- Zope-Dev - Zope lists

Can't add propertysheets to ZClasses in 2.2
by Kevin Dangoor 08 Jun '00

08 Jun '00

I've already submitted this to the collector, but I wanted to make sure that I'm not the only one with this problem. Using the CVS Zope, if I create a ZClass, I am unable to add a Property Sheet because of an error (missing "__len__"). I find it hard to believe that I'm the first person to try to add a ZClass in 2.2, but I didn't see this in the collector. Kevin http://www.byproducts.com - Humor and Novelties

1 0

RE: [Zope-dev] Request for comments: Directory storage
by Toby Dickenson 08 Jun '00

08 Jun '00

I don't have the two on comparable machines :-( Do you have a standard benchmark for comparing the relative performance FileStorage/DirectoryStorage on reiser fs? > > Mmmmm. I suspect NTs heavier file security checks will prove to be a > > significant disadvantage - benchmarks to follow. > > If you do benchmarks, you should do them comparing > DirectoryStorage/NTFS to DirectoryStorage/reiserfs, because > (at least at > mass object creation) DirectoryStorage is slower than > FileStorage (because > of the open() overhead). > I plan on optimizing the random access on huge number of > objects case. > > -Petru >

2 1

RE: [Zope-dev] Request for comments: Directory storage
by Toby Dickenson 08 Jun '00

08 Jun '00

> The version I sent to the list assumes a '/' directory > separator. I'm > releasing a fixed version (a snapshot of my working code) in > a couple of > seconds. Thats fine on windows too (a backslash is only required on the standard command line, but everywhere else a / is ok too) > I do think it's worth a try, but I doubt NTFS is as good > as ReiserFS > :) Mmmmm. I suspect NTs heavier file security checks will prove to be a significant disadvantage - benchmarks to follow.

2 1

DirectoryStorage 0.03
by Petru Paler 08 Jun '00

08 Jun '00

Note that this version (experimentally) uses a dbm database for storing serials. If you don't have/don't want to use gdbm, replace all occurences of gdbm with dbhash or dumbdbm. I didn't used anydbm because it has some strange problems with my python installation :) (but it will be fixed soon). Changelog: 0.03: - don't die if posix.fsync is not available - base class renamed to DirectoryStorage - added directory (re)creation and locking - added a 'magic' file - last oid file open/close bug - moved serials to an gdbm database 0.02: - converted to using os.path.join 0.01: - initial release -Petru

1 0

possible security flaw? - and, request for a phone conference.
by Jon Franz 08 Jun '00

08 Jun '00

Hello, First off, sorry for the cross-posting of this message to admin and to development. I'm a software developer for a major ISP in the Midwest region of the USA. Recently we began evaluating Zope for use in our web application development, internally and for our clients, and have been quite pleased with the wealth of features and add-ons available*; However, I need two points addressed if possible: 1) We are running Zope 2.1.4 mapped to the root of the apache install on a Linux (mandrake 7.0) box, and have found a rather nasty security - or at least, its what I'll call a nasty problem - because if you don't know about it, it could really bite you in the butt. Basically, if a user with manager privileges to a folder changes their password to be empty, then anyone (from permitted domains) can access the management screen for that folder Without Logging On... Zope assumes that you are the user without the password and treats you as if you have those rights. I found this problem when one day the welcome Zope page (default from install) didn't prompt me for a password when I clicked to enter the management screen. I did not realize what had happened until I went under the 'undo' tab and saw that all of my actions while I was snooping around for the problem were being listed as being done by one of the other developers... I went into the acl_users and fixed their password and everything is back to normal. I've tested this by setting my own password to an empty string, and it lets me log in... From a security standpoint, It should probably prompt for a user name and password, and simply accept a empty field for the password As the password for that user... Anyway, my point is to either inform the community of the bug, if it isn't known, or to find out if it is known and has been fixed in the newest release... If it has not been fixed in the newest release, I will be glad to create and provide a patch... 2) As an experienced web developer, I'm very keen on new technologies that can be reused and make my life easier - thus Zope is a godsend. However, my management is hesitant to start using Zope on a regular basis for our projects - they feel it is unproven and possibly unstable: Now, I realize, and have informed them of the facts, that Digital Creations makes their living off of Zope, and that new businesses are springing up almost everyday that are Zope-centric, and that many contracting/development firms are embracing it whole heartedly... But, my management is still kind of hesitant. Is there anyone among you in the community who would be willing to write about your experience with Zope in the professional development arena, to address their concerns? Even better, Would anyone be willing to participate in a conference call q & A session on Zope's suitability for use in professional web development? I cannot offer money for these, but I can promise my undying gratitude, and, I can promise that any and all add-ons and patches we create for Zope would be released back to the community at large... As a large website app dev firm, our contributions could be significant... Please email me privately if you wish to possibly participate in the phone conference. Thank you for your time and attention! * I have already made two modifications to the Zope source, one dealing with making 'border' a built in property (and used during tag output) of the image object. and another, simple hack to the basic dtml parsing routines that makes your dtml development a little faster by requiring less typing. Both of these will be available under my member area on Zope.org. Hopefully these will be the first of many patches and add-ons I get to contribute.

1 0

Re: [Zope-dev] Recursively adding ZClasses (continued)
by Rik Hoekstra 07 Jun '00

07 Jun '00

-----Original Message----- From: Jason Spisak <444(a)hiretechs.com> To: Rik Hoekstra <rik.hoekstra(a)inghist.nl> Cc: Kevin Dangoor <kid(a)kendermedia.com>; zope-dev(a)zope.org <zope-dev(a)zope.org> Date: woensdag 7 juni 2000 22:26 Subject: Re: [Zope-dev] Recursively adding ZClasses (continued) >Rik Hoekstra writes: > >> Thanks a lot Jason, >> >> I'll try it (though i'd swear I tried something very much alike) It was very much alike, but you were right ;-). The difference was that I did a (sort of cut down pseudocode) <dtml-with "manage_addProduct['ZECF']"> <dtml-in obligatoryitems> <dtml-call "ZECItem_add(_['sequence-item'], REQUEST)"> </dtml-in> </dtml-with> in which case the dtml-in interferes badly with the dtml-with so turning it around to <dtml-in obligatoryitems> <dtml-with "manage_addProduct['ZECF']"> <dtml-call "ZECItem_add(_['sequence-item'], REQUEST)"> </dtml-with> </dtml-in> which works. So is this subtle or what ?! But at least it's consistent >> >> > >> >This currently adds recursive ZClasses for me. All ZClasses are on the top >> >level of the Product, no nesting: >> > >> > <dtml-with "manage_addProduct['ZGL']"> >> > <dtml-with >> >"ComponentClass.createInObjectManager(_.getitem('unique_id', 1), REQUEST)"> >> >> hm, what is the 1 in the getitem argument doing there? Never used that >> before... > >I am using it to render the document, not just get me the code. The >document is a DTMLMethod that renders a Zope install unique id based on the >time. > Ah, yes. No need for that for me > >> >I cut a few things out that didn't have to do with the recursing, but you >> >bet the general picture. >> > >> >> >> Yes I bet it (sorry couldn't resist) >> > >Yeah, like this is the most complex DTML you've ever seen. ;) Hm. You don't want me to send some of the clobbered stuff I put together then. Still, I don't see how to do this in a cleaner way in a Python Method (it will look cleaner, but the voodoo will be about the same unless I'm badly mistaken). Thanks (and Kevin also) for your help in sorting this out. Rik

2 1

Packaging ZODB, ZEO, ...
by Andrew M. Kuchling 07 Jun '00

07 Jun '00

My ZODB article says little about installation, because there's no good answer at this point, beyond installing all of Zope and adding $ZOPE/lib/python to your PYTHONPATH. Next week I'm going off to California for a few days, and will have lots of time to kill, so I'd like to package ZODB separately. Question: how does DC want to do this? If I was following my own heading, I'd use the Distutils to separately package ExtensionClass, ZODB, and anything ZODB depends on. But I'd like to make this packaging official; what would DC like to do? Another point: I understand that packagizing all of Zope is on the TODO list, but it's such a big job that it won't be done any time soon, certainly not for 2.2. ZEO isn't released yet, though, so it can be placed in its final position in an otherwise-empty package. What would that location be, and what would be the package arrangement for Zope? zope.ZEO, zope.ZODB, zope.DocumentTemplate, &c., or something else? I leave on Sunday, so this needs to get this settled before then in order for me to know what to do while away. -- A.M. Kuchling http://starship.python.net/crew/amk/ Imagine a world where nothing is stable. In the West, we have three moving elements -- Air, Fire, Water -- but at least we can depend on the fourth. -- Philip, in Peter Greenaway's _8 1/2 Women_ (1999)

1 0

Re: [Zope-dev] Recursively adding ZClasses (continued)
by Rik Hoekstra 07 Jun '00

07 Jun '00

Thanks a lot Jason, I'll try it (though i'd swear I tried something very much alike) > >This currently adds recursive ZClasses for me. All ZClasses are on the top >level of the Product, no nesting: > > <dtml-with "manage_addProduct['ZGL']"> > <dtml-with >"ComponentClass.createInObjectManager(_.getitem('unique_id', 1), REQUEST)"> hm, what is the 1 in the getitem argument doing there? Never used that before... >I cut a few things out that didn't have to do with the recursing, but you >bet the general picture. > Yes I bet it (sorry couldn't resist) thanks again, and i'll let you know if it works. It would be highly inconsistent if it would work from one product folder (a different from the current one) and not for the other (the current). So I think this deserves some more digging. Rik

2 1

Recursively adding ZClasses (continued)
by Rik Hoekstra 07 Jun '00

07 Jun '00

Could someone help me understand adding adding ZClasses a bit further? First I had a problem with nested ZClasses, which got me into trouble when I wanted to add ZClasses to each other. So I followed the 'common wisdom' of adding all ZClasses at the top level of the product. THis generally works OK, and you can add ZClass instances to each other from the management interface. So far so good. WHere things go wrong is by recursively adding ZClasses, as in: the following pseudo code for ParticularZClass with some NestedZClasses inside: (<Particular ZClass> constructor has the following action sequence): create ParticularZClass instance set some properties in somelist set some other properties into REQUEST create NestedZClass instances whatever reading and following every piece of documentation I could get on this (not much), I never got any further than adding the NestedZClasses instances on the _same_ level as the ParticularZClass. No <dtml-with "manage_addProduct['whatever']"> (which contrary to documentation should have the containing product and not the ZClass as the 'whatever' argument) could help me out. The only workaround is to create the ZClass in an auxiliary product, in which case the recursive adding does work. Could someone explain what is happening here (apart from that it's a bug)? And yes, I'll add it to the Collector. Rik

3 3

LM and user objects
by Bill Anderson 07 Jun '00

07 Jun '00

Pardon my denseness (politics can do that to you I guess ;)... I beleive I have the basic LM concept grasped. I understand that I need a 'User' Object, ostensibly can be done in Python or ZClasses. For now, I will look at ZClasses for experimentation. So, I beleive that to set up a ZODB-based User for LM, I need to create the UserObject's ZClass. What do I need to subclass, if any, from? Once I get that set up, I add property sheets for the user where? The ZClass? Once I get that set up, how do I add a user? Would one method be to go into the acl_users(LM) and add a User? What about adding them programmatically? I looled at the API.txt, but it wasn't helpful in this regard. :( I swear if nobody beats me to it, I'll write all this up and post it to Zope.org when I get it done. :) (If nothing else, for my own reference ;)

6 11