- Zope-Dev - Zope lists

acl_users and PARENTS
by Vladimir Petrovic 23 Dec '00

23 Dec '00

What is REQUEST ['PARENTS'] [0] inside acl_users.validate () method during Zope authentication/authorization process ? Help says it is ancestor of the called object, but it seems that in Zope 2.2.4 it is the actual called object. Is it going to stay like this in future versions ? What is the proper way to find accessed object inside validate () method of a user folder ? Vladimir

1 0

Re: [Zope-dev] calling SQL from External Method and using acquisition
by Dieter Maurer 21 Dec '00

21 Dec '00

Andy McKay writes: > This is just an annoying namespace issue: > - I'm calling SQL methods from External Methods by <dtml-var > create_index_ext>. > - I can then call a SQL method by calling self.sql_method() You can pass to a Z SQL method either a single dictionary (positional) argument or a sequence of keyword arguments. Thus, you may use: self.sql_method(self.REQUEST) Dieter

1 0

LoginManager and PTK
by morten＠esol.no 21 Dec '00

21 Dec '00

Hi guys, I previously posted a couple of functions that enables users to login at a lower level in the tree-structre than where the actual user folder is. I.e., a user could enter username and password at /a and get redirected to /a/a/a/a/b (the acl_users folder would be located in /a/a/a/a). Now, there is a minor problem, because I can't seem to figure out how to login the user to the actual context /a/a/a/a, except maybe first redirecting the user to /a/a/a/a and then letting the user log in from there.. Any thoughts / ideas? And if you've got a completely different solution, I'd be glad to hear it. =) Thanks. -Morten

1 0

urllib not available in Python Scripts?
by Itai Tavor 21 Dec '00

21 Dec '00

Hi, sorry for the recent barrage of posts... In Python Methods I could do urllib.quote(...). This doesn't work in Python Scripts. Is quote considered a security risk? Itai -- Itai Tavor "Je sautille, donc je suis." C3Works itai(a)c3works.com - Kermit the Frog "If you haven't got your health, you haven't got anything"

4 8

Re: [Zope-dev] Catalog class--does it support boolean queries?
by Casey Duncan 21 Dec '00

21 Dec '00

Chris Withers wrote: > > Casey Duncan wrote: > > > > In doing some more digging in UnTextIndex.py there I do see support for > > parens and quoted phases, although in practice they do not work. If I > > find time I will delve into this further. > > Cool, if you document it anywhere, please let us know... > > Chris 2.3.0a1 seems to be a bit more friendly toward near, and parens and quoted phrase searches. I will be looking into this further. Perhaps a howto is in order? -- | Casey Duncan | Kaivo, Inc. | cduncan(a)kaivo.com `------------------>

2 1

Re: [Zope-dev] ZPatterns, ZClasses, Specialists: Assigning responsibilities
by Itai Tavor 21 Dec '00

21 Dec '00

Phillip J. Eby wrote: >This should probably be more like: > >product.addMeToOrder(): > item = OrderLineItems.newLineItemFor(self) > item.setQuantity(...) > etc. > order.addLineItem(item) > >customizable_product.addMeToOrder(): > item = OrderLineItems.newLineItemFor(self) > item.setGraphic(...) > item.setQuantity(...) > etc. > order.addLineItem(item) > >This approach makes things more declarative. The product classes can have >properties or interfaces that the OrderLineItems specialist can use to >decide what kind of line item would serve them best. You can then change >your line item assignment rules without necessarily requiring changes to >the product classes. Yeah, it does work much better your way. And, getting OrderLineItems to decide on its own which type of object to add - haven't thought about doing it this way before. Thanks - something new to meditate on. > >I imagine, then, that the UI for uploading the graphic would be >>included in product.addMeToOrderForm, using a UI snippet from the >>OrderLineItemsWithGraphic Specialist. Then I could pass REQUEST on to >>order.addLineItem and to OrderLineItemsWithGraphic.add, which would >>then upload the file? > >I think you're right about this being an OrderLineItem. A couple of fine >points, however... First, I don't think there needs to be an >"OrderLineItemsWithGraphic" specialist, since there is nothing else that >would talk to it. It's fine in this case to have the line item classes >(either with graphic or without) handle their own UI snippets. UI >delegation is for when an object needs to display UI for some *other* >object than itself, since you can always use class extenders and other >techniques to reshape the apparent class of an object retrieved from a >specialist. The interface which other objects deal with is >"OrderLineItem", and they simply expect a portion of the form to be >rendered, and it's okay for the class to handle that. I got a bit confused here... the UI snippet for uploading a graphic actually comes from the Graphics Specialist. If I want to let the user upload the graphic as part of the product's addToOrderForm, Product needs to get this snippet - but Products and Graphics don't know about each other in the object model, so Product would have to ask OrderLineItems (not OrderLineItemsWithGraphic - I clearly don't need that) to get the snippet from Graphics for it, because it would violate Demeter if it talked directly to Graphics... Or I could eliminate the problem by uploading the graphic from a form displayed by the order line item after it has been added. >Second, you need to define that interface so that the Order can give the >line item constraints on how it does that UI, so it can share the screen >and REQUEST with other objects/data that the Order needs. One easy way to >do this is to use a namespace parameter, that simply gives the line item a >name prefix to use on its fields. Alternatively, you can use the "record" >approach, like this: > ><INPUT TYPE="TEXT" NAME="lineitem1.desiredSize:record:int" VALUE="4"> ><INPUT TYPE="FILE" NAME="lineitem1.imageFile:record:file"> >... > >The resulting REQUEST object from submitting the form will contain a single >object, "lineitem1", with "desiredSize" and "imageFile" attributes, so >you'll only have to pass a single parameter back to the line item. I've >never tried doing a record with a file in it before, so I don't really know >how well that works. I've been solving the REQUEST sharing problem using a prefix on form fields... but I like the "record" idea - it makes it much easier to pass the form data around... I'll try it with a file soon. I imagine it would work fine. > >Woof... so long. I'd appreciate any comments on this - especially on >>the question on whether it's better to have a specialized type of >>OrderLineItem, or to link the standard OrderLineItem to a Product >>object in case of a standard product, or, in the case of a > >customizable product, to a new object which stores the graphic and >>tracks the fabrication of the customized item. > >Here's the question... how many behaviors are different in the order line >item itself? Are you also using fulfillment line items? If the only >difference to the order line item is that it references some additional >data, then I'd say a single class would be fine. Most of the behavior >probably comes in on the fulfillment line item, yes? Again, you can ask >your FulfillmentLineItems specialist to create >"newLineItemFor(orderLineItem)" and let it decide what kind of >implementation to hand back. In this case, it probably will be a different >class, while for the order line items, it may or may not buy you anything. I haven't thought of using fulfillment line items... not sure what they are for? An order is considered fulfilled once all items have been shipped, so order line items are responsible for tracking everything that happens until a ShipmentLineItem is created. The order line item for a customizable product tracks the product using state values like 'sent to factory', 'received from factory', etc. So it needs a new set of state values, as well as methods like 'sendManufacturingOrderToFactory'. What exactly does the fulfillment role you're referring to do? Does it do more than a shipment role? Itai -- Itai Tavor "Je sautille, donc je suis." C3Works itai(a)c3works.com - Kermit the Frog "If you haven't got your health, you haven't got anything"

2 1

'Subclassing' another product
by morten＠esol.no 21 Dec '00

21 Dec '00

I think I read somewhere that it was, from version 2.2 of Zope, possible to 'subclass' products. Is this just somebody janking my chain, or is it actually possible? If it is possible, would someone care to explain? Thanks. -Morten

2 2

Keyword Indexes causing Keyerrors
by Itamar Shtull-Trauring 21 Dec '00

21 Dec '00

I'm getting tons and tons of keyerrors when making changes to a catalogaware object's keyword index and then reindex_object() it. Alternatively, the Catalog doesn't get updated at all. Is there any way to prevent this from happening, other than upgrading to 2.3? -- Email: itamar(at)shtull-trauring.org Web: http://itamarst.org

2 4

RE: [Zope-dev] RE: objectIds accessiblilty & and a proposal
by Toby Dickenson 21 Dec '00

21 Dec '00

> -----Original Message----- > From: Dieter Maurer [mailto:dieter@handshake.de] > Toby Dickenson writes: > > > ... protocol specific access rights ... > > Please No. > > > > Zope security is complex enough without having to worry about > > different security settings depending on how a method is accessed. > > (And we should have a lower tolerance for complexity when > it applies > > to security) > > > > If a user has permission to access a method then he should > be able to > > access it any way (xmlrpc, ZPublisher, DTML, PythonMethods) > I agree with you mostly. > > But it might be a significant difference, whether > you access via HTTP or HTTPS or even a protocol that > provides trusted authentication. As a matter of principal, authentication issues do not belong in the permissions machinery, but rather in the User machinery. As a matter of practicality, changing the user machinery is also the smallest change that achieves what you want. What if it was possible to specify per-user the level of security required (Basic is ok for some users, another needs https, etc). You could do this today with a custom user folder, but it might make sense to add it to the standard one. Your very-private-method could then be protected by a permission that is only given to users who are configured to require https. This obviously works for normal users, but it applies to anonymous users too.... The word 'zen' hasnt been used on the list for a while, so ill drop it in here.... Zope has a standard "Anonymous" user who represents users who do not authenticate. This user has no management interface, and he has a fixed set of roles - this makes him very limited. However, you *dont* *need* *to* *use* *it*. Create your own substitute as a new user (I like to call him "Anon") in the root folder with a blank password. This is useful if you create a product with a feature that you want to make available anonymously today, but may want to authenticate in the future. You could tweak the permissions mapping so that the appropriate permissions are given to the "Anonymous" role, however that leads to alot of re-tweaking when you make the change. A better solution is to create a new role, and grant that role to "Anon". This step (granting special roles to the anonymous user) is the thing you cant do with the regular anonymous user. I hope this helps,

1 0

partial search performance problems...
by John Eikenberry 21 Dec '00

21 Dec '00

I just did some tests on the performance of the partial matching features of ZCatalog. They weren't as good as I hoped. A Catalog of 2000 objects, text index on a 10 char string (person's last name), with a partial search that will match only 200 items... it takes 10 seconds. At 1000 matches it takes over a minute. And Zope is inaccessible this entire time. This is after I upgraded to Python-2.0 for the new re module (which helped) and messing with interpreter check interval (which didn't really help). Are there any other tricks to get this to perform better? Aside from switching to a relational database. -- John Eikenberry [jae(a)zhar.net - http://zhar.net] ______________________________________________________________ "A society that will trade a little liberty for a little order will deserve neither and lose both." --B. Franklin

1 0