- Zope-Dev - Zope lists

User folders, access rights, security, collector item 47
by Brad Clements 29 Nov '01

29 Nov '01

Sorry to post here. I posted last week on the zope list about what appears to be a new/strange security related problem in 2.4.3 I thought it was a problem in LdapUserFolder, but jens spent more time debugging than I did and he feels it's somewhere in the Zope security machinery. http://collector.zope.org/Zope/47 Is it security related when security doesn't do what you want (though nothing has been exposed, rather, what we want exposed isn't)? I'd try to tackle this myself, but I really have no idea where to start. I know everyone is busy, but I was wondering if anyone else has been able to reproduce the condition so that we can say for certain if its a bug, or a mis-configuration. Thanks, Brad Clements, bkc(a)murkworks.com (315)268-1000 http://www.murkworks.com (315)268-9812 Fax netmeeting: ils://ils.murkworks.com AOL-IM: BKClements

1 0

Re: [Zope-dev] Catalog improvements
by Wolfram Kerber 29 Nov '01

29 Nov '01

Hi No, i wasn't aware of your product :-( , the only one i found was ZOQL by Stephan Richter, but that didn't help much. Well, now i have written an implementation that reuses some of the code in TextIndex (for parenthesis parsing and insertion of a default operator) an then saves the query in RPN format (so the Catalog does't need to think that hard when being queried). I have taken a look at your product, and i'd say a 'new' Catalog should have sort of QueryParser plugins that know how to turn string-queries (as yours) or SQL to native Catalog queries ... I've also contacted the authors of the two proposals, just wasn't sure wether i should start this off, since i have no experience as to how the fishbowl works and i'm expected to finish my current project sometime soon. Wolfram ----- Original Message ----- From: "Casey Duncan" <c.duncan(a)nlada.org> To: "Wolfram Kerber" <wk(a)gallileus.de>; <zope-dev(a)zope.org> Sent: Tuesday, November 27, 2001 2:48 PM Subject: Re: [Zope-dev] Catalog improvements > On Tuesday 20 November 2001 05:35 pm, Wolfram Kerber allegedly wrote: > > Hi, > > > > i'm currently working on a product that allows to attach relational > > information to zope-objects. It works quite well so far, but to further > > enhance it i need to make some changes to the Catalog. I could perhaps > > implement it as a separate product, but i strongly feel that those changes > > are best applied to the Catalog itself, as they are of general use (i > > think) and involve a lot of changes to the inner workings of the Catalog. > > In particular i need the following: > > > > - named/stored queries > > these are precompiled queries, so they can be executed without parsing and > > are easily cacheable > > i.e. similar to what is implemented in CMFTopic, but stored in the Catalog > > and a bit smarter > > > > - caching support > > > > - unions and intersections > > sub-queries (i.e. queries that are directed at a certain index) should be > > more flexibly combineable > > I have some code that implements this in my CatalogQuery product. It creates > a query object from a string. Presently these are not persistent, but they > could easily be made to be to create precompiled queries. > > code at: http://www.zope.org/Members/Kaivo/CatalogQuery > > > > > I searched this mailing-list as well as zope.org to get an idea about what > > has already been discussed and requested, and there seems to be some > > interest in improving the Catalog. Some people even seem to have worked on > > this, perhaps they could give an update on this? Possibly i don't have to > > write everything from scratch... > > I would be willing to help both in coding and getting the code put into the > Zope core. > > > I would have put this into a proposal, but there already are two proposals > > that deal with the features i want, one is dedicated to > > unions/intersections, the other (TopicIndexes) to performance issues (i > > dont't know what's the status of these though, especially the first one is > > rather old), and i don't want to hijack them without asking. As so often i > > will need to complete my current project first, but would then like to help > > in improving the Catalog for a more general use. > > Possibly we need to rekindle discussion. I would suggest contacting the > authors of those proposals to see how compatible your concepts are wth > theirs. Perhaps a new proposal should be drafted with the new ideas and ty > them back to the previous ones. If there is redundancy, that can be worked > out. > > > > > So, if there is interest, i would propose to collect some ideas and > > comments about how a better Catalog should look like, how it could be best > > implemented and how to organize this effort (with respect to the already > > existing proposals). > > I am very interested in such a discussion. Let me know what I can do to help. > > /---------------------------------------------------\ > Casey Duncan, Sr. Web Developer > National Legal Aid and Defender Association > c.duncan(a)nlada.org > \---------------------------------------------------/

3 3

one help file refuses to load in my product. Help?
by Gary Poster 29 Nov '01

29 Nov '01

Hi all. I have a folder-like product that holds some other objects that are not products--like the users in a user folder, their class definition is in the same product (and file) as their parent folder. Unlike users in the user folder, my subobjects actually have use a tabbed Zope UI themselves. The problem is that when I context.registerHelp() in my init file, the .stx help files in my help directory are all registered correctly, *except* the one used by the subobject's tabs. I've gone through the registerHelp process as best I can and the method just goes through the help directory, registering everything it finds newer than what it already has. It doesn't seem to care what uses the file, or even if anything does. However, that one file never loads, even as I try changing its name, modifying it, modifying other help files, etc. Help? Thanks Gary

1 0

Different way to use portal_types actions (was: Best way to do "links")
by Bjorn Stabell 29 Nov '01

29 Nov '01

Oliver, Yes, you're right there is no direct link; I forgot to mention that. I've made the link similarly to the way 'index_html' and 'view' are linked by looking up in portal_types the Type object corresponding to your portal_type. Here is an example: security.declareProtected(View, 'summary') def summary(self, client=None, REQUEST=None): ''' ''' action = self.getTypeInfo().getActionById('summary', None) func = getattr(self, action) return func(self, client, REQUEST) So you basically have to designate a few methods that you want to override this way. This wasn't a big problem for us. We basically subclass all our content from a base class that defines these methods in the same way as summary was defined above, effectively letting us override them in dynamic types: line - a line based rendering of the content, suitable to use in listings feature - a half-page width render if the content, with icon image, title and description summary - a one-paragraph rendering of the content, suitable for inclusion in search results body - just the body of the content, suitable for inclusion in other templates Furthermore, we've extended the metadata_edit form so that it shows a pull-down menu of all portal_types that can be used with this meta_type, also found dynamically by looking it up in portal_types: -- in base class: def listContentTypes(self, meta_type=None): """List content types which meta_type can be bound to.""" if meta_type==None: meta_type = self.meta_type types = [] for ti in self.portal_types.listTypeInfo(): if ti.content_meta_type == meta_type: types.append(ti) return types --- in metadata_edit form: <th align="right">Dynamic type</th> <td><dtml-let my_type="portal_type" ><dtml-in listContentTypes> <dtml-if sequence-start> <select name="portal_type:ignore_empty:ignore_missing"> <option value="">Please select..</option> </dtml-if> <option <dtml-if "my_type == id">selected</dtml-if>>&dtml-id;</option> <dtml-if sequence-end> </select> </dtml-if> <dtml-else> No dynamic types available for &dtml-meta_type; </dtml-in> </dtml-let> </td> --- In a way, this is abusing the actions of the portal_types. This is not a problem for us as we don't use them: we find just providing a "Manage" link to ./manage_workspace to work better, and then creating all our management interfaces in the ZMI... It is more reusable this way, and provides content managers with more power. Bye, -- Bjorn -----Original Message----- From: Oliver Bleutgen [mailto:myzope@gmx.net] Sent: Thursday, November 29, 2001 00:23 To: Bjorn Stabell Subject: Re: [Zope-dev] Repost to zope-dev: Best way to do "links" Hi Bjorn, sorry for adressing you directly, but I have only one small question on what you wrote. Bjorn Stabell wrote: > Two comments. One with regards to solving the original problem, one > with regards to links. > > > SEVERAL TEMPLATES FOR ONE CONTENT TYPE > > With the CMF you have another level of typing of objects available: > portal_type (dynamic type). A meta_type can have many corresponding > portal_types, e.g., a generic MyDocument class (implemented in a > Python > product) can support many logical types who only varies in their usage > and skin. The CMF lets you set the portal_type at creation time (you're > basically creating a portal_type object, implicitly based on some kind > of meta_type object). > > What I'm doing now, and it works quite nicely, is to enable users to > change the portal_type at run-time. In the Metadata edit view for an > object, I scan the available portal_types for the given meta_type and > give the user the option to select one of them as the "current dynamic > type (portal_type). The CMF's portal_skin tool does the rest of > selecting the correct skins to use (based on the portal_type > attribute). I don't understand the last sentence, because I don't see any direct link from portal_type to portal_skin. As far as I see it, you get the functionality of dynamic templates by creating objects of differing portal-type, but from the same meta_type, and then using different methods for the view action of each portal_type. I just don't see how the portal_type directly influences the skin which is used to render it. Did I misunderstand you? cheers, oliver

1 0

Re: [Zope-dev] Security Question
by Danny William Adair 29 Nov '01

29 Nov '01

> This doesn't work, because the user it not known in root where the > index_html is, > the user is known in the folder view. Sorry. I think I read your first email a little too fast. This behavior is normal, and meant to strengthen Zope security. You are not calling the Image object, index_html is. The user folder will not authenticate "above". You are calling index_html which is "above". That's why calling the Image object directly works fine. If the other way would be possible, you could switch the authenticating user_folders and thus sneak into something you weren't allowed to access: <dtml-with folder_where_current_user_is_in_acl_users_and_has_foobar_role> <dtml-with folder_next_to_it_where_user_can_access_contents_information> <dtml-var some_Image_only_foobar_role_owners_can_view> </dtml-with> </dtml-with> This means showing the bouncer your public library card, instead of (at least) your driver's license. Of course it says that you're 21... By the way, this has nothing to do with the URL. Calling /foo/bar/index_html, (hoping for acquisition leaving you with the client object "bar"), will bring the same result. <dtml-var Image> will _find_ the Image object, but index_html (which is still above) will need to show proper permissions. So you cannot do it this way. Not even unrestrictedTraverse would help you. Not even a proxy role, since you would have the same problem with the method that holds the proxy role. Where would you put it? If I understand you right, you want the user to authenticate when trying to access index_html, because that's where the protected image will be shown. (Or was the question not of practical relevance?) You either have to move index_html down to where acl_users lies, or the other way around. If you want one universal "view image" page, which only asks for authentication if needed for the image it is supposed to show (and doesn't for public images), then call "foo/bar/Image/show" with "show" being a method on the same level as your current index_html. Another way would be redirection. The third and by far the easiest solution is to use <img src="/foo/bar/Image"> in index_html, because then the Image object will be requested directly and authenticates itself (on the right level). I was rebuilding your sample structure, and found something quite annoying, that might have to go into the Collecor: "Access contents information" looks like it is not sufficient to access image objects or their properties. <dtml-var "foo.bar.Image.width"> will need the "View" permission, which is not how this thing works with other object types. As soon as you _access_ an image object Zope behaves as if you were trying to render it, but you're not (yet). You might have found a Zope bug here... Hope this helps, Danny

1 0

Security Question
by Andre Schubert 28 Nov '01

28 Nov '01

Hi all, i have a little security problem. let me explain. root/ index_html foo/ acl_users/ bar/ Image I have a image which could only be view by users with a role named foobar, these users are in acl_users. If i access the image through the web a must authenticate myself for the first time, after that everything works well. But if i want to access the Image via <dtml-var Image> from the index_html in the root-folder a got no access. After searching at Zope.org i tested with <dtml-var "restrictedTraverse('foo/bar/Image')"> but this doesnt works. How do i authenticate myself in foo if i access the folder via dtml. Thanks as P.S.: Sorry for my bad english

4 8

Inserting file in ZODB
by Demont Maarten 28 Nov '01

28 Nov '01

Hey I want to insert a file from my "normal" file system into the ZODB database. I have collected the path from a form-field "file". The file that needs inserting must be placed in a certain folder inside Zope, and gets a title that I base upon a certain number. How can I - using DTML - insert this file? Can anyone supply me (fast, this is quite urgent...) with a few lines of code explaining this? Thanx!!!!! Maarten Demont maarten.demont(a)cronos.be Zope-Newbie

2 1

Overriding base class method / CatalogAware mixin
by sean.upton＠uniontrib.com 27 Nov '01

27 Nov '01

I'm having the same problem described in: http://lists.zope.org/pipermail/zope-dev/1999-November/002427.html My class inherits from a few base classes including CatalogAware as a mixin; I'm trying to override a method in my core API superclass (which uses MySQLdb, and thus mx-DateTime), with a similar method that is compatible with Zope's DateTime; I got a TypeError that I think is due to ExtensionClass when trying to call the superclasses method, even with an instance of the subclass passed as the first variable. Since this didn't work, I ended up having to create a temporary instance of the superclass and inside a method of the subclass - not entirely graceful, but it works. Is there a more graceful way to get around this? (I'm using Zope 2.3.3/Python 1.5.2 at the moment). Sean ========================= Sean Upton Senior Programmer/Analyst SignOnSanDiego.com The San Diego Union-Tribune 619.718.5241 sean.upton(a)uniontrib.com =========================

2 1

PluginIndexes, 2 bugs
by Juan David Ibáñez Palomar 27 Nov '01

27 Nov '01

First bug, the module 'Products/PluginIndexes/tests/testFieldIndex.py' contains the methods 'checkEmpty', 'checkPopulated', 'checkZero', 'checkNone' and 'checkRange'; they should be named 'testEmpty', 'testPopulated', etc.. otherwise the tests doesn't run. Last bug, The file 'Products/PluginIndexes/README.txt' from Zope 2.4.3 says that there're two ways to pass parameters: old: <dtml-in myCatalog(myindex='xx yy',myindex_usage':'blabla') new: <dtml-in myCatalog(myindex={'query':'xx yy','usage':'....'}) And the class 'CatalogTool' in 'Products/CMFCore/CatalogTool.py' (CMF from the CVS) uses the new way, but it doesn't works. Add the following test case to'PluginIndexes/tests/testFieldIndex.py': def testNewRange(self): """Test a range search""" index = FieldIndex( 'foo' ) for i in range(100): index.index_object(i, Dummy(i%10)) r=index._apply_index({'foo': {'query': [-99, 3], 'usage': 'range:min:max'}}) assert tuple(r[1])==('foo',), r[1] r=list(r[0].keys()) expect=[ 0, 1, 2, 3, 10, 11, 12, 13, 20, 21, 22, 23, 30, 31, 32, 33, 40, 41, 42, 43, 50, 51, 52, 53, 60, 61, 62, 63, 70, 71, 72, 73, 80, 81, 82, 83, 90, 91, 92, 93 ] assert r==expect, r This test is similar to 'testRange' but uses the new way to pass parameters. It fails: AssertionError: [3, 13, 23, 33, 43, 53, 63, 73, 83, 93] -- J. David Ibáñez, Nuxeo.com

1 0

Resize a image stored in a Oracle's BLOB Field
by Juan Javier Carrera Obrero 27 Nov '01

27 Nov '01

Hello, Thanks, I have displayed the images which them was stored in a Oracle's BLOB field, with: <dtml-call expr="RESPONSE.setHeader('content-type','image/jpeg')"> <dtml-in SQLMethod_with_a_Only_Row> <dtml-var expr="BLOB_FIELD.read()"> </dtml-in> However, I would like to resize this image. I can not do it with the "height" and "width" attributes, because the image is obtained from a Oracle's BLOB field, and no from image object (i.e.: I can not use <dtml-var "ImageObject.tag(border='5', align='left')">). How can I do it ? Thanks again !

4 3