- Zope-Dev - Zope lists

RE: [Zope-dev] attribute protection question
by Brian Lloyd 21 Aug '00

21 Aug '00

> Hmmm. Hence the problem with properties that meant OFS.Item.SimpleItem > had to have __allow_access_to_unprotected_subobjects__=1? > > Can you not just assign roles to properties as they're created or am I > missing something else? That's one way to do it - but it will require some thought to make sure we do it right. Having the "=1" assertion is a short-term solution intended to avoid breaking everyone's code for 2.2 while taking a step on the road to changing the default policy. I expect that it will soon make a distinction between properties and attributes that are not properties, which will be the next step on the road. I'd like to see this for 2.3, but I don't promise specific features for particular release numbers anymore :) I do want it to be Soon. My hope is that we'll release a 2.x beta where: o far less things are available via the __allow_... hack o product authors and app builders will have auth problems because they're using attrs formerly covered by the hack o the new security assertion spelling from dev.zope.org will be available and make it much easier for people to go in and protect the problem attrs correctly :) o most if not all of the Zope core will be using the new assertion style, which will help the product authors along with the "guide" to making security assertions that will be a deliverable of that dev.zope.org project o we'll be one more step closer to where we want to be Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

intSet and the new security model
by Chris Withers 21 Aug '00

21 Aug '00

Hi, Squishdot uses an intSet called 'thread' to store some information. Items in this intSet are used in several DTML methods, for example: <A HREF="<dtml-var site_url >/<dtml-var expr="thread[0]" >/index_html#<dtml-var id >">Return to main thread</A> Now, in Zope 2.2 this throws an unauthorized error as show in the PS. How can I make this go away in a non-hacky fashion? cheers, Chris PS:

1 2

RE: [Zope-dev] attribute protection question
by Brian Lloyd 21 Aug '00

21 Aug '00

> In the new security model is it just attributes that are methods that > are protected or is it all attributes? All attributes - methods just happen to be the most common case. > Now, would I need body__roles__=None or somethign similar to > be able to > do: > <dtml-var body> Yes, or (better) associate the name of the attribute with a permission. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

2 1

Squish
by Chris Withers 21 Aug '00

21 Aug '00

...it was named appropriately ;-) Right, this would probably be easier if you have a background knowledge of Confera/Squishdot code, anyway... there's two classes, SquishSite and Posting. They don't inherit from each other, but postings are always contained in a SquishSite and eveything is Acquisition.Implicit-inheriting. Right, there's a whole host of methods: def postingValues(self): def tpId(self): def tpURL(self): def this(self): return self def has_items(self): def desc_items(self): ...that are implemented identically. So I thought 'why?' Why can't they just be implemented in the SquishSite class and acquired by the postings? So I commented them out... bad move :( Things that used desc_items, and a dtml-tree that used postingValues suddenly started producing infinite recusion errors and other weirdness. I think, instead of returning the children like postingValues is supposed to, it just returned the children of the Site object instead. very strange. Can you help explain? (it seemed to me like the method was being acquired alright, but the 'self' being used was that of the object the method was acquired from rather than object the method was being called on) The code for the two methods of any substance (the rest are just things like 'return self' and 'return self.id') is shown below. cheers, Chris # protected by 'View' permission def desc_items(self): # """ return latest list of replies """ mlist = [] mstack = Stack() if self.has_items(): plist = [] for id in self.ids: plist.append(id) plist.reverse() for id in plist: mstack.push(id) while not mstack.isEmpty(): item_id = mstack.pop() item = self.data[item_id] mlist.append(item) if item.has_items(): plist = [] for id in item.ids: plist.append(id) plist.reverse() for id in plist: mstack.push(id) return map((lambda x, p=self: x.__of__(p)), mlist) # protected by 'Manage Postings' permission def postingValues(self): # """ return all replies """ return map(lambda x, p=self: x.__of__(p), self.data.map(self.ids)) self.data is an IOBtree in the SquishSite object. self.ids is an intSet in the SquishSite object. (I think both are acquired by Posting objects)

1 0

Unauthorized head hurting :(
by Chris Withers 21 Aug '00

21 Aug '00

Is there any way you can find out what, exactly (ie a traceback ;-) is causing an unauthorized error? cheers, Chris

1 0

Methods with no __roles__ defined no always protected?
by Chris Withers 21 Aug '00

21 Aug '00

Hi, Just doing Squishdot for 2.2 when I noticed the following: The SquishSite class has a method called item_count() which is used on one of the management pages. It currently isn't protected by any permissions or __roles__ and yet it still works fine on the management screen concerned. I thought this sort of thing was supposed to throw up an unauthorized error in 2.2? cheers, Chris PS: It is now protected by a permission, but I can send anyone who cares a version which isn't...

2 2

attribute protection question
by Chris Withers 21 Aug '00

21 Aug '00

In the new security model is it just attributes that are methods that are protected or is it all attributes? For example, I have a lump of text in an Article class which is stored in self.body. Now, would I need body__roles__=None or somethign similar to be able to do: <dtml-var body> ? cheers, Chris

1 0

acquired methods and permissions
by Chris Withers 21 Aug '00

21 Aug '00

More questions from 2.2'ing Squishdot ;-) If a method is acquired by an object, does it use any permissions defined for that method in the object it's acquired from, or do you have to specify the permissions in the acquiring object as well? cheers, Chris

1 0

Looping through a folder's contents...
by jiva＠devware.com 21 Aug '00

21 Aug '00

I would like to loop through the contents of a folder, and the contents of the subfolders of that folder. I know I can do this to a singular level by doing something like: <dtml-in "subfolder.objectValues('Folder')"> <dtml-var title> </dtml-in> Should give me a list of the titles of all the subfolders of the folder called "subfolder". So, once I get there, how do I loop through the subobjects of each of those folders? In other words, I have a subfolder inside of the folder called "subfolder" and I want to see the contents of that folder. How do I do it? -- IBM Pollyanna Principle: Machines should work. People should think.

3 4

Re: [Zope-dev] Data.fs
by Dieter Maurer 21 Aug '00

21 Aug '00

Andre Schubert writes: > I'am using Zope 2.1.6 and my Data.fs is going corrupted .... > My Questions are: is there a way to delete the last transaction from > Data.fs, There is a product "tranalyze" (or "tranalyzer", "tranalyse", "tranalyser") that allows you to analyse and fix your Data.fs. Zope 2.2 contains an "ZODB.fsrecover" which is able to fix a corrupted "Data.fs". > and can i backup the Data.fs when Zope is running. .... Yes. Just copy it. Dieter

4 3