- Zope-Dev - Zope lists

RE: [Zope-dev] Methods through the Web (security?)
by Brian Lloyd 19 May '00

19 May '00

> > Hmm, another ZAZ fan :-) > Don't get me started... :^) > > a holdover from the bobo days - if you are a method and you have a > > docstring, you are accessible through the web (but still subject to > > the std security rules). objectIds and objectValues are a good > > example of things that really only want to be used from DTML and > > thus shouldn't have docstrings. I've changed this (and a few other > > iffy methods) for the next release. > > Won't this break Amos' XML-RPC-based editor and similar hacks? Waaa.... probably. Ok, so I've _provisionally_ changed this in the current CVS. I feel a to-the-death-cage-match coming on. > Can't you just turn off 'Access contents information' permission or > whatever it is on a folder if you don't want people to call > those things trough the web? Yes you could, except that you would also make them inaccessible from DTML (or from anywhere else) for the same class of users. Is it really acceptable that in order to use <dtml-in objectIds> on a page that needs to be accessible to anonymous users that I must grant 'Access contents information' to anonymous users and thus give them the ability to inspect my objects if they want to? I have a feeling that intent will need to become more important somehow in the future. As we add more protocols and types of usage to Zope, it becomes harder for a single permission to really cover a resource in a way that makes sense for all of the various usages. From the point of view of an xml-rpc based client app, having objectIds and the like may be an absolute necessity, while from a pure HTTP standpoint many would at best consider it superfluous or at worst consider it a security hole. *sigh*. Maybe the right short-term thing is to just leave it the way it was and tell people who may be concerned about it to turn it off via that permission and live the repercussions that will have in their DTML. I guess at least that way the software isn't taking the choice out of their hands. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

8 10

Re: Strange ZClass permissions problem with 2.2a1
by Dr. Ross Lazarus 19 May '00

19 May '00

Yep, trying to access a newly instantiated empty zclass instance produces the same error. Looks like a bug. Email me if you want an exported version of my zclass to poke and prod at... Tres Seaver wrote: > Does the problem repeat in the "vanilla" version if you just create a > new instance of your ZClass, instead of importing the old pickle? If > so, it is definitely a "bug"; if not, it may be a "migration problem," > with a fix like the one Brian posted for recursively "re-ownering" > Zope.org. > > If I take out manage_tabs from the offending ZClass index_html > > method, I can view index_html (but of course, I can't use the > > management stuff built in! making it rather useless), so that's > > where we're getting into trouble for sure. > > > > I've tried starting out with a vanilla 2.2a1 Data.fs and importing all > > the zclasses and the relevent folders - no difference. > > > > Anyone else seeing this? > > Is this worthy of the collector? > -- Dr Ross Lazarus Associate Professor and Sub-Dean for Information Technology Faculty of Medicine, Room 126A, A27, University of Sydney, Camperdown, NSW 2006, Australia Tel: (+61 2) 93514429 Mobile: +61414872482 Fax: (+61 2) 93516646 Email: rossl(a)med.usyd.edu.au

2 1

Displaying Excel Workbooks on a Zope site
by Adam Ratcliffe 18 May '00

18 May '00

I am using a Zope site as a repository for documentation on a business application that I'm involved in supporting. Site content presently includes a mixture of HTML pages and MS Word and Excel documents. The site uses a frameset to contain a DTML-Tree based navigation structure in the left frame, and displayed pages in the right frame. When I attempt to open MS Office documents in the right frame they typically open fine the 1st time around, but if I move off the page and seek to revisit them I'm presented with a download dialog box rather than the page itself. I imagine that this is a caching issue. If anyone was able to help with some ideas on the behaviour of MS Office documents in Zope it would be most appreciated. Best regards Adam

1 0

Adding ZCatalog index programatically
by R. David Murray 18 May '00

18 May '00

I was just looking at the ZCatalog code to figure out how to programatically add an index to a Catalog. I figured out how to do that fairly easily, but the code I was looking at has me a bit mystified. The method manage_addIndex is defined. The form that you use through the management interface to add an index has a submit button whose name is manage_addIndex:method. OK, that all looks like reasonable magic (magic because I don't know exactly what happens when a button gets marshalled as a method). Here's the part I don't understand: the form's action is set to the Catalog itself. manage_addIndex expects the index name and type as its first two parameters. Where does the magic come from that turns the form submission into a correct call to manage_addIndex? Probably I'm missing something obvious, but I will appreciate any aid in increasing my Zope Zen level here <grin>. --RDM

2 2

Fixed reply Re: [Zope-dev] Trouble setting LoginManager default user class
by Dan L. Pierson 18 May '00

18 May '00

Oops, my reply of yesterday was missing the actual error I get using manage_setStorage. It's an AttributeError for aq_acquire! I can't see how I could be getting this since PersistentUserSource singly inherits from BasicUserSource which inherits from Rack. What happened to my aq_acquire? Does it have to do with some mistake in the way I'm calling manage_addLoginManager? Phillip J. Eby writes: > At 10:01 PM 5/17/00 +0100, Steve Alexander wrote: > > > >The _defaultClass only needs to become DemoPortal.LoginMember before a > >Portal's LoginManager instance is created. > > > >Therefore, you can leave the _defaultClass as LoginUser until the > >"install" method of DemoPortalBase is called (PTKDemo/Portal.py). > > > >In the "install" method, after creating a MembersClass(), set its > >_defaultClass to LoginMember. > > It would be better to call manage_setStorage(zclass='meta type') rather > than tinkering with attributes directly, as manage_setStorage should always > be forward-compatible. Ah yes, forgot about this problem -- it was yesterday... Here's my current code from DemoPortalBase.install: elif db == 'LoginManager': from Products.LoginManager.LoginManager import \ LoginManager, manage_addLoginManager from PersistentUserSource import PersistentUserSource self.MembersClass = LoginManager # maybe not needed anymore manage_addLoginManager(self, 'Persistent User Source', ['Basic Auth Login'], 0, 0, 0) #self.acl_users.manage_setStorage('DemoPortal/LoginMember') for us in self.acl_users.UserSourcesGroup.objectValues(): if us.meta_type == 'Persistent User Source': us.manage_setStorage('DemoPortal/LoginMember') The commented out line fails because it doesn't have a manage_setStorage. The uncommented out code causes the following traceback. It was after I hit this that I started hacking on _defaultClass... Probably I should have yelled for help then, but I have this bad habit of digging myself in as far a possible first :-) Traceback (innermost last): File /home/zope/lib/python/ZPublisher/Publish.py, line 214, in publish_module File /home/zope/lib/python/ZPublisher/Publish.py, line 179, in publish File /home/zope/lib/python/Zope/__init__.py, line 202, in zpublisher_exception_hook File /home/zope/lib/python/ZPublisher/Publish.py, line 165, in publish File /home/zope/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: Portal_add) File /home/zope/lib/python/ZPublisher/Publish.py, line 102, in call_object (Object: Portal_add) File /home/zope/lib/python/OFS/DTMLMethod.py, line 150, in __call__ (Object: Portal_add) File /home/zope/lib/python/DocumentTemplate/DT_String.py, line 502, in __call__ (Object: Portal_add) File /home/zope/lib/python/DocumentTemplate/DT_With.py, line 148, in render (Object: Portal.createInObjectManager(REQUEST['id'], REQUEST)) File /home/zope/lib/python/Products/PTKDemo/Portal.py, line 71, in install (Object: DemoPortalBase) File /home/dan/src/Zope-2.1.6-src/lib/python/Products/ZPatterns/Rack.py, line 348, in manage_setStorage (Object: AttributeProviderContainer) File /home/dan/src/Zope-2.1.6-src/lib/python/Products/ZPatterns/Rack.py, line 225, in _unifiedZClassRegistry (Object: AttributeProviderContainer) AttributeError: (see above)

2 5

Re: [Zope-dev] a simple example of the ZPatterns frame work
by Jephte CLAIN 18 May '00

18 May '00

"Phillip J. Eby" wrote: <snip> > >The AttributeProvider (that my rack have by default) raise an exception > >in MyItem.__init__ because i and s do not exist (indeed, I want to > >create them in the instance!) > > Could you give the traceback? I think it is more likely your __init__ is > failing because you are setting self.id. You should not set self.id > directly in your __init__ method, you should call RackMountable's __init__ > method like this: > Thanks for the insight. It is a pity that I can't write e-mail from where I work. When I'm back to the office, I will cut and paste the traceback and send it to you tomorrow. I hope it will be useful. You probably noticed that when you are at work, it's time to sleep for me. see you tomorrow :-) we-should-definitely-have-36-hours-a-day-ly yours, Jephte CLAIN minf7(a)educ.univ-reunion.fr

1 0

updated Wikki with __call__ issue
by Chimezie Thomas-Ogbuji 18 May '00

18 May '00

I added another note on the Wikki regarding the XSLTMethod __call__ issue, more information on the ZPublisher is neccessesary for any progress. Is there any good documentation on the subject? Here is the link to the issue: http://216.164.72.7:7780/Wiki/Members/jim/ZDOM/Issue%20with%20__call__%20an… -- Chimezie Thomas-Ogbuji Junior Consultant Fourthought Inc. (303) 583 9900 ext 104 cogbuji(a)fourthought.com

1 0

RE: [Zope-dev] 2.2.0a1 Problems
by Brian Lloyd 18 May '00

18 May '00

> - start.bat still hasn't been renamed. It's not that bright since > windows has had a start command for ages now... typing start.bat tries > to 'start' something called .bat. doh... > The only way to get it to work is > "start.bat" > or > ./start > which is very weird on an NT box although quite normal on UNIX ;-) We are going to move a better 'zopectl start', 'zopectl stop' sort of setup, though its not there yet. This will make a number of things better. > - the -P option doesn't work properly. > python z2.py -D -P 9000 still resulted in the PCGI server being run on > port 8090. That's because the pcgi info file (Zope.cgi) controls the pcgi port. > Wasn't there going to be an option so that servers which you don't use > (monitor and PCGI in this case) don't get started? yes, try: python z2.py -X -w 8080 ...to only publish HTTP on port 8080. Note that -X should come before the specific servers you want to enable. > - hitting the help button on the ownership tab resulted in: > Traceback (innermost last): Yes - I just checked in the help for ownership today. It will be in the next release. Thanks for the feedback! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

3 2

DCOracle Problem on HPUX
by Mark Postal 18 May '00

18 May '00

I'm running HPUX 10.20 and Oracle 8.0.3. My goal is to use ZOracleDA, but first I must get DCOracle working. DCOracle compiles OK and I am able to connect to the database when executing from the command line. My test script is attached for reference. My problem occurs when running in the Zope environment, as ZOracleDA Product or an External Method, DCOracle hangs in the oci_8.Logon() method. I have to kill the python process to recover from the error. Yes, I have ORACLE_HOME and LD_LIBRARY_PATH set. I wrote a new module, just to login to Oracle, using code that I am more familiar with. Again with the same result, it works OK on the command line but not in Zope. I have included that code also, because it shows where the hangup is. In my module it hangs in OCIServerAttach. Here's where I need help. In both cases, its actually hanging in an Oracle function (OCILogon in oci_8.c and OCIServerAttach in my module). What might cause this? Why does it happen in the Zope environment and not in the command line environment? How do I get this working? Thanks in advance, Mark Postal postalm(a)nosc.mil =========================================================================== # DCOracle test script from string import join, split # If threads are enabled, then put Oracle in thread-safe mode: try: import thread except: thread=None if thread is not None: oci_.opinit(oci_.OCI_EV_TSF) del thread if __name__ == '__main__': connection_string = "system/xxxxxx" if environ.has_key('ORACLE_HOME'): print "ORACLE_HOME: ", environ['ORACLE_HOME'] else: print "ORACLE_HOME not defined" if environ.has_key('ORACLE_SID'): print "ORACLE_SID: ", environ['ORACLE_SID'] else: print "ORACLE_HOME not defined" if environ.has_key('TWO_TASK'): print "TWO_TASK: ", environ['TWO_TASK'] else: print "TWO_TASK not defined" if oci_: print "Got oci_" if oci_8: print "Got oci_8" up, s = (split(connection_string, '@')+[''])[:2] u, p = (split(up, '/')+[''])[:2] print "Logon: %s %s %s" % (u,p,s) sc=oci_8.Logon(u,p,s) _d=sc.lda() print "Logging off" oci_.ologof(_d) =============================================================== static PyObject * Logon(PyObject *ignored, PyObject *args) { char *u, *p, *d; int lu, lp, ld; if (!PyArg_ParseTuple(args, "s#s#s#", &u, &lu, &p, &lp, &d, &ld)) return NULL; Py_BEGIN_ALLOW_THREADS OCIInitialize(OCI_DEFAULT, NULL, NULL, NULL, NULL); OCIEnvInit(&envp, OCI_DEFAULT, NULL, NULL); OCIHandleAlloc(envp, (dvoid**)&hp, OCI_HTYPE_SVCCTX, NULL, NULL); OCIHandleAlloc(envp, (dvoid**)&ep, OCI_HTYPE_ERROR, NULL, NULL); OCIHandleAlloc(envp, (dvoid**)&svrp, OCI_HTYPE_SERVER, NULL, NULL); OCIHandleAlloc(envp, (dvoid**)&sesp, OCI_HTYPE_SESSION, NULL, NULL); OCIAttrSet(sesp, OCI_HTYPE_SESSION, u, lu, OCI_ATTR_USERNAME, ep); OCIAttrSet(sesp, OCI_HTYPE_SESSION, p, lp, OCI_ATTR_PASSWORD, ep); /* fails here */ printf("Attempting to attach to server\n"); OCIServerAttach(svrp, ep, (text *) 0, 0, OCI_DEFAULT); printf("Attached to server\n"); OCIAttrSet(hp, OCI_HTYPE_SVCCTX, svrp, 0, OCI_ATTR_SERVER, ep); OCISessionBegin(hp, ep, sesp, OCI_CRED_RDBMS, OCI_DEFAULT); OCIAttrSet(hp, OCI_HTYPE_SVCCTX, sesp, 0, OCI_ATTR_SESSION, ep); Py_END_ALLOW_THREADS return Py_None; }

3 5

zope + apache + webdav
by Steve Giraud 18 May '00

18 May '00

Hello, I've got a zope who turn on my apache server, and i want use webdav. I have already apply the patch to mod_cgi (thanks greg) but my problem is not resolv. Is anybody know how to change the httpd.conf to use webdav protocol to work with zope through apache ? ******************** Steve GIRAUD Universite de Savoie ********************

1 0