- Zope-Dev - Zope lists

Adding a new UserSource
by Harry Henry Gebel 15 Oct '00

15 Oct '00

I am trying to add a new UserSource for LoginManager. I placed a directory SampleUserSource in /usr/lib/zope/lib/python/Products , in this directory I placed two files __init__.py and SampleUserSource.py . Here are the contents of the files: __init__.py: from SampleUserSource import SampleUserSource def initialize(context): ''' Register SampleUserSource class as a ZPatterns Plug-in''' context.registerPlugInClass( SampleUserSource, permission = 'Add Sample User Source', constructors = defaultConstructors(SampleUserSource, globals())) context.registerBaseClass(SampleUserSource) SampleUserSource.py: from Products.LoginManager.UserSources import BasicUserSource class SampleUserSource(BasicUserSource): """ Sample UserSource plugin """ meta_type = "Sample User Source" def retrieveItem(self, name): raise NotImplementedError def rolesForUser(self, user): raise NotImplementedError def domainsForUser(self, user): raise NotImplementedError def authenticateUser(self, user, password, request): raise NotImplementedError I restart Zope, but the new user source does not show up in the products list, nor does it show up in the list of available user sources. Obviously, I am missing something here either about making Python Products or plug-ins. If anyone could point out to me what I am doing wrong I would appreciate it. There are .pyc files in the SampleUserSource directory so I know Zope at least is aware of the files existence. -- Harry Henry Gebel, ICQ# 76308382 West Dover Hundred, Delaware

2 1

Getting all objectIds, recursively (ZODB)
by morten＠esol.no 15 Oct '00

15 Oct '00

Is there a method available that'll return a nested list of ids (or something similar) of the current object? -Morten

2 2

RE: [Zope-dev] (no subject)
by Gregor Heine 15 Oct '00

15 Oct '00

> I recently asked how to read in and render the contents of > an external file, which doesn't work anymore using > Zope 2.2.2 an LocalFS' xxx.read(), and You responded that > > > The quickest solution for you would be an external method > > that gets the file, performs the "read" and returns the result. > > Now I use in an external method fsreadin a .py-module with > > import sys > def readinfile (self, html): > """Ralf Herolds way to read in local file objects.""" > file = open(html, "r") > filecontent = file.read() > file.close() > return filecontent > > which is referenced in a DTML method by > <dtml-var "fsreadin('/tmp/var/thewantedtext.html')">. > > It works, but I almost cannot believe that this is that > simple - am I missing something, is security a concern? > It *is* that simple. The only problem is security. That way, you can read *any* file that has read permission for the user, the zope process is running on, e.g. everybody could use something like http://your.host/fsreadin?html='/etc/passwd' to view your password file. If you want to read files only from one directory, you could use: import sys, os, string def readinfile (self, file): """Ralf Herolds way to read in local file objects.""" file=file[max(string.rfind(id,'/'),string.rfind(id,'\\'),string.rfind(id,':' ))+1:] path=os.path.join('/tmp','var',file) file = open(path, "r") filecontent = file.read() file.close() return filecontent This would ensure, that only files from /tmp/var can be read. Cheers, Gregor!

1 0

Inconsistent behaviour in Zope's constructor security check?
by Stephen Simmons 15 Oct '00

15 Oct '00

I have just concluded an epic two day struggle with Zope's security machinery. I think I've won, and wanted to find out whether anyone else has had similar problems. I had defined a Python product that worked very nicely. I was able to add and delete my objects and edit, copy and export them perfectly well. But when I tried to rename, paste or import them, I got an exception saying that "The object X does not support this operation". It appears that security checks for permission to add an object to a Folder is done differently by the Product Add machinery and the CopySupport machinery that paste/rename/import use. I had defined my constructors slightly unconventionally in __init__.py. Redefining the constructors more normally solved my immediate problem, but it doesn't remove the source of Zope's inconsistent behaviour. More details of the diagnosis are at the end of this email, for those who are interested. Is this something I should put in the collector? One happy result of this mess is that I am now on a first-name basis with about 80% of the Zope source code! Stephen ___________________________________________ Stephen Simmons, stephen.simmons(a)healtharena.net HealthArena B.V., Amsterdam, The Netherlands phone +31 20 486 0555; mobile +31 6 1505 3086; fax +31 20 486 0559 Problem copying/pasting and renaming ------------------------------------ I was able to create new instances of my Element class, but whenever I tried to rename, cut/paste or import the objects, _verifyObjectPaste() in CopySupport.py raised a Copy Error (The object X does not support this operation). _verifyObjectPaste() performs three checks: (i) The container is happy having an object of this type being pasted into it (ii) The user is allowed to create new objects of this type (iii) The user is able to access the object being pasted or renamed All three conditions were true, so there is no reason why renaming, etc should be prevented. Especially when I could create objects as desired through the management screens. Solution -------- The problem was traced to the unusual way I had defined the constructors in __init__.py and the class's module. It appears that getSecurityManager().validateValue(meth) does not exactly duplicate the check done when adding a product instance. Originally, I removed the constructor definition tuple from __init__.py: def initialize(context): """Register Element""" context.registerClass( PlatformElement.Element, constructors = (PlatformElement.Element), # Specified indirectly! icon = element.gif ) and put it at the end of my class definition module, PlatformElement.py: class Element(Folder): ... def manage_addElement(self, id, name='', title='', REQUEST=None): """Create an Element""" ... Element_constructors = ( ('manage_addElementForm', HTMLFile('Element_add', globals())), ('manage_addElement', manage_addElement), ) In this case, check (ii) was failing at line 390 of CopySupport.py when trying to validate the constructor manage_addProduct/HAPlatform/manage_addElementForm. The problem was fixed by changing the constructor definition to the more conventional form: In __init__.py: def initialize(context): """Register Element""" context.registerClass( PlatformElement.Element, constructors = ( # Specify constructors explicitly! PlatformElement.manage_addElementForm, PlatformElement.manage_addElement, ), icon = element.gif ) In PlatformElement.py: ... manage_addElementForm = HTMLFile('Element_add', globals()) def manage_addElement(self, id, name='', title='', REQUEST=None): """Create an Element""" ... While this fixes the problem, it leaves unresolved the question of why Zope's security machinery was happy using the original constructors but barfed when checking whether it could use them.

1 0

New ZPatterns documentation on the Wiki
by Phillip J. Eby 14 Oct '00

14 Oct '00

There is a new document on the Wiki which explains in excruciating detail how triggers/rules work in ZPatterns: http://www.zope.org/Members/pje/Wikis/ZPatterns/HowTriggersWork I have also now completed the SkinScript reference documentation at: http://www.zope.org/Members/pje/Wikis/ZPatterns/SkinScriptSyntax In addition to a detailed definition of all SkinScript statements, variables, and syntax, the reference includes 19 short "real world" SkinScript examples ranging from very simple to very complex. Examples include data movement to/from SQL and ZCatalog, as well as other Specialists, and various kinds of "alert"-type triggers. Please note that the SkinScript syntax described is "slightly ahead of its time" in documenting a few features that are only available in an as-yet unreleased ZPatterns. I'm holding up the release of 0.4.3 for additional documentation and I'm also waiting on Ty to get a LoginManager 0.8.8 release together, as there were some changes that had to be made to LM for compatibility with ZPatterns 0.4.3, relating to my recent addition of ZClass support for PlugIns (yay!). Feedback on the above documentation is welcome. Thanks. _____ _/__) ___/

1 0

RE: [Zope-dev] (no subject)
by ralf.herold＠charite.de 14 Oct '00

14 Oct '00

Hello Dieter, dear list readers, I recently asked how to read in and render the contents of an external file, which doesn't work anymore using Zope 2.2.2 an LocalFS' xxx.read(), and You responded that > The quickest solution for you would be an external method > that gets the file, performs the "read" and returns the result. Now I use in an external method fsreadin a .py-module with import sys def readinfile (self, html): """Ralf Herolds way to read in local file objects.""" file = open(html, "r") filecontent = file.read() file.close() return filecontent which is referenced in a DTML method by <dtml-var "fsreadin('/tmp/var/thewantedtext.html')">. It works, but I almost cannot believe that this is that simple - am I missing something, is security a concern? Thanks for answering, Yours. Ralf Herold mailto:ralf.herold@charite.de http://www.knm-poh.charite.de/ > -----Original Message----- > From: Dieter Maurer [mailto:dieter@handshake.de] > Sent: Wednesday, October 04, 2000 1:46 PM > To: ralf.herold(a)charite.de > Cc: Zope-Dev(a)zope.org > Subject: Re: [Zope-dev] (no subject) > In earlier Zope versions, a method without a permission meant > "can be used freely". Now, it means "cannot be used via DTML/URL". >

1 0

Recursive Folders programatically
by Jason Spisak 13 Oct '00

13 Oct '00

Zopists, I forgot about the 'let' tag. It ain't pretty but it works. Here's the code in DTML for recursive folder generation: <dtml-in expr="_.range(0, 2)"> <dtml-let a=sequence-item> <dtml-call "manage_addFolder(_.str(a), _.str(a))"> <dtml-in expr="_.range(0, 2)"> <dtml-call "_.getitem(_.str(a), 1).manage_addFolder(_.str(_['sequence-item']), _.str(_['sequence-item']))"> </dtml-in> </dtml-let> </dtml-in> ugly. Sorry to mail when the answer was in the vaccum of my memory. All my best, Jason Spisak 444(a)hiretechs.com

1 0

Programatically trying to create recursive folders
by Jason Spisak 13 Oct '00

13 Oct '00

Zopists, In orderto get around the confliting writes issues I am experiencing, I would like to create recrusive folders like, /0/1, /0/2, etc., so that my objects will be in many different folders. I am trying to get DTML to create these pre-set drop folders automatically, but am unable to do so. The following code throws an id already in use error, because the 'with' tag is not letting the newly created object's namespace be used for the creation of the second folder. <dtml-in expr="_.range(0, 2)"> <dtml-with "manage_addFolder(_.str(_['sequence-item']), _.str(_['sequence-item']))"> <dtml-in expr="_.range(0, 2)"> <dtml-call "manage_addFolder(_.str(_['sequence-item']), _.str(_['sequence-item']))"> </dtml-in> </dtml-with> </dtml-in> Any ideas? All my best, Jason Spisak 444(a)hiretechs.com

1 0

Re: FW: [Support] [ZOPE Collector] Zope Bug entry: Ghost ZClasses
by Shane Hathaway 13 Oct '00

13 Oct '00

Brian Lloyd wrote: > > A new bug entry was added with the following information: > > > > Title: Ghost ZClasses > > > > At: http://classic.zope.org:8080/Collector/1676/sview > > > > Submitter: lalo > > > > Email: lalo(a)hackandroll.org > > > > Description: Some ZClasses in a ZODB migrated from 2.1.6 did not > > handle the migration well. Their instances were reported as > > broken, till I removed the Product, when the instances started > > working (but with no icon, factory or constructor). I would have to guess that the cause may be a product that was supplying a base class wasn't installed. > > I tried flushing the cache, packing the database and restarting > > Zope, to no avail. Then I found there was a global registry for > > ZClasses; looks like somehow, when the classes were deleted, they > > didn't _unregister(). > > > > I finally tired of not being able to create banners and manually > > removed the classes (via Python) from root()['ZGlobals']. Not > > that this is a fix, but it's something other people with the same > > problem can do if they're brave (insane?) enough. This is actually expected behavior: if the ZClass itself is broken, Zope can't even figure out what class ID it was supplying. ZClasses break when the base classes disappear. At that point, there's no way to unregister from ZGlobals. This is a Hard Problem. At the moment the only way I see fixing it is a big change to ZClasses. Shane

1 0

WriteLocking Proposal Revisited. Again.
by Jeffrey P Shell 13 Oct '00

13 Oct '00

WriteLocking <http://dev.zope.org/Wikis/DevSite/Proposals/WriteLocking> Revisited and rewritten again after some internal discussions and a decision to ensure that the proposed Write Locking for WebDAV behaves in a matter that the clients (particularly the more popular ones) expect. There's less architectural discussion in this revision of the proposal, intentionally. --jeffrey

1 0