- Zope-Dev - Zope lists

2.2.1 changes tighten security?
by Bill Anderson 31 Aug '00

31 Aug '00

Working on a new release of Membership, I have encountered a problem. Doing the development in 2.2.1, I cant seem to access my roles managemenu UI as Manager. For those who haven't seen it, her eit is: <dtml-in ShowUsers> <dtml-call "REQUEST.set('user',_['sequence-item'][0])"> <form action="/acl_users/manageRolesForUser" method=POST> <br> <dtml-var user> <dtml-var "user.roles"> <input type=hidden name=user value="<dtml-var user>"> <input type=submit name=submit value="Manage Roles"> </form> </dtml-in> Where ShowUsers is a python mehtod that returns a list of user objects. The traceback indictaes the problem lies in accessing "user.roles". roles is on the Restricted Property sheet, which requires you have the 'Manage users" role. Of course, as manager, I expect I have it. :) This worked fine in 2.2.0, and was wondering if anyone knew what changes would bring this behaviour out, and how to fix it off hand. TIA, Bill -- Do not meddle in the affairs of sysadmins, for they are easy to annoy, and have the root password.

1 0

RFC: page contracts
by Petru Paler 31 Aug '00

31 Aug '00

Hi eveyone. While playing around with the development version of ACS (ArsDigita Community System), I noticed a very nice feature they introduced, namely page contracts. In ACS, this means that every tcl page starts with a call to ad_page_contract. In the parameters passed, you specify: - general page documentation (what it does) - author(s) - creation date (not needed for Zope since we have bobobase_modification_time) - CVS ID (not quite applicable for Zope (yet?)) - the expected input variables (from forms) along with their default values (where applicable) and types (having a couple of types like "integer" and "string" predefined and an easy-to-use plugin system to add custom types) - an optional validation block in which you can check the input data ranges and validity (you can also make validation rules depend on each other so if one fails, the rules which depend on it aren't tried) - an optional custom error messages section (to use when one of the required input variables is not there or does not match the format, or when a validation block fails). If you don't provide this some reasonable defaults are provided. IMHO, such a feature would be very useful for Zope too. I find myself quite often doing input validation and error handling in DTML, which is (to say the least) painful. I would be interested to give a try at implementing this, but before starting I wanted to hear community's opinion on: - whether this would be useful - how this should be aproached (the two possibilities I have in mind until now are either a separate manage tab for the page contract, and there a HTML-based interface for building it, either a <dtml-contract> tag which surrounds the page contract (written in python probably) and placed at the top of DTML documents/methods). -- Petru Paler, mailto:ppetru@ppetru.net http://www.ppetru.net - ICQ: 41817235

4 3

PythonMethod-related mini-proposal
by Evan Simpson 30 Aug '00

30 Aug '00

I have a mini-proposal at http://dev.zope.org/Wikis/DevSite/Projects/PythonMethods/NamespaceObjectInte rface which I hope will take care of the last major barrier to the new version of PythonMethods. Jim asked me to put it in the fishbowl and get some feedback on it, so please comment if you have an interest. Cheers, Evan @ digicool & 4-am

1 0

ZPatterns bug: Compute instance has not _objectAdding method
by Steve Alexander 30 Aug '00

30 Aug '00

Zope 2.2.1, ZPatterns 0-4-1snap1, with some small patches. I'm adding a dataskin-derived ZClass instance underneath a Customizer folder. The Customizer has a SkinScript plug-in. When I try to add a new ZClass instance, I get an exception that I can trace to the fact that DataManager's _objectAdding method is trying to call _objectAdding on a Compute object. DataManagers.py line 29: def _objectAdding(self,client): for ob in self._uniqueProviders(('attributes','sheets','handlers')): ob._objectAdding(client) I've temporarily fixed the problem with a test to see if the _objectAdding attribute exists: def _objectAdding(self,client): for ob in self._uniqueProviders(('attributes','sheets','handlers')): if hasattr(ob, '_objectAdding'): ob._objectAdding(client) On deleting a Dataskin object, there was no error in the Zope Management interface, but the following was logged to the console: 2000-08-28T15:05:08 ERROR(200) Zope manage_beforeDelete() threw Traceback (innermost last): File /lib/python/OFS/ObjectManager.py, line 327, in _delObject (Object: PlugInBase) File /lib/python/Products/ZPatterns/DataSkins.py, line 303, in manage_beforeDelete (Object: doo) File /lib/python/Products/ZPatterns/DataSkins.py, line 162, in _objectDeleting (Object: doo) File /lib/python/Products/ZPatterns/DataManagers.py, line 34, in _objectDeleting (Object: Transactional) AttributeError: _objectDeleting Therefore, I've patched _objectDeleting similarly. The SkinScript method is: WITH SELF COMPUTE title="foo", fish='%s, (%s)' % (id,name) I suspect this is not the best way to solve the problem, though. Should compiled SkinScript support these methods? -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net

2 1

Re: [Zope] dtml-tree question
by Hugo Ramos 30 Aug '00

30 Aug '00

----- Original Message ----- From: "Dieter Maurer" <dieter(a)handshake.de> To: "Hugo Ramos" <hugo(a)zopers.org> Sent: Wednesday, August 30, 2000 6:14 PM Subject: Re: [Zope] dtml-tree question > Hugo Ramos writes: > > line 566 (original source): > > s.append([id,[]]) > Chris Withers has been hit by this bug, too. > > Maybe, he found a patch/workaround by now. > > I never saw this problem, but, up to now, used the tree tag > only in Zope 2.1.x. I have that error all the time if I use the dtml-tree tag inside a ZClass. regards ===== Hugo Ramos - hugo(a)zopers.org ZopersORG - http://www.zopers.org ===== Do not meddle in the affairs of programmers, for they are easy to annoy, and have all the source code!!!

1 0

SynchronizationTab proposal
by Shane Hathaway 30 Aug '00

30 Aug '00

Zopistas, I'd like to point out the new proposal at: http://dev.zope.org/Wikis/DevSite/Proposals/SynchronizationTab The goal is to integrate a UI that can be used to manage CVS, backups, other types of revision control, and coordination of development and production servers. Shane

1 0

Redirection and Authentication
by cs＠comlounge.net 30 Aug '00

30 Aug '00

Hi! I had a little problem and just wanted to ask if someone knows an explanation.. The goal: I want to show a list of newsitems to the user. If an administrator wants to change it he should be able to log in and see the same list but with edit- buttons. The setup is: /folder/list - public accessible dtml method which show the list /folder/edit - protected dtml method The edit method is protected so that the login requester pops up and asks for a passwort. Originally I was simply redirecting back to the list page inside the edit document by <dtml-call "RESPONSE.redirect('...../list')"> (the only line in the document) In list I then check for a login with <dtml-if "REQUEST['AUTHENTICATED_USER'].has_permission('whatever',this())"> .. show edit button here ... </dtml-if> The problem is now that after the Redirect AUTHENTICATED_USER is again set to Anonymous (which I tested by printing AUTHENTICATED_USER). If I do no redirect but put a normal link back to the list document, everything works as expected (thus showing the edit button). So has anyone an explanation? (Version is 2.2.0) (right now I directly include the list again in the edit document by using dtml-var. Works for this little thing but I assume this only being a workaround..) (I also remember having some strange problems with a redirect from python some time ago. Back then it did not commit the database transaction in Oracle. After putting a get_transaction().commit() before the redirect made things work again.) cheers, Christian -- Christian Scholz MrTopf@IRC COM.lounge http://comlounge.net/ communication & design cs(a)comlounge.net

2 1

generic login
by Michael James 30 Aug '00

30 Aug '00

Hi, We are developing a generic site login package based around a mysql database. Instead of reinventing the wheel has anyone done this before specifically using mysql. Cheers, Michael

2 1

Re: [Zope] dtml-tree question
by Hugo Ramos 30 Aug '00

30 Aug '00

----- Original Message ----- From: "Dieter Maurer" <dieter(a)handshake.de> To: "Hugo Ramos" <hugo(a)zopers.org> Cc: "ZOPE" <zope(a)zope.org>; "EUROZOPE" <eurozope(a)comlounge.net> Sent: Tuesday, August 29, 2000 10:22 PM Subject: Re: [Zope] dtml-tree question > Hugo Ramos writes: > > Is there a way to use my own self made '+' icon in a tree tag? > > I'dd like to use my own icon only IF i want to... and not change the python > > source to use my own icon all the time! > The code is partially there, but incomplete and commented out. > > If you do not mind other extensions as well, I could provide > a TreeTag patch for several extensions, including the > icon customization. hello Dieter, I've tryied to hack the treetag source already... but there's some kind of bug in it: line 566 (original source): s.append([id,[]]) Why is this trying to append to 's' when 's' has become a tupple somewhere before this line???... tupples don't accept append!! This bug is really making me crazy... because it makes an error when clicking the + icon in a dtml-tree that I must use... Another thing: I hacked the source of treetag.py to accept 2 more parameters in the dtml-tree... icon_mi and icon_pl The hacked source is in the attach. Changes go from line 411-427. Of course i defined the 2 new parameters as None in the file top. Please somebody help me... I'm running out of ideias... regards ===== Hugo Ramos - hugo(a)zopers.org ZopersORG - http://www.zopers.org ===== Do not meddle in the affairs of programmers, for they are easy to annoy, and have all the source code!!!

2 1

ZCatalog and SiteRoot
by Hans Rauch 30 Aug '00

30 Aug '00

Problem: If I use ZCatalog without SiteRoot, I don't have any problems. But if I try to use ZCatalog with a virtual host (by SiteRoot), I'm not able to "Find items to ZCatalog": ErrorType: IndexError Error Value: list index out of range The error occurs on line 321 from ZCatalog.py --------------------------------------------- Solution: With the following patch I can use ZCatalog with virtual hosts (by SiteRoot): try : path=urllib.unquote(string.split(URL2, REQUEST.script)[1]) except : path=urllib.unquote(URL2) Hans -- ----------------------------------- HeLP PI Frankfurt Hans Rauch Gutleutstr. 8-12, 60329 Frankfurt/M Tel 069 / 2568 - 335 Fax - 320 hrauch(a)help-pi.f.shuttle.de -----------------------------------

2 1