- Zope-Dev - Zope lists

hello
by 3dalbert_uy＠abs-cbneu.com 28 Jun '04

28 Jun '04

you are sexy in this doc!

1 0

Re: CatalogBrains since Zope2.7.1b1
by Santi Camps 27 Jun '04

27 Jun '04

Optional arguments will still allow untrusted code to bypass security checks. Yes, that's true. Here are three solutions to this, two of which do not involve catalog changes: - Use a proxy role on the script that invokes getObject which grants the permissions needed. - Use self.unrestrictedTraverse(brain.getPath()) from trusted code - Add a private method: unrestrictedGetObject() to the catalog brain API which does no security checking, but is inaccessible to untrusted code. I think the last one is a good idea and I will implement it. The other two are available options for now. Ok, I think it will be useful. Until then, the second option is a good solution for me. Thanks a lot for the suggestion. Regards Santi Camps

1 0

Why are width and height strings?
by Terry Hancock 26 Jun '04

26 Jun '04

I've run into a weird problem with product development (VarImage product): Since I inherit from Zope's 'Image' object, I get and use its width and height attributes -- which I blithely assumed were integer properties. But they're not -- they're strings. (At least in Zope 2.6.4 they were). Why? There doesn't seem to be any logical reason for that, since the only sensible values are integer numbers. Things get weird when you set them to integer values and then try to use Zope's management screens to set them, which I'm currently trying to fix as a bug in VarImage. Is there some compelling reason why they should be strings? I'm thinking about overriding this, because it doesn't make any sense to me, but I'm curious if there was a rationale behind it (and whether I'm creating a whole new group of bugs if I do that). Cheers, Terry -- Terry Hancock ( hancock at anansispaceworks.com ) Anansi Spaceworks http://www.anansispaceworks.com

1 0

Popular software at low low prices
by peter 26 Jun '04

26 Jun '04

1 0

V1AGKRA 80% DISCOUNT !!
by Lincoln Helton 26 Jun '04

26 Jun '04

1 0

Business Relationship
by MR FREDRICK NKOSI 26 Jun '04

26 Jun '04

NAME-FREDRICK NKOSI EMAIL ADDRESS-FRED_NKOSI32ZAYAHOO.CO.UK PHONE NUMBER-+27-73-3655055. Attention: Chairman/CEO My name is Mr. Fredrick Nkosi, the stepson of Mr. Terry Ford of Zimbabwe. It might be a surprise to you where I got your contact address, I got it from the internet business Index and further information indicated you to be a capable and responsible person. It is for this reason I am contacting you and I will appreciate that you are not unduly worried because I am contacting you in good faith. As you may be aware of that there is a crisis against the white Plantation farmers of Zimbabwe by the supporters of our President Robert Mugabe to claim all the white owned Farms in our country, he ordered all the white farmers to surrender their farms to his party members and their followers. My stepfather was one of the best tobacco farmers in the country who believed in equitable sharing of wealth but opposed to the government policy of forceful seizure of Land. Unfortunately he paid the supreme price for his belief as supporters of the president invaded my father's farm and Burnt down everything. Sadly he was killed in this incident. After the death of my step-father, my mother and I with my younger sister decided to move out of Zimbabwe for them safety of our lives. We took along with us the money my stepfather kept in the safe in my mother's house which amounted to the sum of US$15.5 Million to the Republic of South Africa where we have deposited it as personal valuables in a private Security Company for safekeeping. Because of our present status being Political Refugees and our desire to leave Africa entirely, my mother and I are seriously looking forward to having an overseas partner That will assist us with the convenient and legal transfer of the funds out of South Africa. We agreed that if you consider assisting us in the safe Transfer of the funds out to your country we are willing to offer you 20% of the total fund and 5% of the total will be set aside to cover any expenses incurred during this Transaction while the remaining 75% will be for my family which we wish to invest under your guidance and supervision. I will appreciate you confirm the receipt of my message Indicating your willingness to assist my family. For Detailed information, you can contact me on my direct line + 27-73-365-5055. Please note that your confidentiality in this matter is Very important for our safety while praying your assistance Will bring us the so much needed succor that will make this Terrible experience a thing of the past. Yours faithfully, Fredrick Nkosi

1 0

Re: Re: [Zope-dev] CatalogBrains since Zope2.7.1b1
by Eric Brun 25 Jun '04

25 Jun '04

My object really exist and I check the getPath path : it's a correct path. When I use CatalogBrains.py of Zope2.7.0 on a Zope2.7.1b1, my object is correctly returned. The changes in the version of CatalogBrains.py in Zope2.7.1b1 can't find my existing object with a good path. I think there is a problem here. I just alert a potential bug for the zope-dev community. Sorry for my english thanks for your answers > Eric Brun wrote at 2004-6-16 11:16 +0200: > >I have a problem with 'getObject' method of CatalogBrains class on Zope271b>1 : it's return None. But with a Zope2.7.0 > >my object is correctly find and returned. The permissions are right. > > > >is there any bug here ? > > They return "None" when the object no longer exists. > > Check the path ("getPath" method) and verify whether the object > exists. > > -- > Dieter > Eric Brun Ingénieur de développement eric.brun(a)pentila.com Pentila Bâtiment Euclide 73370 Le Bourget du Lac Savoie Technolac http://www.pentila.com

4 6

Specific Qs about diffs btw Zope 3 & Zope 2.x (2.7, etc)
by Eric Hielscher 25 Jun '04

25 Jun '04

Hi, I'm trying to decide which version of Zope would work best for a project on which I've been assigned to work. I've personally had no contact with Zope before yesterday when I downloaded 2.7.1 and 3.0.0b1 to start playing around a bit. The project involves a web page where users can upload files of a specific format (zipped SCORM-conformant e-learning files to be exact). The system would then rip out all of the meta data and perhaps the full text of the files in the zip and index them for searching. The MD is in XML, but we'd also perhaps like to support RDF and some others like RSS. Each file in the system would then be linked to the MD by some sort of GUID-equivalent. Then the users could search the MD and text and the system would return a results list, and afterward repackage their content. Now, I've been asked to decide which version of Zope would work better for this. I would think that native XML support (which I read will be better in 3 but don't understand how yet) would be a huge plus. Also, the new ObjectHub replacement for the ZCatalog might really help me. Zope's native authentication services have also been given a huge overhaul and we'd like to leverage those as well. I was hoping that someone out there with better in-depth knowledge of Zope would be able to read this list of reqs and be able to tell me in (semi-)detailed fashion just why 3 or 2.x would be a better decision. Thanks all for your help, Eric Hielscher

2 1

Re: zope-dev list policies
by Casey Duncan 25 Jun '04

25 Jun '04

-1 on changing the list policy. I read and post to all of the public lists through Gmane, which won't work if the policy is changed. I rarely see spam get through list either (unless Gmane is filtering it all out for me), so I fail to see the problem from that point of view. -Casey On Wed, 16 Jun 2004 21:24:07 -0400 "Tim Peters" <tim.one(a)comcast.net> wrote: > Over on the zope and zope-dev lists, there's currently agitation to > make them members-only mailing lists. The point is that spam could > not get thru then (unless posted by a member). > > What would zodb-dev members like? > > Posting by a list member would not be affected, unless you attempted > to send a message from an email account other than one you subscribed > with. In the latter case, your message would be bounced back to you. > > You could worm around that by subscribing to zodb-dev with that > address too, then going to your list membership page on the web and > checking the box to suspend email delivery on that account. Then you > could post using that account too, but wouldn't also get zodb-dev > email on that account. > > I'm the list admin for zodb-dev, and don't have a preference. If you > do, and it's strong enough to scream it, shout. The loudest screamer > will win<wink>. By default, I won't change the current policy (anyone > can post here, member or not).

5 6

Re: Re: CatalogBrains since Zope2.7.1b1
by Santi Camps 25 Jun '04

25 Jun '04

"Security was tightened for getObject recently as part of a general refactor of that code. I am happy to consider whether the security is too tight, in which case it could be backed off a bit. Previously getObject performed no security checks and returned objects for catalog results regardless of security permissions (it used unrestrictedTraverse). I switched it to use restrictedTraverse which checks security all the way down on all of the containing folders and on the final object itself. This is how path expressions work, for example." I think this new security checks could be a problem in some cases. They are Ok when using restricted code, but from trusted code I'm not sure that force to use restrictedTraverse could be considered a goal. For instance, imagin an application with employees of one department managing dossiers with economic data inside. Employees of accounting department shouldn't have access to these dossiers objects, but they need to obtain some reports with a sum of all dossiers economic data. So, accounting department users shouldn't have access to dossiers objects, but from reports trusted code these dossiers need to accessed. I think a possible solution could be an additional optional parameter of .getobject used from trusted code when unrestrictedTraverse want to be used. What do you think ? Regards Santi Camps

2 1