- Zope-Dev - Zope lists

Security Confusion :-S
by Chris Withers 24 Oct '00

24 Oct '00

If anyone can help me with this, it'd give me more faith in the new security model :-S Right, I have a Python Product Class (lots of bits left out ;-): > class MyProduct(OFS.SimpleItem.SimpleItem): > """... > """ > > __ac_permissions__=( > ('Use MyProduct' , ('a_method',),('Manager',)), > ) > > a_methodisDocTemp=1 > > def a_method(self,ignored,md): > list = [] > for name in self.get_contents(): > list.append(DisplayClass(name,self)) > > return list The important bits of DisplayClass look like: > class DisplayClass(Globals.Persistent): > """ """ > > __allow_access_to_unprotected_subobjects__=1 > > meta_type = 'CaseDisplay' > > __ac_permissions__=( > ('View', ('get_name',),('Anonymous',)), > ) ... > def get_name(self): > return self._name Now, I have a DTML method which goes like: > <dtml-with an_instance_of_MyProduct> > <dtml-in a_method> > <B><dtml-var sequence-item html_quote>:</B> > <dtml-var get_name><BR> > </dtml-in> > </dtml-with> Which _always_ throws up an authentication box when a_method returns anything except an empty list. no matter what username or password I use, that box still appears. What I would like is for the get_name and a_method methods to be mapped to permissions so I can manage access to them using the security tab. How should I do that? BTW, in an attempt to get the method accessible in _some_ way I have tried: - setting __allow_access_to_unprotected_subobjects__=1 in both the MyProduct and DisplayClass classes. - setting get_name__roles__=None in the DisplayClass. - giving every conceivable permission to both the Anonymous and Manager roles in the folder containing the MyProduct instance None of which feel like a good way to go, but nevertheless, none of them worked. The only way I coudl solve the problem was to give the DTML Method the 'Manager' proxy role, then everything worked fine. Why is that? What's _is_ going on? Confused and Frustrated (isn't that always the way with Zope security?!) Chris

2 2

ZGDChart product...
by zope 24 Oct '00

24 Oct '00

Hi. This is really a great product. Unfortunately, I'm not able to create a chart with multiple columns using a ZSQL Data Method. Multiple columns with a DTML-Method works fine. Do I miss something. Any ideas? Thanks for any help. Regards, Marc Ludwig (zope(a)isp.lu)

1 0

DataSkinAddons: Fix for CatalogTrigger for ZPatterns-0-4-3b1
by Steve Alexander 24 Oct '00

24 Oct '00

John Eikenberry wrote: > > The new ZPatterns has changed their NamespaceStack from a function to a > class. It seems it no longer needs the REQUEST object to be passed to it > manually. Simply removing the self.REQUEST from the call to NamespaceStack > has kept it from throwing an exception, though I haven't tested it > thoroughly. > > The change is on line 83 of CatalogTrigger.py: > > From... > t = NamespaceStack(self.REQUEST) > To... > t = NamespaceStack() > > You've probably fixed this already if you've switched to the new ZPatterns, > just thought I'd drop you a quick note anyways. Thanks John. I hadn't yet looked to see if DataSkinAddons needs changing much. Your fix looks just fine, and I'll include it in a new release soon. If you find any other problems using DataSkinAddons with the new ZPatterns, please let me know. I think the change in ZPatterns is to get rid of some cruft for supporting both Zope 2.1.x and Zope 2.2.x. Now that ZPatterns only supports Zope 2.2.x, the code becomes clearer. Unfortunately, this breaks other products that use ZPatterns intimately. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

1 1

geting relative url in a dtml tag
by Brett Carter 24 Oct '00

24 Oct '00

I've defined my own dtml tag, i.e. <dtml-foo>. I want to get the relative path of the 'calling' object for that tag, in <dtml-foo>'s __init__ method. I.E. if i have a dtml-method 'index_html': <dtml-foo bar> When I edit the 'index_html' method, <dtml-foo>'s __init__ method gets called, and I want to get something like '/zope/index_html' in the __init__ method. It's easier in the render() method since the REQUEST variable is available. It's not available in the __init__() method. Any ideas? -Brett

1 0

Adding ZCatalog capability for a (Python) product, and using it.
by morten＠esol.no 23 Oct '00

23 Oct '00

Is there any documentation that explains this? Or, maybe some *understandable* and *well-written* product? Thanks. -Morten

2 1

Task, Job or Operation?
by James Johnson 23 Oct '00

23 Oct '00

Is there a Wiki or some other starting point for this thread. As a newbie I like safe vs power over anything else. I also understand that with using anything in a power mode can be risky for a newbie. It's nice to know that I can start out learning in a safe mode and then graduate to a power mode after learning more. Is there a ZopeScript and why not? Safe ZopeScript can be written in using other scripting languages. Zopelet imho is not as marketable as ZopeScript. When you call it operation, method, or function it takes it away from it's context. This is zope specific right? Excuse me while I use safe ZopeScriptPython or power ZopeScriptPerl. Get your Free E-mail at http://tacoma.zzn.com ____________________________________________________________ Get your own Web-Based E-mail Service at http://www.zzn.com

2 1

Task, Job or Operation?
by Spicklemire, Jerry 23 Oct '00

23 Oct '00

Sorry for the duplicate post, forgot the subject. :) Hi Name Hunters, My problem with Zopelet is that it already has a meaning, at least to me. Looking down the road, not nearly as far as one might imagine, let's see where we may be heading. Think about minimal Zope instances running on Palm Gizmos, Cell Phones, whatever, a sort of personal ZEOClient, that enables offline or intermitent access to Zope Applications (e.g. WorldPilot). That's a Zopelet to me, a "little Zope". As for the other suggestions, "Op" sounds right to me. An Operation, or an Operative carrying out some work on behalf of the caller. Python Op, Perl Op, XSLT Op. It's short too! Also, Safe is clear, and easy to grasp, since most folks are aware how critical security can be. As for Flexible vs. UnSafe, how about "Direct", as in, "running directly from the file system"?. The term implies a trade-off of power for some degree of insecurity, at least to the initiated. Newbies should be warned away if they don't get the connotation. This leads to: Direct Python Op, etc. Later, Jerry S.

1 0

(no subject)
by Spicklemire, Jerry 23 Oct '00

23 Oct '00

Hi Name Hunters, My problem with Zopelet is that it already has a meaning, at least to me. Looking down the road, not nearly as far as one might imagine, let's see where we may be heading. Think about minimal Zope instances running on Palm Gizmos, Cell Phones, whatever, a sort of personal ZEOClient, that enables offline or intermitent access to Zope Applications (e.g. WorldPilot). That's a Zopelet to me, a "little Zope". As for the other suggestions, "Op" sounds right to me. An Operation, or an Operative carrying out some work on behalf of the caller. Python Op, Perl Op, XSLT Op. It's short too! Also, Safe is clear, and easy to grasp, since most folks are aware how critical security can be. As for Flexible vs. UnSafe, how about "Direct", as in, "running directly from the file system"?. The term implies a trade-off of power for some degree of insecurity, at least to the initiated. Newbies should be warned away if they don't get the connotation. This leads to: Direct Python Op, etc. Later, Jerry S.

1 0

Re: [Zope-dev] Task, Job or Operation?
by jpenny＠universal-fasteners.com 23 Oct '00

23 Oct '00

On Mon, Oct 23, 2000 at 11:08:14AM +0100, Chris Withers wrote: > jpenny(a)universal-fasteners.com wrote: > > I can see four potential properties that one could want to emphasize > > about a python method. > > > > 1) It is safer (to the Zope server) than a python external method. > > 2) It safer to the end user than a JavaScript (it never touches the client). > > 3) It uses python, and not something else as its implementation technique. > > 4) In OO terms, it is not really a Method. > > Good points :-) > > > Hence the preference for Safe in the name. Even a newbie ought not to > > be able to cut himself too badly on a python method. > > I dunno... > > > descriptive. Widget has technical meaning. Perhaps task or job are > > suitable, as in > > Safe Python Task > > Safe Python Job > > > Then external methods, which are often also not methods, can become > > Flexible Python Task > > Well, felxible doesn't really explain a lot. Filesystem is probably the > most explicit. > > I dunno, I actually like Jeff's suggestion of Operation giving you: > > PythonMethod -> Python Operation > External Method -> Filesystem Python Operation > > The same could also apply to DTML and Perl Methods. A nice side effect > is that you could have Filesystem DTML Operation replace those horribly > named HTML File objects you get when use grab your DTML out of .dtml > files on disk. Especially as they bypass all known security ;-) OK, here is why I used Safe/Flexible. I still think that it is important to give newbies guidance as to which to choose. Because of the restrictions (no import, no _ variables, etc.) that Python Methods provide, it is far safer for a newbie to tackle Python Methods, and discarding them only when they are incapable of doing the needed operation. It is simply true that python methods ARE safer than external methods and ARE to be prefered if they have enough power. Hence the strong preference for Safe in the term. Now, what are things that stand in distinction to safe. One set is unsecure, risky, dangerous. No sane company is going to call a thing Dangerous Python Operation (even if true). So that set of associations is out. Another set of anti-associations is unprotected, open, unguarded. While this set is better, there are still too many connotations of danger. Another way of looking at it is that safe is similar to restricted (restrictions are enforced to maintain safety). Here the opposites are unrestricted, powerful, flexible. I don't like powerful here. It will encourage a newbie to skip the safe version entirely (what newbie doesn't want unlimited power?). Turbo, and supercharged imply extra speed, which I don't believe to be significant. Unrestricted has a double negative problem. Hence something like flexible. I really don't like Filesystem here. It is true. But, it provides the newbie zero guidance. Why should one use a Python Operation rather than a Filesystem Python Operation? The answer is nowhere to be found in the name (unless you count that the name is shorter!). I rather like the Zopelet suggestion. I would like to retain Safe/(some anti-association) in the name. This would give something like: Safe Python Zopelet Flexible Python Zopelet or Power Python Zopelet, or Filesystem Python Zopelet or something else. This is going on too long, but 2 more thoughts. The Safe version should appear in the pulldown before the corresponding Flexible/Power/Filesystem version. These lists are read by Euro-language readers fro top down and we want them to see the Safe version first. Another set of terms for this might be chosen from magick terminology, i.e. spell, incantation, cantrip. Then we could have grimoire/formula/cantrip. Such a nice set of terms! > > cheers, > > Chris

1 0

Reference to a user
by Chris Withers 23 Oct '00

23 Oct '00

Hopefully this will be a little simpler ;-) If I want to store a reference to a User in Zope, what's the best way to do it? I'm currently storing just the user's name, which doesn't seem very robust. Perhaps there's a more conrete reference to the user object? How about a path or something? Is there an interface for this anywhere? I guess something would have been needed for the ownership stuff? Any ideas gratefully recieved :-) cheers, Chris

2 2