- Zope-Dev - Zope lists

RE: [Zope-dev] Weird ConflictErrors on startup
by Toby Dickenson 06 Aug '01

06 Aug '01

All of the standard products Chris W mentioned do this.... Zope keeps the product help index in a persistent BTree, which is updated automatically at product startup. > -----Original Message----- > From: Chris McDonough [mailto:chrism@zope.com] > Sent: 06 August 2001 17:36 > To: tdickenson(a)geminidataloggers.com > Cc: Chris Withers; zope-dev(a)zope.org > Subject: Re: [Zope-dev] Weird ConflictErrors on startup > > > It's generally bad form for a Product to try to modify a persistent > object at startup. Unless it's an _v_ attribute or something.

2 1

Copy, Cut and Cookies: a CopySupport.py question
by Jeff Sasmor 06 Aug '01

06 Aug '01

To someone with perhaps more ZZen than myself .... I am trying to understand CopySupport.py - It seems that objects that are cut or copied are stored in a cookie on the client. I could see how this would be easier than trying to associate some stored data item on the server with a particular client browser, but it also seems somewhat inefficient (esp. as regards upload and download times from the client) unless the object is relatively small in size and I also wonder if this scheme would break down completely for a big object, say something a few MB in size. Am I missing something ? Or maybe this is the only reasonably sane way to do it. TIA Jeff Sasmor jeff(a)sasmor.com www.netkook.com is an "open Zope CMF site"

2 1

Changes to Refresh
by Shane Hathaway 06 Aug '01

06 Aug '01

I've checked in a change to the way refresh works that should make it much more reliable. Instead of guessing at module dependencies and using the reload() function, it now just removes the appropriate modules from sys.modules temporarily. That way dependencies are resolved the natural way. For me, this corrected a lot of problems, at only a small cost. The change should be in the next Zope release, but if you're following CVS you can get the change right away. Please let me know if it fixes or breaks things. Shane

2 1

[Long] Advice solicited on Security, exUserFloder, and Components in Zope 2.4.x and forward?
by Dario Lopez-Kästen 06 Aug '01

06 Aug '01

Hello! A couple questions for ye Zope Deities, I am starting out in Python programming and Zope by adapting the exUserFolder product for usage with Zope 2.4.x and to our own security stuff. So far I have had limited luck, but I am slowly understanding how Zope UserFolders work and how exUserFolder works. If anyone has had any success in adapting exUserFolder for Zope 2.4.x please let me know, as you are probably better doing it than I am :-). I am adapting the exUserFolder for various reasons, the most important being that I need to manage amounts of 10k+ users with several different types of roles, that have to be calculated in some sintances. The setting here is a university building a Eduational Portal for it's students and staff. I would gladly accept any input of whether this is doable by adapting the exUserFolder or if there are any other means of doing it. I do not wnat to list 10k+ users in the management interface, nor do I want to have to list all possible, and current, roles each and every user might have. Eplanation of my rationale follows below. During this investigation I've looked at the ZopeDevGuide, and I am wondering if I can start using the new component interfaces with the current release of Zope. It is not clear that I cannot but it als is not clear if I can. Anyway, any help or comments are appreciated. --<begin longish problem explanation>-- Due to the nature of our infrastructure, I need to have a very clean separation of authentication, authorisation, user-mapping and user-information. I essence our needs mandate that we keep a map-database between various keys identifying users in various systems, where Zope works as the middleware. Our "authentication service" are actually three different auth services (try one, if fail try next, etc) that we need to employ during a trasition phase (we'll end up using DCE in the end for all centralised authentication services). The mapping service helps us map the username to various other keys needed to iteract with some of our legacy systems. We maintain a database mapping username with, for example, social security number. This way, when you log in, you only use your username and passwd and then the system automagically knows your social sec nr and a) gives you personalised info from the university and b) prevents you from accessing other user's personal info. The auth service will be used to allow or restrict access to various parts of the system. For instance, it is desirable to restrict certain features in a course homepage system to people that are actually registered as participants in the course. For this we want to use a system of "calculated roles" in combination with what I, for lack of a better name, would call "adapted queries" (as in "return only stuff for user x"). So I am thinking of finding a way of providing Zope with a list of acceptable roles, say, as the result of a ZSQLMethod. The user-info service would provide us with other user-properties such as Full Name, Home Adress, etc. The problems I am having so far is that I cannot even get etcAuthSorce working. I am now trying with usAuthSource and have had some luck with it, but nothing that works quite right just yet. --<end longish problem explanation>-- Any helps is, as always, appreciated. Sincerely, /dario cc-ing zope-edu-user, eurozope - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario(a)ita.chalmers.se ICQ will yield no hits IT Systems & Services

1 0

Re: [Zope-dev] Help on Zope security needed ...
by Oliver Bleutgen 06 Aug '01

06 Aug '01

Hi Joachim, > No, it shouldn't. > Am starting to think that the Zope security model implementation is a bit > "strange". So, actually I thought that _my_ brain is going wrong here, but if it isn't, this is IMO a very serious bug. I just couldn't believe that something serious like that could have gone through up to zope 2.3.3 without anybody noticing, when it is indeed not wanted behaviour. >What I'd need in practice is a security model that > a) is completely predictable (that's what > http://dev.zope.org/Wikis/DevSite/Proposals/SecurityJihad is working on) > b) would normally make sure that somebody in a subfolder can not get > access > to anything that is explicitly protected in the parent folder I would think not follwing a) and esp. b), the software has a bug, or the documentation. I for one can't find anything in http://www.zope.org/Members/michel/ZB/Security.dtml which would warn about the above described behaviour. > c) would on the other hand offer the possibility to bind access to a role, > regardless where in the folder hierarchy somebody gets the role. No, I wouldn't like this, I always thought that containment before context should also apply to security. > The problem is with acquisition: If I have an "editButtonsBar" widget in > my > root directory, I'd like to make it available to ALL Editors, not just to > the ones who have editor roles in root. Do you want to make it available or editable? > On the other hand, if I have a standard header or footer that should not > be > overriden in a subfolder, this should be possible. This means I'd not only > need a permission that can not be bound to roles in the subfolder, but > also > a mechanism to prevent overriding the object ... Isn't this a typicial problem for a zclass or product or whatever? Even if I couldn't overide standard_html_header, i.e. create my own methods with that name, I could always change the places where it is called to call my_own_header instead. cheers, oliver

4 3

Re: [Zope-dev] ComponentArchitecture thoughts
by Ken Manheimer 05 Aug '01

05 Aug '01

On Sat, 4 Aug 2001 15:05:21 +0200, Joachim wrote: > Before that, Tim McLaughlin wrote: > > I listened in on the chat regarding this and although I think the idea has > > merit, I'm not sure that it is vitally important right now. It could too > > quickly turn into a lot of burned time with nothing to show for it. [...] > One of the important points to make is that ZClasses (or a replacement for > them) as well as the security model are frequently used by Zope users (or > "configurators") , while the new components model will mainly be a benefit > for Zope programmers (i.e. people working on extending Zope rather than just > using it). So their impact might be much larger ... I'm going out on a limb, here. I've got a slightly sketchy understanding of the component architecture, myself. But my impression, from what i do understand, is that it will make it easy to do a lot of the things that bring people to ZClasses, and in a better way. At the least, i think it will significantly reduce the pressures that push people in the direction of ZClasses, and at best, fill in most of the gaps that ZClasses currently fill haphazardly. (In contrast to some other voices at zope corp, i *do* see significant value in ZClasses, as opposed to filesystem products[*]. I've used them in the tracker, a bit in my wiki projects, and in customer projects. So i'm with you in wanting what they offer, and in wanting relief from their shortcomings.) Many fundamentals of the component architecture were born in the CMF. Those of us using the CMF found that several of its features enabled the kinds of things we sought from ZClasses, but in a better organized way. Skins, for instance, provide for through-the-web customization of presentation and steering, as do ZClasses. In conjunction with the types-tool and type factory information, you can connect skin methods (and others) with content types, as ZClasses associate the contained method artifacts with the class. In addition, skins provide a direct development path from through-the-web customization to filesystem-based artifacts, and back. The filesystem connection, alone, is a major win over ZClasses, where people suffer for lack of version control, grepping, and other amenities available to stuff based in the file-system. Fostering of separation between presentation, application, and glue between the two is another great benefit of the CMF skinning model. ZClasses can be used in this model, but many of their virtues are superceded by what's there, and they don't specifically support the separation. Yet another advantage of the component approach is that components, even the service components, are "placeful" - they can be situated anywhere in the object hierarchy. This means you can have the same service, for instance, implemented in different ways for different parts of the folder hierarchy. This is in contrast to the global scope of every ZClass. Skins are just one better-fitting CMF methodology that the content architecture will bring to all of zope. Another is the types-tool, by which methods are dynamically associated with content-types - for refining the uses of existing content types with new functionality, without having to do any application coding. It may turn out that the most profound advancement will be the specification of interfaces to hook things together - that will increase modularity in a way that can make the dream of pervasive reuse real. I may be misjudging from a less-than-thorough understanding of the architecture, or of people's ZClass desires, but i think the component model will provide a platform for doing the kinds of things you want to do with ZClasses, in a more comprehensive and manageable way than ZClasses _can_ allow. > BTW: I missed the chat. Will there be a transscript somewhere on zope.org? Should be - i'm not sure what the situation is... Ken Manheimer klm(a)zope.com ([*] Things i like and dislike about ZClasses: i like their through-the-web development access, the ability to collect various artifacts of an application together within a folderish GUI, the implicit packaging of TTW-manageable property sheets and, generally all the stuff they gather together for you. I *don't* like the separation of the artifacts from the filesystem, however, and the many foibles and bugs that make working with ZClasses too unpredictable. And i think their security provisions muddy the security equation, i just don't quite understand it...)

1 0

FindHomes.py
by Chris Withers 05 Aug '01

05 Aug '01

Hi, Can someoen explain lines 138 to 153 of FindHomes.py to me? Is it documented anywhere? cheers, Chris

2 1

Storing modules in the ZODB
by Joseph Barillari 05 Aug '01

05 Aug '01

Hello, I'm having trouble storing to the ZODB. The code in question reads a string argument and selects a module from the current directory that matches the string argument, importing it into the current class: class Division(Persistence.Persistent): "A collection of rounds." def __init__(self, name, type, flags = []): self.name = name self.typename = type self.rules = __import__(type) self.rounds = [] self.teams = {} self.judges = [] self.flags = flags (rest of class snipped in the interests of brevity) Here's the result of a call using the arguments ('Test', 'APDA') in Python 1.5.2 and Zope 2.4.0 Traceback (innermost last): File "<stdin>", line 1, in ? File "t3s.py", line 909, in add_division get_transaction().commit() File "/usr/lib/python1.5/ZODB/Transaction.py", line 300, in commit j.commit(o,self) File "/usr/lib/python1.5/ZODB/Connection.py", line 375, in commit dump(state) cPickle.UnpickleableError: Cannot pickle <type 'module'> objects (add_division is a function that creates the division and stores it to a global database; essentially, a wrapper.) I tried the native cPickle module in Python 2.1.1 (to ensure that I had a clean version). Same problem -- it chokes on module objects. The purpose of this code is to enable the user to select from several different sets of 'rules' ('APDA' is currently the only one written), which are implemented as Python modules. At run-time, when a 'division' is created, the ruleset is imported into the object instance as self Do you have any suggestions as to how I might implement this? Thanks, Joe

2 3

XML-RPC and Exceptions
by Tobias Oberstein 05 Aug '01

05 Aug '01

lets say i call some method of an zope object via xml-rpc and * give wrong parameters or * throw an exception within the method for example. then the result served by zope will be a html page describing the error, not an XML-RPC fault response like the spec describes it. how can i change this behaviour ? greets, tobias

2 1

ATTN: Zope Security Alert
by Chris McDonough 04 Aug '01

04 Aug '01

A new Zope hotfix has been issued which addresses an important security issue that affects Zope version 2.3.3, all Zope 2.4.0 alpha and beta releases, as well as the final release of Zope 2.4.0. We *highly* recommend that any Zope site running Zope 2.3.3, Zope 2.4.0 final or any alpha or beta version of 2.4.0 have this hotfix product installed to mitigate the issue. Zope 2.4.1 will contain a fix for the issue, at which time the hotfix can be removed. Zope versions prior to 2.3.3 are not affected by this issue. Thanks to Ron Bickers for providing a reproducible test case For more information, see: http://www.zope.org/Products/Zope/Hotfix_2001-08-04/README.txt http://www.zope.org/Products/Zope/Hotfix_2001-08-04/Hotfix_2001_08_04.tgz ---------- Chris McDonough Zope Corporation http://www.zope.org http://www.zope.com """ Killing hundreds of birds with thousands of stones """

1 0