04

30 Dec '04

I was wondering if my solution to the problem outlined below would be a useful inclusion into the main CMF code tree? I solved this by encrypting the __ac_name and __ac_password values in the URL and then hacked CookieCrumbler.py to decrypt them before it sets the cookie. The general idea is that the user would setup the path to a method called decrypt as a property of the cookie crumbler. If this property is non NULL the cookie crumbler calls it to decrypt the values b4 setting the cookie, in an instance where the value is not decrypted the decryption mechanism should return the value passed to it. --On Donnerstag, 23. Dezember 2004 11:47 Uhr -0800 Declan Shanaghy <declan(a)shanaghy.com> wrote: > I have set up a portal of shopping sites. > Each merchant we support has their own domain set up. > > e.g. > > http://www.some-merchant.com > > Seeing as they are shopping sites certain pages have > to be handled by SSL. > > Due to SSL limitations only 1 SSL domain+certificate > can exist per ip, and we only have 1 ip. Therefore my > solution is that for non SSL pages the merchant can > use their own unique domain name, but all SSL pages > will be redirected to > > https://merchantname.portal.com and an SSL certificate > is setup with a CN of *.portal.com > > A problem arises when switching between domains like > this. The login cookie is lost. Curently i do a > redirect between domains and include __ac_name and > __ac_password arguments in the URL so the user stays > logged in, but this causes the username and password > to be displayed in the address bar in plain text. > > I'd like to secure this more. > > Is there any way that i could > > A - Encrypt __ac_name and __ac_password values? > > or > > B - Set the cookie for both domains so name and > password dont have to be transferred? > >

3 2

Access Content stored in the FileSystem without storing them in the ZODB
by MET 2004-2005 28 Dec '04

28 Dec '04

I am working on product named GNOWSYS (a content management software), the software has the facility to add Objects along with the properties and Content. Only the properties of the object are stored in the ZODB but actual content are stored in the File System i.e in the zope's var directory. I am facing problem if the content is something other than "text" for eg an image. Can anybody tell me How can I display the Content of an Object that is an Image in a Page Template? Thanks for ur help in advance.

2 1

SOAP Support for ZOPE
by Aruna Kathiria 28 Dec '04

28 Dec '04

Hello: I did some work regarding SOAP support on ZOPE and published this document on zope.org. The link for this document is http://zope.org/Members/arunacgx/SOAP%20Support%20on%20Zope/file_view I would like to get feedback/suggestion regarding this document. With Regards, Aruna Kathiriya Sr.Consultant, CIGNEX Technologies, Inc T: 408.327.9900 x 314 F: 408.273.6785 C: 408.896.1330 E: aruna(a)cignex.com U: www.cignex.com "Implement IT Right"

8 10

getPassword() from PythonScript
by Krzysztof Kubacki 27 Dec '04

27 Dec '04

Hi, Zope 2-7-0 Linux Is possible to get user's password by getPassword() method using Python Script? Any proxes don't work. the code below: user = context.getMemberById(context,'koperski') return user.getPassword() returns: The object is marked as private. Access to 'getPassword' of (MemberData at 0x2353aea0) denied. Thanks in advance KK

3 2

FS PageTemplates and XML generation issues
by Alan Milligan 22 Dec '04

22 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I have some PT skins I'm using to generate XML responses and am getting some strange behaviour. I'm not sure if its because I misunderstand something, there are bugs, or the API could be made more useful. I will focus this discussion around the following ZPT: <?xml version="1.0" encoding="UTF-8"?> <repomd xmlns="http://linux.duke.edu/metadata/repo"> ~ <data type="other" tal:repeat="source here/objectValues" tal:attributes="type source/meta_type"> ~ <location href="" tal:attributes="href string:repodata/${source/id}"/> ~ <checksum type="sha" tal:content="source/checksum"/> ~ <timestamp tal:content="source/timestamp"/> ~ <open-checksum type="sha" tal:content="source/open_checksum"/> ~ </data> </repomd> What is happening with this is that it's not doing any TAL rendering at all and just returning this 'raw' xml. However, if I customise my skin and assure the content-type is text/html, then it indeed renders this 'xml'. I have experimented with the xmlns on this to no avail. Besides, it surely must be implicit in the choice of making this a FSPT, that I am anticipating TAL/METAL rendering, and that any non-(ME)TAL tags in the raw text are to be passed thru to the client... I am also concerned that the FSPT code has implicitly assumed that the content type is text/xml. While I'd prefer this to be the type, at this stage, this choice does not work ... I would however have thought that in lieu of an explicit statement, any FSPT would be of type text/html... This brings me to my other question: how do I set the content-type on an FSPT?? It would seem that content-type=xxx in the [default] section of the .metadata file is ignored. I'd someone to comment upon my observations before investigating further. Alan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFByS4YCfroLk4EZpkRAk+pAKCZKz6swAiPjCASlYeTRNr1aayhjQCgqvMs tAhtC2jRk9mOPsA3ObH3Ow0= =/vDj -----END PGP SIGNATURE-----

2 5

i18n:translate - problem
by Krzysztof Kubacki 22 Dec '04

22 Dec '04

Hi, I have the Zope 2.7.0 instaled under Linux OS. I want to have my website in many languages in one Plone site. So I have installed "Placeless Translation Service". I've made 2 .po files (cms_pl.po, cms_en.po) and compiled to .mo files (cms_pl.mo, cms_en.mo). I want to change website language version based on varriable value in ZPT and this is the problem (I think). When I do .po files with the same domain, e.g: "Domain: CMS\n" and they have different "Language-Code:" header e.g: "Language-Code: pl\n" and "Language-Code: en\n" Zope chooses language based on web browser settings :(. When I'm setting "xml:lang" and "lang" attributtes it doesen't make effect. There is second way. I can do 2 .po files with different "Domain" and choose the one depends on variable but I cant dynamicialy set "i18n:domain" attribute. How to manage that? Thanks in advance Krzysztof Kubacki

3 2

Why third_party/docutils?
by Stefan H. Holek 20 Dec '04

20 Dec '04

[docutils was moved from lib/python/docutils to lib/python/third_party/docutils/docutils and an ugly sys.path hack employed] Why oh why do we always have to make it harder to start up Zope (instead of making it simpler, for once)? Extending the path in lib/python/sitecustomize only works if lib/python is on the PYTHONPATH at the time the interpreter is started. This is fine in case of ./bin/zopectl, but not anywhere else. For example it breaks basically all test runners. Yes, I have seen that test.py got hacked to append third_party/docutils to the sys.path, this is however not a solution IMO, but plain cheating around a code layout error. test.py is *not* the only test runner around, nor is ./bin/zopectl the only way to start up Zope! Many a sysadmin will curse at having to "fix" a whole bunch of scripts. We have been very careful in the past to accommodate them, let me remind you of the ZOPE_CONFIG hack we added just for legacy scripts. What is the reason for third_party? Is is absolutely required, and if yes, why? Why not keep it simple (well, as simple as possible given the already tricky Z2 startup sequence)? I'd be very happy if this decision could be reconsidered. Thoughts? Stefan -- The time has come to start talking about whether the emperor is as well dressed as we are supposed to think he is. /Pete McBreen/

7 22

Is Zope.2.7.4 feature frozen ?
by Rodrigo Dias Arruda Senra 20 Dec '04

20 Dec '04

Hi, is the Zope 2.7.4 feature frozen ? If not, I believe that the patch : http://zope.org/Collectors/Zope/1584 It adds the directive 'extensions' to zope.conf. If overriden, then the specified directory will be used for ExternalMethods, instead of the default $INSTANCE/Extensions. IMVHO it would be simple to add and nice to have it there. For further information check the thread "Give 'Extensions' a configurable directory in zope.conf", in zope users mailling list. Nevertheless, that patch was cooked for 2.8. I volunteer to clean it, port it back and test it under 2.7.4b, and re-submit to ZC if approved. best regards, Rod Senra

4 8

Re: cvs for Zope 2.7.X
by Jim Fulton 20 Dec '04

20 Dec '04

Dennis Allison wrote: > I am a bit confused by the current state of the CVS repository. Where is > the current CVS for Zope 2.7.3+? On the Zope-2_7-branch branch in the CVS repository. > What's the purpose of the markers saying > > ATTENTION_THIS_AREA_IS_NOW_CLOSED.txt/1.1 Did you read the contents of this file? Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

1 0