- Zope-Dev - Zope lists

RE: [Zope-dev] feedback wanted on ZCatalog changes...
by Michel Pelletier 27 Jan '00

27 Jan '00

> -----Original Message----- > From: Anthony Baxter [mailto:anthony@interlink.com.au] > Sent: Tuesday, January 04, 2000 6:27 PM > To: Michel Pelletier > Cc: zope-dev(a)zope.org > Subject: Re: [Zope-dev] feedback wanted on ZCatalog changes... > > > do you think? Can you reproduce a security violation with > your patch? > > Nope. Not in my application. In _theory_ I can see that you could > have a security problem if you weren't aware that the indexing > occurs in the context running the findandapply request - but then, > it does already (see above). Heck, you could even make it a toggle > option in the page 'index acquired objects'. Ok, this is a good compromise. I'll put a checkbox on the find form and add some logic to the find method to either acquire or not. > [*1] go to www.ekit.com, sign up for an account (about 3 clicks) then > click on 'help'. The tree on the left is populated from > ZCatalog searches, > which amongst other thing only show help for the stuff your account is > able to do, the search box is a textindex of the files (which, again, > only searches the help for stuff your account can do), and > the lookup of a > help document (like, when you click on a help link) will hit > the ZCatalog > to look up the file's path. The help files themselves are > maintained by > a non-techie in dreamweaver, and uploaded into zope. > ZCatalogs rock :) Thanks! -Michel

2 1

CorruptedTransactionError on Data.fs
by Bruno Mattarollo 26 Jan '00

26 Jan '00

Hello, We have this traceback on a Zope 2.0.1 running a Solaris 7 Sparc machine with all the lastest patches. [bmatt@izote iPersonal]$ ./start [bmatt@izote iPersonal]$ Traceback (innermost last): File "/export/home/bmatt/iPersonal/z2.py", line 375, in ? exec "import "+MODULE in {} File "<string>", line 1, in ? File "/export/home/bmatt/iPersonal/lib/python/Zope/__init__.py", line 109, in ? DB=ZODB.FileStorage.FileStorage(Globals.BobobaseName) File "/export/home/bmatt/iPersonal/lib/python/ZODB/FileStorage.py", line 287, in __init__ self._pos, self._oid, tid = read_index( File "/export/home/bmatt/iPersonal/lib/python/ZODB/FileStorage.py", line 1165, in read_index panic('%s has invalid transaction header at %s', name, pos) File "/export/home/bmatt/iPersonal/lib/python/ZODB/FileStorage.py", line 214, in panic raise CorruptedTransactionError, message ZODB.FileStorage.CorruptedTransactionError: /export/home/bmatt/iPersonal/var/Data.fs has invalid transaction header at 15217920 Is there a way to correct this? Should I overwrite the whole Data.fs with the backup we have? TIA /B Bruno Mattarollo <brunomadv(a)ciudad.com.ar>

1 0

Re: [Zope-dev] External Method Return value?
by Clayton Miller 26 Jan '00

26 Jan '00

Chris, Thanks for the timely response. What I am trying to do is to replace some code that use to be like: someDTMLmethod -------------- dtml-in "someSQLmethod(anyParams)" <dtml-var FIELDA>, <dtml-var FIELDB> /dtml-in someSQLmethod ------------------------- select FIELDA, FIELDB from some Table ... I am attempting to replace this with an external method like: someDTMLmethod -------------- dtml-in "someExtmethod(anyParams)" <dtml-var FIELDA>, <dtml-var FIELDB> /dtml-in someExtMethod ----------------------- results = self.someSQLmethod(anyParams) """ further processing of results into new results """ return newresults someSQLmethod ------------------------- same as above How do I get the tuples(python return value) to work as the same type of results(old SQLMethod) to the dtml-in? Clayton ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

3 2

Thoughts on wysiwyg 'object based' editing (once again)
by Jerry.Spicklemire＠IFLYATA.COM 26 Jan '00

26 Jan '00

Rik has some interesting observations regarding the depth of a present generation browser's "awareness" of the components that make up a Zope rendered html "page", which is to say nearly none. But isn't this exactly what XML solves for us? An XML document, even after browser rendering (not to be confused with the Zope server side composition stage), is still made up of discrete XML objects, and thus selectable, editable, etc. The beauty of this concept isn't so much that Zope / Python simply can't do all this by itself, we all know that Zope / Python (Grail?) can do anything short of levitation*. Rather the point is simply that XML is a well accepted, existing standard, and is bound to be supported in popular browsers. FWIW, Jerry S. * I missed the conference, so this is subject to updating ;-)

2 1

Thoughts on wysiwyg 'object based' editing (once again)
by Rik Hoekstra 26 Jan '00

26 Jan '00

Wysiwyg Zope editing possibilities has come up in the list more than once. Unless I understand the Zope Mozilla project wrongly seems to be no solution, let alone a standardized one, as Johann Carlsson (the inventor of ZIE) is using XML-RPC for editing. Now I may be completely mistaken here, as I only half understand everything that has been going on. If so, flame me, and stop reading. If not, read on, and please bear with me, cause this turned out to be a lengthy analysis. The question of wysiwyg comes up on the list frequently, though. And it is certainly not solved, let alone in a portable way. The question of editing and the apparent difficulty of rendered editing vs source editing has been proposed as a fundamental objective to editing Zope html documents/objects ;-) in wysiwig editors. Let's for a second leave aside, whether wysiwyg editors are at all desirable and which. After pondering the question for some time I _think_ I may have a solution. It was triggered by an article of John Aycock and Michael Levy, "An Architecture for Easy Web Page Updating" in Crossroads <URL: http://www.acm.org/crossroads/xrds6-2/updating.html>. They state that the 'atomic document' is a myth and that 'a document is the fundamentally wrong level of abstraction for web page updating'. Then they go on to an architecture which breaks apart a document into editable regions and store these into a dbm-database. The documents are retrieved through a http like protocol (called UTTP and invented by the authors) and edited in a special client. Aycock and Levy's proposal sounded to me as if Zope has provisions for most of this already, but I would propose this could also be achieved through a web-based system. A dtml document is already composed of 'sections' (namelijk html and dtml sections). They can seen as a collection of objects (both real zope objects and section objects) that are together rendered as a html/xml/pdf/whatever document. The dtml object is -in fact- divided into 'inside-document' and 'outside-document' sections. All <dtml-var> related tags are 'outside document' sections and the other <dtml-...> tags are 'inside-document' sections. That is to say, the var tags _themselves_ are inside document, their content is outside document. At the moment, the sections are not visible inside the rendered document. Moreover dtml always either renders the whole document, or it does not, except for the inclusion of <dtml-var>'s that are called as 'not rendered'. >From a site-development point of view the different sections are editable by people with different abilities. In Zope terms these abilities are translated into roles: content managers and designers, dtml programmers, sql programmers. Content managers should not be bothered with dtml, programmers should be programming one object at a time. An example: a content manager or designer should not have to be able to edit <dtml-if> tags or occupy himself with namespace issues. It _is_ nice for him to see what other content there is on the page he is designing for and what layout he is designing in. If he uses a wysiwyg editor _and_ a the site has a global stylesheet, it would be a good idea if the stylesheet was included at the time of entering content. The server (Zope) should handle that. What stands in the way of making sections editable is not, in my analysis, the dichotomy between document and object, but the fact that in developing in Zope you are dealing with either rendered documents or non-rendered objects/dtml-templates and never with partially rendered document/template hybrids. Or, in fact you are: the Zope management interface where you edit, say, a DTML Document, _is_ such a hybrid: the management interface itself is rendered while the document is not. The hybrid is just not extended beyond the boundaries of the dtml-template. But there is no real reason to do so as (1)Zope encourages factoring common content and (2) a document is in fact a collection of objects or regions. Because and as long this is so, Zope editing is confined to the dichotomy. What should be done to overcome the problem (an example is under the points> is (as I see it) to 1. devise a way to indentify sections in rendered documents. This could be done by making the rendering machinery mark the begin and end of a tag in the rendered version. 2. devise a way to treat sections as objects and make the objects editable _or_ rendered on basis of the roles of an developer. As far as I can distinguish it, this involves the following steps, but please correct me if I'm mistaken or : * Rendered and non-rendered sections should be included in one document. * Only non-rendered objects should be designated as editable. * Rendering (in editing view) is conditional on (1) the role of the current user (manager, content manager, designer etc)) (2) the needs of that user. In other words: the 'editing view' of a dtml object should show a user: a) which parts of a dtml template would be editible to him and b) he should be able to choose whether to render these object/sections or to edit them. * Outside-documents should alway be fully rendered. They should be treated as atomic. * This obviously means that the updating/uploading machinery should also be able to discern between the editable and non-editable sections. For this a simple block parsing mechanism (possibly derived from the dtml parser itself) should be used. * In order to keep track of what sections/objects of the document in question to update the uploading machinery should have knowledge of what was sent to the client (in whatever form). This will probably be the hardest part to figure out. It could be done by cookies, by including rdf in the document or in its header, and/or by editing in a session-like environment. What could and should be done in this case depends on the client that is used for editing. Therefore, the basic machinery should be the same, but it should have a possibility to plug-in different client-specific interfaces. This seems a very Zopish way to treat the problem. * A few thoughts/proposals for the Zope management interface: in the conventional Zope management interface this could easily be done by including textareas on the spot where an editable object is located. Or the document would be presented as a tree to the user, much in the way XMLDocument is now. This would also allow us to have 'collapsable regions' like many programming editors have (or at least this should be possible in the Zope Management interface and in Mozilla). pff. That was much more than I anticipated. I hope I have made my point clear. I wanted to discuss this, before I gave the idea a shot. A few questions beforehand: - is this a sensible approach to solving the rendered document vs object dichotomy - if so, what would be the best way to implement this? I was thinking of a product that would be called whenever the edit view of a dtml object was called. The product would handle the whole round trip from rendering to updating/uploading, including the parsing of the object. Is this feasible, or did I oversee something that would imply a much deeper reworking of the Zope machinery? I now realize that the whole bunch of developers is out on IPC8 (or stuck in the snow). Perhaps I should put this on my member pages... Rik

1 0

Re: [Zope-dev] Authentication Patch
by Anthony Baxter 26 Jan '00

26 Jan '00

>>> "Evan Simpson" wrote > > Hm, in that case, wouldn't that then just recurse back through > > the parent folders looking for additional access controls? > > Exactly :-) This can allow authentication to succeed at a higher level, > while still giving you the nice inner Login page if it fails at all levels. > > This isn't necessarily desirable in all cases, and you can't even *get* a > basic authentication dialog when there's an inner cookie-based acl_users > unless you define a method which explicitly throws 'LoginRequired'. It's > still an improvement on the current default situation, though. Should auth behave this way, tho? Should a top level acl_users take precedence over a lower level one? Doesn't that kill the ability of a manager of a subfolder to delegate control to their own users? Anthony

2 1

Zope Futures
by Jeff Nielsen 26 Jan '00

26 Jan '00

I'd like to chime in on this futures discussion. Let me start with a short background: I developed a site using IIS as the web server, Zope as the application server and SQL Server 6.5. I used a combination of IIS and Zope to address a couple of issues (Zope database access is much easier than IIS, and IIS can track session variables, while Zope, at that time, didn't. Zope also did not log, to my knowledge, at that point). My goal is to make a commercially successful web site, not to muck around with new technologies. In the second generation of my web site, I want to simplify things by eliminating either IIS or Zope and use just one technology. I'm intrigued by the object-oriented nature of Zope and the benefits it brings, but I'm also wary of the things that I've found difficult about Zope. In the future, I'd press to develop those things that make Zope a complete production-ready web system and less of a geeky toy. To wit: 1. Complete , timely, non-overtly technical documentation. The Zope Quick Reference has been a God-send recently 2. Strive for completeness in the whole package; a complete help system, a strong IDE (Zope Studio sounds intriguing), good installs for Zope and add-ins. Don't just launch new technology without the supporting materials. 3. Feature names and terms that are self-apparent and not techno-cute. Especially, go easy on the Zeverything names in favor of more useful, self-descriptive names. I believe that Zope is adequately powerful to do most any job, we just need to make that power easier to access. Jeff ----------------------- Jeff Nielsen http://www.UgoFast.com/ "Where U Go Fast"

1 0

embed java script
by vvchen 26 Jan '00

26 Jan '00

Hi I don't know howto embed java script like this in zope <body bgcolor="#FFFFFF" topmargin="0" leftmargin="0" marginheight="0" marginwidth="0" onLoad="MM_preloadImages('images/nav2.gif','#945291788790')"> http-url in function argument maybe someone can tell me thanks

2 1

REQUEST placement in a file
by Andrew Edmondson 25 Jan '00

25 Jan '00

The following code fails: <dtml-with "manage_addProduct['product <dtml-call "REQUEST.set('id','S'+Immutable_id)"> <dtml-call "REQUEST.set('Immutable_id','S'+Immutable_id)"> <dtml-call "REQUEST.set('Related_Discussion','S'+ Related_Discussion)"> <dtml-call "my_Document_add(_.None,_)"> </dtml-with> with the error: ValueError: <HTML><HEAD><TITLE>Docs</TITLE></HEAD> <BODY BGCOLOR=00ccff> <center>ZOPE CLIENT ON Rameus</center> <TABLE BORDER="0" WIDTH="100%"> <TR VALIGN="TOP"> <TD WIDTH="10%" ALIGN="CENTER"> <IMG SRC="http://localhost/Zope/fastcgi/p_/ZButton" ALT="Zope"> </TD (File: /usr/local/ZOPE2.1.2/lib/python/OFS/DTMLMethod.py Line: 370) 500 Internal Server Error for http://localhost/Zope/fastcgi/RAF5/Docs/add_replicatedDocument (This method is called through the ZPublisher Client, from a python script, which is why there isn't a more informative error message...) However, the following code runs fine: <dtml-with "manage_addProduct['product <dtml-var REQUEST> <dtml-call "REQUEST.set('id','S'+Immutable_id)"> <dtml-call "REQUEST.set('Immutable_id','S'+Immutable_id)"> <dtml-call "REQUEST.set('Related_Discussion','S'+ Related_Discussion)"> <dtml-call "my_Document_add(_.None,_)"> <dtml-var REQUEST> </dtml-with> Can anyone explain the problem here? -Ed

1 0

(no subject)
by vvchen 25 Jan '00

25 Jan '00

Hi All Who can tell me how to embed a quicktime movie in zope. I try to code it like this <embed src="QuickMovie" width="179" height="280" autoplay="true" cache="true" controller="true" correction="full" kioskmode = "true" pluginspage="http://www.apple.com/quicktime/download/" border="1" type="video/quicktime">. But Result is display binary code in screen. I wish somebody can tell me how to. Thanks a lot

1 0