- Zope-Dev - Zope lists

Re: [Zope-dev] Security/Acquisition Bug? (take two)
by Charlie Wilkinson 13 Nov '00

13 Nov '00

On Sun, Nov 12, 2000 at 11:42:32PM +0100, Dieter Maurer waxed eloquent: > > I tried it on my ZopeCVS installation. > The Python parts are quite new. The C-part is about 2 weeks old. > > I can not observe what you describe. > "/index_html" can be viewed as "Annonymous" without any > change in permissions. Hi Dieter, Thanks for investigating. I also gave it another try, with the same results as my previous attempts. Maybe I'm doing something dumb? I have followed exactly these steps (as a regular user): 1. mkdir Zope2 2. cvs -z7 -d :pserver:anonymous@cvs.zope.org:/cvs-repository checkout Zope2 3. cd Zope2 4. python wo_pcgi.py 5. python zpasswd.py -u XXXXXX -p XXXXXX access 6. Edit start file (for port change and stupid log): #! /bin/sh reldir=`dirname $0` PYTHONHOME=`cd $reldir; pwd` export PYTHONHOME exec /usr/bin/python \ $PYTHONHOME/z2.py -P 9000 \ -D "$@" STUPID_LOG_FILE=$PYTHONHOME/zope.log 7. ./start & 8. Visit http://www.boinklabs.com:9080/index_html 8. Get BASICAUTH login box... ?? Box is Redhat 6.0 with updates, Python 1.5.2 from source. CVS is v1.10.5. The only bit I left out was setting up the CVS login on a prior occasion: cvs -d :pserver:anonymous@cvs.zope.org:/cvs-repository login -cw- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Charlie Wilkinson - cwilkins(a)boinklabs.com - N3HAZ Parental Unit, UNIX Admin, Homebrewer, Cat Lover, Spam Fighter, HAM, SWLer... Visit the Radio For Peace International Website: http://www.rfpi.org/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CLOBBER INTERNET SPAM: See!! <http://spam.abuse.net/> Join!! <http://www.cauce.org/> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QOTD: Al Gore: Please, just concede. I can't handle another four years of whiney Republican bumper stickers!

1 0

Exceptions
by seb bacon 12 Nov '00

12 Nov '00

I was just building in some error handling into some UI code, and wanted to catch errors relating to duplicate ids. The problem is that just about every client-side error raises the same kind of Exception, a 'Bad Request'. A quick grep counted 41 different types of 'Bad Request' in my Zope source. Wouldn't it be *much* nicer to have a hierarchy of exception types, so that applications can deal with them at an arbitrarily granular level? e.g. ZopeException | `RequestException | | | `XMLException | `IdException | | | `ReservedWordException | `DuplicateException Has this discussion taken place before? Would it be useful? Would its effort:benfits ratio be too great to justify doing? seb

5 4

PythonMethods: Can't Slice context.REQUEST.PARENTS
by The Doctor What 11 Nov '00

11 Nov '00

I cannot slice context.REQUEST.PARENTS The reason I want to do this is to travel up the URL tree for a breadcrumb navigation do-hicky. I want to slice it so I can make a copy because if I just do ...reverse() on it, I screw up everything afterwards. It says I'm unauthorized (Guarded.py __careful_getattr__) so I assume this is a feature. I suppose I can just .reverse() it back again at the end, but it seems.....wrong some how. Attached is my code at the moment...it sucks, I know. This is python project numero uno and zope project duo... If anyone has a better example of how to hand text (I'm using buff and returning it) back, I'd appreciate it. I'm much to tired, so off I go to bed... Ciao! -- Man is the best computer we can put aboard a spacecraft ... and the only one that can be mass produced with unskilled labor. -- Wernher von Braun The Doctor What: <fill in the blank> http://docwhat.gerf.org/ docwhat(a)gerf.org KF6VNC

1 1

RE: RFC : ZPatterns Customer Relationship Management Framework
by Roch'e Compaan 11 Nov '00

11 Nov '00

Thanks for your comments on our model Philip, it is really appreciated and very enlightening. >From your comments some other questions came to mind (I posted this on the Wiki as well): It seems that we did not give enough consideration for the pattern, Roles Before Objects but we can retrofit this pattern to our existing design without to much trouble. The area where I need more guidance is on the ability of a specialist to add attributes on top of objects. Thinking out load: Objects might have different attributes depending on the roles they play in various application frameworks. Specialists make it possible to add these attributes through AttributeProviders. One might create a Person ZClass with properties Name, Surname, Age. When the Person plays the role of Customer we will create a Customers specialist for that role providing us with services relevant to dealing with Customers. Let's say for now that the properties defined on our ZClass propertysheet for Person suffices for the Customer role. Our Person object also plays the role of Requester in our Requesters specialist. For this role we need an extra attribute, Priority. The Requesters specialist will ask the Customers specialist for properties Name, Surname and Age but will store the attribute Priority in it's own rack. For storage in the ZODB this will imply that the extra attributes will be stored persisently in the slots of the Requester. For non-ZODB storage like a SQL RDB one will have to add a table to the RDB. Roché

1 0

Security/Acquisition Bug? (take two)
by Charlie Wilkinson 10 Nov '00

10 Nov '00

I had posted about this previously, but no one has tackled this one, it seems to be a pretty serious issue, plus I've done a *lot* of poking around and learned a few things since I first reported it. What I have *not* found (or been told) is that the below described behavior is normal. First a simple exercise for those who would like to avoid my laborious novice Zoper description and just ferret out the likely bug: Create a fresh CVS copy of Zope on your *nix box. Build it (python wo_pcgi.py), configure 'start' with the ports of your choosing, set a superuser password, start Zope and try to visit the /index_html page. What I'm getting at that point is a BASICAUTH login box. One has to explicitly enable anonymous permissions on the index_html page in order to view it without logging in. I've read through all the security model discussion I could find, but saw no discussion of this issue. If somehow this behavior is intentional, I would greatly appreciate a clue to that effect. (Some response either way would be nice, actually...) Based on my recent flailings with LoginManager and finally, stock acl_users in Zope v2.2.cvs, it seems there this problem relates to the "scope" of acl_users and/or its parent folder not including the objects within. The security settings of the parent folder are apparently not regarded in determining access to objects within. Instead, acl_users is only impacting its sibling objects (and presumably their child objects). Apologies if I'm making the wrong noises in the wrong place in the wrong way. Any help or pointers welcome. -cw- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Charlie Wilkinson - cwilkins(a)boinklabs.com - N3HAZ Parental Unit, UNIX Admin, Homebrewer, Cat Lover, Spam Fighter, HAM, SWLer... Visit the Radio For Peace International Website: http://www.rfpi.org/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CLOBBER INTERNET SPAM: See!! <http://spam.abuse.net/> Join!! <http://www.cauce.org/> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QOTD: "Bush is a big corporation disguised as a human being running for president." -- Ralph Nader on David Letterman (9/28/00)

1 0

ZODB, Threads and Persistence
by Magnus Heino (Rivermen) 10 Nov '00

10 Nov '00

Hi. Reading from Jims 'Introduction to the Zope Database': "An object's state may be freed at any time by the ZODB to conserve memory usage." What does this mean? That the object can be freed even though there are references to it? The reason I'm asking is becase I want to use threads and persistence together. I would like to inherit both threading.Thread and Persistence.Persistent, but that gives an error. I guess thats because of the ExtentionClass. However, if i only inherit Persistence.Persistent and starts a thread using the thread module withing the persistent class, what will happen with it? Can the ZODB still decide to free my persistent object even thoght it has a reference to a thread that is running?? Or can I start my thread when the object first is used, and rely on that it will be running until I stop it or remove any reference to it? /Magnus

3 3

DTML processing variable
by David W. Damon 10 Nov '00

10 Nov '00

Hey all, I'm having difficulty getting dtml-in to iterate over a list of strings returned from an external python method. Essentially, I have a string that is comprised of the contents of an HTML text area. I need to split the string into a list of words and iterate over this list. My external python method is this: def stringSplit( self, theString ): return string.split( theString ) Heres the pertinent DTML..... ------------------- <dtml-call expr="REQUEST.set( 'userList', stringSplit(acctUsersEmail))"> <dtml-in userList> <dtml-var sequence_item> </dtml-in> <dtml-var REQUEST> ------------------- If I comment out the dtml-in block, i have a userList variable in the REQUEST object that is something like: ['name1', 'name2', 'name3'] Any ideas? -- dave

2 1

Re: question re problem adding zwiki webs
by Simon Michael 10 Nov '00

10 Nov '00

Re this error when adding a zwiki web: Error Type: KeyError Error Value: H?v`H?v$y_?-----------------------------006412673360557 Content-Disposition: form-data; name="wiki_type" basic Tony McDonald <tony.mcdonald(a)ncl.ac.uk> writes: > It is a Mac actually. IE 5.0. I've just asked a colleague to try > creating a ZWikiWeb on his PC and it's worked fine! > > I do have other problems with IE 5.0 in that it has a limit on the > number of things I can 'copy' and 'paste' - in general I don't bother > doing it and export and reimport folders etc. I'd really like to know > why it's behaving like that, I do have a *lot* of cookies in my IE and > have also heard that the sequence in which HTTP headers are sent to IE > can be an issue to (sigh) Thanks, that helps a lot! To narrow it down, if not to solve it :( It does appear that the problem is not with zwiki, but that HTTP form data headers are being sent in some unusual format and confusing zope. I wonder if you experience mac-IE-specific problems with other zope forms or forms in general. I suppose it could be related to your cut/paste problems. I'm cc'ing the list, perhaps someone knows more. Cheers, -Simon

1 0

RFClarification: Security on Product Attributes
by Chris Withers 10 Nov '00

10 Nov '00

Hi, If I have the following lines in a Python Product: def __init__(self, id): """initialise a new instance of product""" self.id = id self.title = 'Title!' self.anInt = 0 self.aString = 'testing' Are these attributes protected by the security machinery? If so, how so? Can I read them? I think the answer is yes for anInt and no for aString. Don't know the mechanics of title and id, I'm guessing they're going to be special cases whatever... Are they protectable by permissions? I do hope so although my experience is that, at best, it's not necessary, which is contrary towhat I thought the new security policy was. Should they have to be protected by permissions? Probably... Looking for comments-ly, Chris

5 8

[Fwd: [Zope] DataSkin Supplier?]
by Chris Withers 10 Nov '00

10 Nov '00

Erk... meant this for zope-dev :-S Chris Withers wrote: > > Hello... > > Okay, I'm still staring up at the ZPatterns learning cliff as I write > this so forgive my ignorance. > > I'm looking at ZPatterns WRT to 'dynamically generated dataskins'. > > You what? Well, okay, I'll try and explain... > > Firstly, I'm assuming that DataSkins (or their subclasses?) are > first-class zope objects, can be 'added', copied, pasted, have security > tabs, can be catalogued, URL traversed, etc, etc. Is that assumption > correct? > > I hope so :-S > > If it is, is there something which can generate DataSkins on the fly? > ie: in the same way an AttributeProvider supplier attributes to an > object, is there something like a 'DataSkin provider' which provides > whole dataskins to a folderish object? > > Finally, and this is the important bit. Can one of these folderish > objects also _be_ a DataSkin? So, to word it differently, there is a > root 'DataSkin provider'. This provides DataSkins which are folderish > and are also 'DataSkin providers' themselves. > > Why do I want this? Well, think objects in a tree where the > parents/children are stored as a list of names refering to other > objects. In addition, objects may have multiple parents, etc... > > Any ideas? Where should I start reading? > > cheers, > > Chris > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

1 0