- Zope-Dev - Zope lists

Distributed ZODB-Transactions
by Heine Gregor 18 May '00

18 May '00

Zopistas! I want to write an Product that mirrors every ZODB-Transaction to a Backup-Server. The idea was to trap every transaction (i.e. creation, change, deletion of zope-objects) and transfer a copy of the object to another server (via XML-RPC?!?) after the transaction got commited. I've been debugging through various zope-classes (esp. transaction.py, connection.py) but couldn't understand the way, zope manages the transactions. The creation and deletion process always seems to trigger a transaction for the parent object. Has anybody an idea? Thanx, Gregor!

4 3

Zope and SMP
by news-list.zope.dev＠innominate.de 18 May '00

18 May '00

hi! yesterday, i have test-driven zope on a dual-pentium smp-machine running linux 2.2 and i was very disappointed by the results. the zserver threads are running on both cpu's but it seems to scale really, really badly. i have only done some very cheap benchmarking but it seems that a single cpu is faster than 2 cpu's. but as i said, this is not proper benchmarking (yet). i wanted to ask if someone has already tried zope on more than 1 cpu and/or could point me to a direction where i could find out more about this subject? cheers! thilo -- thilo.mezger(a)innominate.de innominate AG networking people fon: +49-30-308806-0 fax: -77 web: http://innominate.de pgp: /pgp/tm

3 2

Re: [Zope-dev] Methods through the Web (security?)
by Tres Seaver 18 May '00

18 May '00

Chris Withers <chrisw(a)nipltd.com> opined: > > Brian Lloyd wrote: > > [snip] > > > > Won't this break Amos' XML-RPC-based editor and similar hacks? > > > > Waaa.... probably. Ok, so I've _provisionally_ changed this in > > the current CVS. I feel a to-the-death-cage-match coming on. > > Horse before the cart? > > Maybe the XML-RPC editor needs fixing 'cos something got fixed in > Zope?! > > > > Can't you just turn off 'Access contents information' permission > > > or whatever it is on a folder if you don't want people to call > > > those things trough the web? > > > > Yes you could, except that you would also make them inaccessible > > from DTML (or from anywhere else) for the same class of users. > > ...as I found out when I first ran into this problem... > > ...and as I said in the first post you can get round this using a > tortuous set of proxy roles (dunno how that'll get screwed up in 2.2) > but it's not a 'nice' solution to what should be a fairly simple > problem. > > > Is it really acceptable that in order to use <dtml-in objectIds> > > on a page that needs to be accessible to anonymous users that I > > must grant 'Access contents information' to anonymous users and > > thus give them the ability to inspect my objects if they want to? > > No!!! ;-) I don't get the issue here, I guess; either anonymous users can view objectIds (through the web, through XML-RPC, whatever), or they can't (because you don't want them to have the information that a given object is there, I guess?) If they can't, then _any_ DTML method which calls objectIds() should be required to have non-anonymous permissions, either through the AUTHENTICATED_USER or through proxy roles. This seems to be working as designed in the current implementation. Turning off objectIds() by default is like running an anonymous FTP server but disallowing the "dir" command: it reduces the utility of the server to such an extent that you might as well not bother. :) An alternate implementation would be to have objectIds() check for the anonymous role, and return only the subset of IDs that the 'skip-unauthorized' attribute filters in <dtml-in> (this touches on another peeve of mine -- lots of the "magic" which DTML does is not accessible outside of the tags). > The solution I proposed before is simple (maybe not to implement ;-) > and I think solves all the problems: > > Split the current 'view' permission into two new permissions: > > 1. View - allow users to directly access an object through > HTTP/FTP/XML-RPC/etc > > 2. Execute - allow non-direct execution of a method by a user, for > example by them viewing another method/object which they have the > 'view' permission for. > > This effectively provides the same functionality as adding or removing > a docstring from a method in a python class, and could be used to > replace it, as it's not really documented anywhere. > > I can't really see a use for he 'Access contents information' > permission other than an additional control over and above these two > new ones. > > As simple example: > -index_html (role X has view permission) > <dtml-var standard_html_header> > Some Text > </BODY></HTML> > > -standard_html_header (role X has execute but not view permission) > <HTML><BODY> > > So, a user with role X can view index_html and have it render > properly (although it wouldn't if he didn't have the execute > permission on standard_html_header) but if the user tried to view > standard_html_header on its own, he would get an unauthorised > error... > > Comments? (hopefully I'll get some this time... ;-) > > cheers, > > Chris > > PS: The XML-RPC stuff could just be given the nwe view permission for > objectIds, if it REALLY needs it... although this would mean the > docstrings thing would have to eb replaced, which isn't necessarily a > bad thing ;-) Itamar Shtull-Trauring <itamar(a)maxnm.com> replied: > Yes, it really needs it. My XML-RPC uploading interface to Zope > needs to know what's in a folder - so it needs objectIds. How else > am I supposed to browse through the Zope tree? I could have users > install a method, but this is a very generic need (browsing the > object tree) and should be built in. Steve Alexander <steve(a)cat-box.net> chimed it: > It occurs to me that there are two distinct "views" of the Zope tree. > > 1. The developer's / content manager's view > > This is what we have now. > > 2. The end-user's view > > Taking HTTP as an example, this consists of the set of URLs that > are available for access via the web. Other URLs should return a > 404 Not Found, even if they are available as part of the > developer's view (point 1). > > Taking HTTP alone, for simplicity of expression; I suppose what I'm > asking for is that there are two HTTP servers for one Zope instance. > The one on port 80 (for example) only responds to those URLs that are > for public viewing. The one on port 8081 (for example) responds to > any request that makes sense to map onto an object or attribute. > > The same scheme can be applied to FTP -- you choose whether a > particular FTP server presents the "public" view, or the "developer" > view. I'm presuming you mean to disallow anonymous access to the "developer" view -- otherwise, you have just transferred the "security-through-obscurity" to another location. Providing dual HTTP servers is actually useful in another way -- it allows you to both develop and test from within the same browser session, without sharing credentials. Patches accepted :) (hint: look at how z2.py initializes the HTTP server). Tres. -- ========================================================= Tres Seaver tseaver(a)digicool.com Digital Creations "Makers of Zope" http://www.zope.org

3 2

RE: [Zope-dev] Methods through the Web (security?)
by Brian Lloyd 18 May '00

18 May '00

> How come you can browse things like the objectIds and objectValues > methods through the web? Surely this is exposing information > that people > shouldn't really know about? You're right - and stop calling me shirley. :) This is something of a holdover from the bobo days - if you are a method and you have a docstring, you are accessible through the web (but still subject to the std security rules). objectIds and objectValues are a good example of things that really only want to be used from DTML and thus shouldn't have docstrings. I've changed this (and a few other iffy methods) for the next release. > While I'm at it, is there any way to make DTML methods accessible to > objects (such as other DTML methods) but not through URLs > other than by > a tortuous series of proxy roles? > I've expressed views about an 'execute' permission in the > past but these > have fallen on deaf ears. > > For example: > http://www.codecatalog.com/standard_html_footer > > This is messy and there's no reason why it needs to be > exposed through a > URL. I don't have a good answer for you, though I tend to agree with you that some things just don't want to be accessed outside of some larger context. I'd like to hear some different viewpoints on how people think something like this should work... Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

5 5

Re: [Zope-dev] a simple example of the ZPatterns frame work
by Jephte CLAIN 18 May '00

18 May '00

"Phillip J. Eby" a écrit : > > At 08:39 PM 5/17/00 +0400, Jepthte CLAIN wrote: > > > >I wonder if someone can send me a simple example using the ZPatterns > >framework. I read all the source, and I still can't figure out what is > >the relationship between the objects instantiated by the Racks and the > >Rackmountable objects. Also, why do the rack try to instantiate a > >ZClass??? > > When created, Racks create some default Attribute and Sheet providers. > These objects are used by Rackmountables to access data which is not stored > directly in the rackmountable. Indeed, attribute and sheets are not stored in the rackmountable. Where are they stored then? in the specialist? in the rack? reading the code does not help to answer that question. > > When used, Racks create instances of the ZClass you've specified. If you > call newItem(key), you will receive a new instance of that ZClass, which > will be stored in the rack under the specified key. Whenever you call > getItem(key), the instance will be retrieved. Some Racks, like > GenericUserSource, do not store items in themselves, but in external > databases. When you call getItem(key) on a GUS, it calls methods to access > the external database, then creates an instance of the appropriate > LoginUser subclass and returns that. > I don't like ZClasses, because I want to use XEmacs to edit my code. In fact, I have trouble using a python class to store my data. say I have in MyItem.py: class MyItem(RackMountable, Item): "" meta_type = 'My Item' def __init__(self, id): self.id = id self.i = 0 self.s = '' and in __init__.py, MyItem is registered as a z base class i and s are properties my objects are going to store. I would like to use MyItem objects until I am ready to move the data into an SQL database, where i and s will be columns in a table. The AttributeProvider (that my rack have by default) raise an exception in MyItem.__init__ because i and s do not exist (indeed, I want to create them in the instance!) Also, say I want to add the OFS.ProperyManager.PropertyManager mixin class to MyItem to manage my properties through the standard interface. Will it clash with the sheet provider? > Hope that helps; I'm not 100% clear on your question. Anyway, my question was not 100% clear neither :-) I'm not interested in the ZPatterns framework to allow my customers to customize the data sources or the collaborators. I'm interested in it because I want to develop code that is independant of the data sources. I want to store some data in the ZODB (because they are python list and dict, or because it is easier for me to use Zope objects until I move to a SQL database), and some of them in an SQL database (because they might be used by externals applications), but still want to have a common interface to the data. I'm still figuring out how it works, but once I'm done, I will rule the world :-) Thanks for your good work, and thanks for the advices! regards, jephte clain minf7(a)educ.univ-reunion.fr

2 1

Strange ZClass permissions problem with 2.2a1
by Dr. Ross Lazarus 18 May '00

18 May '00

I'm testing 2.2a1. I have some ZClasses which work fine in 2.1.6. I copied my Data.fs to the new 2.2a1 install. As a non-superuser I have taken ownership of the top level of the site. When I try to access a zclass instance which uses manage_tabs in it's index_html method, I get the traceback shown below. The relevant code is checking that the containerbase is not the accessedbase whatever they are! If I take out manage_tabs from the offending ZClass index_html method, I can view index_html (but of course, I can't use the management stuff built in! making it rather useless), so that's where we're getting into trouble for sure. I've tried starting out with a vanilla 2.2a1 Data.fs and importing all the zclasses and the relevent folders - no difference. Anyone else seeing this? Is this worthy of the collector? Traceback (innermost last): File /usr/local/zope/zope22a1/lib/python/ZPublisher/Publish.py, line 224, in publish_module File /usr/local/zope/zope22a1/lib/python/ZPublisher/Publish.py, line 189, in publish File /usr/local/zope/zope22a1/lib/python/ZPublisher/Publish.py, line 175, in publish File /usr/local/zope/zope22a1/lib/python/ZPublisher/mapply.py, line 160, in mapply (Object: index_html) File /usr/local/zope/zope22a1/lib/python/ZPublisher/Publish.py, line 112, in call_object (Object: index_html) File /usr/local/zope/zope22a1/lib/python/OFS/DTMLMethod.py, line 160, in __call__ (Object: index_html) File /usr/local/zope/zope22a1/lib/python/DocumentTemplate/DT_String.py, line 500, in __call__ (Object: index_html) File /usr/local/zope/zope22a1/lib/python/App/special_dtml.py, line 121, in __call__ (Object: manage_tabs) (Info: /usr/local/zope/zope22a1/lib/python/App/manage_tabs.dtml) File /usr/local/zope/zope22a1/lib/python/DocumentTemplate/DT_String.py, line 500, in __call__ (Object: manage_tabs) File /usr/local/zope/zope22a1/lib/python/DocumentTemplate/DT_With.py, line 146, in render (Object: _(manage_options=filtered_manage_options())) File /usr/local/zope/zope22a1/lib/python/OFS/DTMLMethod.py, line 180, in validate (Object: index_html) File /usr/local/zope/zope22a1/lib/python/AccessControl/SecurityManager.py, line 139, in validate File /usr/local/zope/zope22a1/lib/python/AccessControl/ZopeSecurityPolicy.py, line 160, in validate Unauthorized: manage_options -- Dr Ross Lazarus Associate Professor and Sub-Dean for Information Technology Faculty of Medicine, Room 126A, A27, University of Sydney, Camperdown, NSW 2006, Australia Tel: (+61 2) 93514429 Mobile: +61414872482 Fax: (+61 2) 93516646 Email: rossl(a)med.usyd.edu.au

2 1

RE: [Zope-dev] Zope and SMP
by Jens Vagelpohl 18 May '00

18 May '00

hi thilo, the scaling problem comes from the overhead of switching python threads when they run on 2 CPUs. one strategy, if your OS allowed it, would be to force the python process onto a single CPU. sunOS/solaris allows you to do so if i remember right. you're a little luckier if you actually run 2 zope instances on the machine (like i do on an old pentium 166 at home), at least on linux, which does not allow you to set processor affinity, this will force each python process onto a single CPU. what you definitely might want to try is a fix that matt kromer here at digital creations came up with. the technical background is that python has a built-in timer that controls how often python checks on all its threads and, if needed, switches from one to another. if you increase the interval on this timer you will decrease the number of thread switches, thereby speeding up your zope installation. to apply it to your own zope install open z2.py in your zope root directory and add the following line just before the comment that starts the "Configuration section" (roughly around line 220): sys.setcheckinterval(50) the best number given as argument to setcheckinterval is something you could find out by benchmarking. 50 is what i use on my site, and compared to two standard zope 2.1.6 instances running i gained about 100% in speed. this fix is becoming part of zope 2.2.0, as far as i know it is already in the alpha and brian lloyd decided on 120 as a good number for starters. again, to see the best results you might want to try different numbers and benchmark the site with e.g. ab. hope that helps jens ---- Jens Vagelpohl jens(a)digicool.com Software Engineer www.digicool.com Digital Creations (888) 344-4332 Got Zope? ---- -----Original Message----- From: zope-dev-admin(a)zope.org [mailto:zope-dev-admin@zope.org]On Behalf Of Thilo Mezger Sent: Thursday, May 18, 2000 03:21 To: zope-dev(a)zope.org Subject: [Zope-dev] Zope and SMP hi! yesterday, i have test-driven zope on a dual-pentium smp-machine running linux 2.2 and i was very disappointed by the results. the zserver threads are running on both cpu's but it seems to scale really, really badly. i have only done some very cheap benchmarking but it seems that a single cpu is faster than 2 cpu's. but as i said, this is not proper benchmarking (yet). i wanted to ask if someone has already tried zope on more than 1 cpu and/or could point me to a direction where i could find out more about this subject? cheers! thilo -- thilo.mezger(a)innominate.de innominate AG networking people fon: +49-30-308806-0 fax: -77 web: http://innominate.de pgp: /pgp/tm _______________________________________________ Zope-Dev maillist - Zope-Dev(a)zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )

1 0

Frames and Zope
by Sin Hang Kin 18 May '00

18 May '00

Hi, I am working at a search form and trying to display the result in one of the frame newly created. I just realize by putting the <dtml-var REQUEST> instead of the code into the frames, the variables were all gone. I recall that zope take account to different browser section, did this related to my problem? If the user require login to perform something, is this means If i split a browser into three frames, all three frames need to login again? Rgs, Kent Sin --------------------------------- kentsin.weblogs.com kentsin.imeme.net

1 0

a simple example of the ZPatterns frame work
by Jepthte CLAIN 18 May '00

18 May '00

Hello, I wonder if someone can send me a simple example using the ZPatterns framework. I read all the source, and I still can't figure out what is the relationship between the objects instantiated by the Racks and the Rackmountable objects. Also, why do the rack try to instantiate a ZClass??? I'm lost. The LoginManager code does not answer my question because the generic user source does not instantiate any object. comments ? Regards, Jephte CLAIN minf7(a)educ.univ-reunion.fr

3 2

Trouble setting LoginManager default user class
by Dan L. Pierson 17 May '00

17 May '00

I'm trying to port the PTK PersistentUserSource stuff to the new LoginManager. A lot of things seem to be working, but I seem to have fallen into a Catch 22: 1. UserSources.BasicUserSource defines self._defaultClass as LoginUser, where UserSources.LoginUser is a simple RackMountable class (not a ZClass) defined earlier in the file. 2. PTK requires DemoPortal.LoginMember, a ZClass that inherits from LoginUser and PersistentUserSource.MemberMixin (actually, it's having the MemberMixin stuff that's crucial). 3. Rack._v_itemConstructor is a ComputedAttribute that looks at self._defaultClass: if it's a class, it uses it, if it's a string it looks in Products.meta_classes[self._defaultClass] for the class to use. So PersistentUserSource needs to change _defaultClass to refer to DemoPortal.LoginMember. If I try to do it by using a ComputedAttribute: def _defaultClass(self): c = Products.DemoPortal.LoginMember self._defaultClass = c _defaultClass = ComputedAttribute(_defaultClass) I get an error traceback from an AttributeError in Rack.createItem for _v_itemConstructor. BTW: this also happens if I also define _v_itemConstructor as a ComputedAttribute in PersistentUserSource. I need something like ComputedAttributes here, because DemoPortal doesn't (necessarily?) exist at the time PTKDemo is installed. If I try to do it by setting _defaultClass to 'LoginMember', it fails because 'LoginMember' isn't in Products.meta_classes. In fact nothing relating to DemoPortal or any other ZClass product is in Products.meta_classes! The official way to get into that dictionary appears to be to call registerBaseClass or registerZClass. registerZClass would seem like the correct method, but the ONLY call of this is in Products/OFSP/__init__.py for ZClasses.ObjectManager.ZObjectManager. Should ZClass products be registering themselves? If I try to set _defaultClass in PersistentUserSource.__init__. I can't figure out how to refer to /Control_Panel/Products/DemoPortal/LoginMember from there. Looks like I need more Zen. Please enlighten me. Dan Pierson

4 5