- Zope-Dev - Zope lists

Local roles and security of ZClass instances in Specialists
by Itai Tavor 25 Jan '01

25 Jan '01

Hi, I'm trying to work out a security strategy for data stored in Specialists, where specific users need access to specific data instances. For example: A Customer object is linked to a Person and Address objects. The customer needs permission to edit the her - and only her - Address object. Using the Owner local role won't work, because customers can be registered by site managers and customer support people, in which case Owner won't be the customer. I can solve this by giving the customer a local role when creating her Address object: Customers.addCustomer(REQUEST): ni = container.addItem(some_id) container.Addresses.addAddressFor(ni.id, REQUEST) Addresses.addAddressFor(for_id, REQUEST): ni = container.addItem(some_id) ni.manage_addLocalRole(for_id, 'EditMyDetails') But this can be a lot of work - If an Address object can also be created for a CreditCard object, addCreditCard will have to both set its own local role, and pass the customer id on to Address... But the main problem is that I'm not sure if it will work at all - can local roles be set for DataSkins that aren't stored in the ZODB? From what I can see ZPatterns doesn't support this, so I'll have to do it myself. __ac_local_roles__ can't be accessed in a SkinScript - so will I have to override has_local_roles, get_local_roles and get_local_roles_for_userid and call them from the SkinScript? This is getting hairy... Without local roles, all I can think of is explicitly checking that the logged in user is the right customer in all the methods that display and edit the object, which is very ugly. Plus it would require Address to know a customer_id even when it actually belongs to a CreditCard, not a Customer... there goes Demeter. Or I can add a findUserID to Address, CreditCard and Customer, all of which pass the request upwards until one is reached that actually knows the customer. Still ugly. TIA for Any comments/suggestions. Itai -- Itai Tavor "Je sautille, donc je suis." C3Works itai(a)c3works.com - Kermit the Frog "If you haven't got your health, you haven't got anything"

3 3

Mapping multiple IP addresses/domains to one Zope
by Aaron Gillette 25 Jan '01

25 Jan '01

My company has many sites which share some content. Each site uses a different IP address. I would like to bring all of these sites into one instance of Zope on an NT machine. I am looking at the possibility of either 1) running Zope behind IIS, or 2) running Zserver exclusively. Personally, I'd rather take the time in advance to learn how to do the whole thing in Zope, as I envision switching to a Linux server in the near future, and I believe that this would ease the migration. My question is this: How do I map different IP addresses/domains to different Zope folders? I am pretty new to Python (but learning fast!), so any snippets of sample code would be much obliged. Thanks in advance, Aaron Gillette

3 3

ANNOUNCE: Zope 2.3.0 beta 3 released
by Brian Lloyd 24 Jan '01

24 Jan '01

Hi all, Zope 2.3.0 beta 3 is now available. You can download it from Zope.org: http://www.zope.org/Products/Zope/2.3.0b3/ This beta contains fixes for various issues reported to date in the beta cycle, and some older Collector bugs. Barring any major unforseen problems, this will be the last 2.3 beta release. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.3.0b3/CHANGES.txt - http://www.zope.org/Products/Zope/2.3.0b3/HISTORY.txt Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

2 1

"Find" broken in 2.2.2?
by tsarna＠endicor.com 24 Jan '01

24 Jan '01

Is there something wrong with the Find mechanism in 2.2.2? "containing" searches never find anything. I've looked at the changelogs for post-2.2.2 versions and didn't see anything about this being fixed, so either it was fixed but not documented, it's still broken, or it's something peculiar to my setup. This is a real problem for managing complex applications... Oh, for the good old days of grep.

1 1

Re: [Zope-dev] Old to new registerClass
by Andy McKay 24 Jan '01

24 Jan '01

I nuked it and everything is just fine, its defined in misc. Anyway works fine, will post a "package" shortly after some testing. -- Andy McKay. ----- Original Message ----- From: "Johan Carlsson" <johanc(a)torped.se> To: "Andy McKay" <andym(a)ActiveState.com> Sent: Wednesday, January 24, 2001 9:39 AM Subject: Re: [Zope-dev] Old to new registerClass > > Lang is used in this line: > > > > document.write("<SCR"+"IPT src=\"misc_/IEMethod/lang_"+lang+"\" > > type=\"text/javascript\"></SCR"+"IPT>"); > > I think that: > The "lang" Javascript variable is either set to "sv" or "en" so the script include > file should look for either "lang_sv" or "lang_en". > The dictionary lang_ defined in __init__ isn't, as far as I can see, used anywhere. > > So you don't need to worry about it much. > > > Kind of a bizarre line, but it looks like its setting the script source. > > Thanks, just doing a quick ZWiki-IEMethod merge so that you can edit a ZWiki > > standard style or using IEMethod. > > Great, one less thing for me to do :-) > > Johan >

1 0

Old to new registerClass
by Andy McKay 24 Jan '01

24 Jan '01

Im hacking around IEMethod and it uses an old style of class initialisation in the __init__.py along the lines of: misc_ = { 'imagef':'foo','imageg':'goo', } lang_= { 'en':'lang_en','sv':'lang_sv', } I want to put this into a modern style product initialisation (context.registerClass). Looking at this functions API it didn't become readily apparent how I can pass in these values. This would be nice to do so I don't have any hacking of dtml to do. Has anyone done this / got any advice? Thanks. -- Andy McKay.

3 3

"Problem" using External Method
by Espen Sorbye Frederiksen 24 Jan '01

24 Jan '01

The module below works using the python compiler class Testclass: def setdata(self,val1,val2,val3): self.data = [val1,val2,val3] def updatedata(self, index): self.data[index] = self.data[index]+1 def display(self): print self.data x = Testclass() def createdata(): import __main__ __main__.x.setdata(10, 20, 30) __main__.x.updateLog(2) __main__.x.display() >>>createdata() >>>[10,20,31] However if I try to add it as an External Method( id= createdata) it doesn't seem to work. I've tried to call it using <dtml-var/call createdata> without success. Any suggestions what I do wrong. I am grateful for all comments, Espen

4 6

DTML Block Parsing - Patch #2
by Casey Duncan 24 Jan '01

24 Jan '01

I am sufficiently happy with my second patch to post it here for any takers. It should be applied to 2.3.0b2 or 2.3.0b1. It *has not* been tested against 2.2.5. The new patch supports nested comments so long as they are properly balanced inside the comment. As with my first patch it also allows you to create a custom DTML block tag that contains something other than valid DTML code. It now should support block continuation tages as well, although this had not been tested completely. Patch files are attached. Enjoy. -- | Casey Duncan | Kaivo, Inc. | cduncan(a)kaivo.com `------------------> *** DT_String.py~ Tue Dec 12 14:20:25 2000 --- DT_String.py Wed Jan 24 08:22:11 2001 *************** *** 272,313 **** sname=stag sstart=start sa=sargs ! while 1: l=tagre.search(text,start) if l < 0: self.parse_error('No closing tag', stag, text, sloc) try: tag, args, command, coname= self._parseTag(tagre,scommand,sa) ! except ParseError, m: self.parse_error(m[0],m[1], text, l) ! ! if command: ! start=l+len(tag) ! if hasattr(command, 'blockContinuations'): ! # New open tag. Need to find closing tag. ! start=self.parse_close(text, start, tagre, tag, l, ! command, args) else: ! # Either a continuation tag or an end tag ! section=self.SubTemplate(sname) ! section._v_blocks=section.blocks=self.parse(text[:l],sstart) ! section._v_cooked=None ! blocks.append((tname,sargs,section)) ! start=self.skip_eol(text,l+len(tag)) ! if coname: ! tname=coname ! sname=tag ! sargs=args ! sstart=start ! else: ! try: ! r=scommand(blocks) ! if hasattr(r,'simple_form'): r=r.simple_form ! result.append(r) ! except ParseError, m: self.parse_error(m[0],stag,text,l) ! return start parse_close__roles__=() def parse_close(self, text, start, tagre, stag, sloc, scommand, sa): --- 272,324 ---- sname=stag sstart=start sa=sargs ! # Determine if the tag wants dtml parsing ! parse_dtml = not hasattr(scommand, 'disable_dtml_block_parsing') + while 1: l=tagre.search(text,start) if l < 0: self.parse_error('No closing tag', stag, text, sloc) try: tag, args, command, coname= self._parseTag(tagre,scommand,sa) ! except ParseError, m: ! if parse_dtml: self.parse_error(m[0],m[1], text, l) ! else: start = l + 1 # Not parsing DTML: Skip malformed tags else: ! if command: ! start=l+len(tag) ! if hasattr(command, 'blockContinuations'): ! # New open tag. Need to find closing tag. ! try: start=self.parse_close(text, start, tagre, tag, l, ! command, args) ! except: ! if parse_dtml: raise ! else: ! # Either a continuation tag or an end tag ! if parse_dtml: ! section=self.SubTemplate(sname) ! section._v_blocks=section.blocks=self.parse(text[:l],sstart) ! else: ! section = String(text[sstart:l], __name__=sname) ! section._v_blocks = section.blocks = [section.raw] ! ! section._v_cooked=None ! blocks.append((tname,sargs,section)) ! start=self.skip_eol(text,l+len(tag)) ! if coname: ! tname=coname ! sname=tag ! sargs=args ! sstart=start ! else: ! try: ! r=scommand(blocks) ! if hasattr(r,'simple_form'): r=r.simple_form ! result.append(r) ! except ParseError, m: self.parse_error(m[0],stag,text,l) ! return start parse_close__roles__=() def parse_close(self, text, start, tagre, stag, sloc, scommand, sa): *** DT_Var.old Mon Jan 22 15:27:30 2001 --- DT_Var.py Mon Jan 22 15:28:14 2001 *************** *** 461,466 **** --- 461,467 ---- ''' name='comment' blockContinuations=() + disable_dtml_block_parsing = 1 def __init__(self, args, fmt=''): pass

1 0

ZSQL method - Can it 'resolve' a property value?
by Schmidt, Allen J. 24 Jan '01

24 Jan '01

I have an index_html which runs queries that count the number of items in a category and displays the number next to each category which is a link to the SearchResults page that will pass the name of the property to the next query. This is how I do the count part: (<dtml-in countAnnouncements><dtml-var announcements null=""></dtml-in>) I have a sql method for each count query and each uses a property (like announcements above) that contains a list of numbers (i.e. Announcements has: '001','002','003','004' ) So the query does a WHERE category IN ('001','002','003','004') statement by resolving the property and getting the list of numbers. This part works well. Now,... When I try to do the same thing on the SearchResults page, using a new sql method, I cannot get the property to resolve. I try using an attribute of the category for testing so it prompts for the category name when I test it. I use the MULTIPLE attribute with a DTML-SQLTEST to produce the "WHERE IN" type of query. I type in the name of the property that contains the list of numbers and all I get for the query is: .... WHERE category = ('nameOfProperty').... This makes less sense as I am describing it, but it may be clear to someone. Thanks Allen

1 0

Re: DTML block parsing - better then C/C++
by Jon Franz 24 Jan '01

24 Jan '01

This allowance for nested comments, as long as they are properly nested, is more then many laguages, such as C/C++, give you in the way of allowing nested comments - So I think its more then acceptable in its current form - good job! >OK, I have developed a new patch that almost completely fixes this >issue. In fact I am happier with it in general than my first patch. >There is only one flaw, although you can nest comments inside of one >another, and you can have any manner of broken dtml inside, if you open >another comment tag inside it, it must be properly balanced or you will >get a parse error. Here are some examples:

1 0