- Zope-Dev - Zope lists

permissions on a python script...
by scripts-urban＠imeme.net 24 Nov '03

24 Nov '03

when I call my form processing script from a form action zope prompt me for a password I have fiddled with both the owner and security settings, with no success Any and all advice welcomed -thanks again -josh

3 3

New-style ExtensionClass, ZODB 3.3, and Zope 2.8 status
by Jim Fulton 24 Nov '03

24 Nov '03

I spent what turned into a couple of weeks on new-style ExtensionClass (NSEC). This is a reimplementation of ExtendionClass as a new-style type. Actually, ExtensionClass.ExtensionClass is a subclass of type and ExtensionClass.Base is a subclass of object whose type is ExtensionClass.ExtensionClass. :) NSEC combines the features of ExtensionClass: - __of__ - __class_init__ - inheritedAttribute - traditional method-lookup order (for better or worse) with the features of new-style classes, including: - descriptors, - slots, - garbage collection NSEC is mostly backward compatible with old ExtensionClass. The major backward incompatability is that method attributes are handled differently. Unlike old EC, NSEC doesn't provide it's own method type. It uses standard Python methods. Old EC methods got their attributes from theor instances by combining their names with the attribute names. For example, if you ask for the '__roles__' attribute on a method named 'foo', the method will try to get the value my looking up the 'foo__roles__' attribute on the bound instance. Standard Python methods don't have this behavior. They get their attributes from their underlying functions. This has major implications for Zope 2's security machinery. More on this later. A few months ago, Jeremy Hylton and Tim Peters created a version of ZODB 3 that didn't use ExtensionClass. This was refered to as "ZODB 3.3" and was implemented on the zodb33-devel-branch (pronounced "devil branch" ;). I've extended this branch to all of Zope and integrated NSEC into the branch. Despite it's name, this branch should be thought of as the Zope 2.8 development branch. Work is underway to add multi-version concurrency control (no read conflicts :) to ZODB 3. This work is underway and will land in ZODB 3.3. During the time working on this, a plan for Zope 2.8 emerged that I think is pretty reasonable. Zope 2.8 will include: - NSEC - ZODB 3.3 and whetever other changes happen to be made while the work on NSEC and ZODB 3.3 is progressing. Currently, on the zodb33-devel-branch, Zope 2 runs and the great majority of it's tests pass with NSEC and ZODB 3.3. It you'd like to see this in action, feel free to check Zope out on the branch and play with it. I'm anxious to get this work merged into the Zope 2 CVS head, but have run into a problem that has stopped me for now. After 2 weeks, I really needed to get back to work on Zope 3. Gory details The issue preventing me from finishing this work is that a significant (though not massive) refactoring of the Zope 2 security machinery is needed to accomidate NSEC. This happens to be a refactoring that is loooong overdue. (It should have been done before Principia was created.) Long ago (even before Principia), our security model consisted of users, roles and objects. Objects required roles. Users had roles. To provide greater control, we added another layer of indirection: permissions. Now, object's require permissions to be accessed. Roles are granted permissions. Users are assigned roles. When we introduced permissions, we didn't want to refactor existing code, so we created permission-roles. Permission roles are complex computed attributes. When you access a __roles__ attribute on an object, a complex computation, making heavy-use of acquisition, is performed by to find all of the roles that have the required permission for the object. What can I say, this is a travesty. :) When we ask for the __roles__ of a method of an old-style ExtensionClass instance, the method turns around and accesses an attribute on the instance, triggering the roles computation. NSEC methods are just standard Python methods. We can store security assertions on them, but we can't use computed attributes. The whole computed roles hack won't work. I could make it work my making the NSEC implementation much more complex, but this would be wrong. The hack should have been done away with ages ago. We need to refactor the way security assertions (permission settings) are stored and accessed. We need to store required permissions (__permissions__) on objects. When we need to figure out roles, we need to compute them at a higher level. (For example, we could compute the needed roles in the zope security policy It's likely that we can speed security checks when doing this.) I estimate that the necessary refactoring would take me 3-5 days. The vast majority of the required time will be spent writing tests. I really need to focus on Zope 3 for a while, so I may not be able to get back to this soon. I think that this is an area where some volunteers could make a big difference. I'd be happy to work with some folks on this. Jim -- Jim Fulton mailto:jim@zope.com Python Powered! CTO (540) 361-1714 http://www.python.org Zope Corporation http://www.zope.com http://www.zope.org

3 11

calling DTML method from python script in Zope
by scripts-urban＠imeme.net 24 Nov '03

24 Nov '03

of course I looked over at ZopeLabs; http://www.zopelabs.com/cookbook/992031125 and while this shed some light on the situtation, it hardly solved the problem. the script calls a DTML method in the same folder from which it resides & was called from -thanks in advance -josh

3 2

switched from Zope2.7.0 b2 to b3 -> LocalFS 1.0.0 broken
by infonicrelay＠t-online.de 22 Nov '03

22 Nov '03

Hi, after switching from Zope2.7.0 B2 to Zope2.7.0 B3 LocalFS 1.0.0 dosnot work. It is not shown broken in the Product management. After commenting out some stuff in LocalFS._safe_get_Ob I get an AttributeError Value:manage_workspace Also I can not access mamage_main It is declared as: manage_main=HTMLFile('dtml/main',globals()) ... same with index_html Are there changes on the HTMLFile implementation that can couse such errors? -- _______________________________________________________________________ Andreas Heckel andreas(a)easyleading.org LINUX is like a wigwam...no gates...no windows and an apache inside ;-)

1 0

__before_publishing_traverse__problem
by lukasz 21 Nov '03

21 Nov '03

I have a problem.When I import my plone site from one server to other I got : AttributeError: __before_publishing_traverse__ What should I do with that?

3 2

Re: Traceback
by Christian Theune 20 Nov '03

20 Nov '03

Wow. This traceback looks like a serious bug in Zope (both 2.6 and 2.7) that existed for quite a while. The "defined" (read: assumed interface) interface makes "AccessControl.Owned.owner_info()" return a dictionary, but a special owner called "UnownableOwner" is a list. I assume this to be the reason for the traceback below. I'm CC:ing the zope-dev(a)zope.org list, to see if anybody is against fixing that bug by making UnownableOwner an empty dictionary instead of an empty list. I'll fix that in the 2.6, 2.7 and HEAD branch. Also I'll patch Vendo to apply a monkey patch against this. (Question to zope-dev: What happens to the method definitions like f(unowned=UnownableOwner) if I do this? Until then, you should remember not to create Plone Sites in the Control Panel. Put them in the Root. Maybe this is the problem here in your specific case. Am Di, 2003-11-18 um 15.26 schrieb David Best: > Christian, > > Here is a copy of the traceback on the error and one other thing. > > Exception traceback > Time > 2003/11/18 06:22:16.448 US/Pacific > User Name (User Id) > admin (admin) > Request URL > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > Exception Type > TypeError > Exception Value > sequence index must be integer > > Traceback (innermost last): > * Module ZPublisher.Publish, line 98, in publish > * Module ZPublisher.mapply, line 88, in mapply > * Module ZPublisher.Publish, line 39, in call_object > * Module Products.CMFCore.PortalContent, line 126, in view > * Module Products.CMFCore.PortalContent, line 117, in __call__ > * Module Shared.DC.Scripts.Bindings, line 252, in __call__ > * Module Shared.DC.Scripts.Bindings, line 283, in _bindAndExec > * Module Products.CMFCore.FSPageTemplate, line 169, in _exec > * Module Products.PageTemplates.ZopePageTemplate, line 228, in > _exec > * Module Products.CMFCore.FSPageTemplate, line 141, in pt_render > * Module Products.PageTemplates.PageTemplate, line 95, in > pt_render > <FSPageTemplate at > /Control_Panel/Products/CMFPlone/vendo2/vendoorder_view used > for > /Control_Panel/Products/CMFPlone/vendo2/Members/admin/.vendo/Order-1069165315.57> > * Module TAL.TALInterpreter, line 200, in __call__ > * Module TAL.TALInterpreter, line 244, in interpret > * Module TAL.TALInterpreter, line 703, in do_useMacro > * Module TAL.TALInterpreter, line 244, in interpret > * Module TAL.TALInterpreter, line 726, in do_defineSlot > * Module TAL.TALInterpreter, line 244, in interpret > * Module TAL.TALInterpreter, line 414, in do_optTag_tal > * Module TAL.TALInterpreter, line 399, in do_optTag > * Module TAL.TALInterpreter, line 394, in no_tag > * Module TAL.TALInterpreter, line 244, in interpret > * Module TAL.TALInterpreter, line 497, in do_insertText_tal > * Module Products.PageTemplates.TALES, line 226, in evaluateText > * Module Products.PageTemplates.TALES, line 220, in evaluate > Line 18, Column 12 > Expression: <PythonExpr order.owner_info()['id']> > Names: > {'container': <PloneSite instance at 94421c0>, > 'default': <Products.PageTemplates.TALES.Default instance at 0x88df40c>, > 'here': <VendoOrder at /Control_Panel/Products/CMFPlone/vendo2/Members/admin/.vendo/Order-1069165315.57>, > 'loop': <SafeMapping instance at a4d3850>, > 'modules': <Products.PageTemplates.ZRPythonExpr._SecureModuleImporter instance at 0x88cb22c>, > 'nothing': None, > 'options': {'args': ()}, > 'repeat': <SafeMapping instance at a4d3850>, > 'request': <HTTPRequest, URL=http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/ven…>, > 'root': <Application instance at 93883c0>, > 'template': <FSPageTemplate at /Control_Panel/Products/CMFPlone/vendo2/vendoorder_view used for /Control_Panel/Products/CMFPlone/vendo2/Members/admin/.vendo/Order-1069165315.57>, > 'traverse_subpath': [], > 'user': admin} > * Module Products.PageTemplates.ZRPythonExpr, line 48, in > __call__ > __traceback_info__: order.owner_info()['id'] > * Module Python expression "order.owner_info()['id']", line 2, > in f > * Module AccessControl.ZopeGuards, line 90, in guarded_getitem > TypeError: sequence index must be integer > > > Display traceback as text > > > REQUEST > form > cookies > _ZopeId > '82700749A1EaOGIdEhk' > tree-s > 'eJyLjlZ3hANXW3UdhWhkEU9b9VggAAC8RAnl' > tutorialExamplesURL > 'http://yoursportspage.zopesites.com/Control_Panel/Products/ZopeTutorial/zop…' > lazy items > other > AUTHENTICATION_PATH > '' > TraversalRequestNameStack > [] > PUBLISHED > <bound method VendoOrder.view of > <VendoOrder at > /Control_Panel/Products/CMFPlone/vendo2/Members/admin/.vendo/Order-1069165315.57>> > USER_PREF_LANGUAGES > <Products.Localizer.AcceptLanguage.AcceptLanguage instance at 0xa59060c> > URL > 'http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/…' > SERVER_URL > 'http://yoursportspage.zopesites.com' > SESSION > id: 10691649820294860270, token: > 82700749A1EaOGIdEhk, contents: [] > AUTHENTICATED_USER > admin > URL0 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > URL1 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > URL2 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > URL3 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > URL4 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > URL5 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2 > URL6 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone > URL7 > http://yoursportspage.zopesites.com/Control_Panel/Products > URL8 > http://yoursportspage.zopesites.com/Control_Panel > URL9 > http://yoursportspage.zopesites.com > BASE0 > http://yoursportspage.zopesites.com > BASE1 > http://yoursportspage.zopesites.com > BASE2 > http://yoursportspage.zopesites.com/Control_Panel > BASE3 > http://yoursportspage.zopesites.com/Control_Panel/Products > BASE4 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone > BASE5 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2 > BASE6 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > BASE7 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > BASE8 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > BASE9 > http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/… > environ > HTTP_ACCEPT_ENCODING > 'gzip, deflate' > SERVER_PORT > '9097' > PATH_TRANSLATED > '/VirtualHostBase/http/yoursportspage.zopesites.com:80/Control_Panel/Products/CMFPlone/vendo2/Members/admin/.vendo/Order-1069165315.57/view' > HTTP_ACCEPT > 'application/vnd.ms-excel, > application/msword, image/gif, > image/x-xbitmap, image/jpeg, > image/pjpeg, > application/vnd.ms-powerpoint, > application/x-shockwave-flash, */*' > GATEWAY_INTERFACE > 'CGI/1.1' > HTTP_COOKIE > 'tutorialExamplesURL="http://yoursportspage.zopesites.com/Control_Panel/Products/ZopeTutorial/zop…"; tree-s="eJyLjlZ3hANXW3UdhWhkEU9b9VggAAC8RAnl"; _ZopeId="82700749A1EaOGIdEhk"' > HTTP_X_FORWARDED_HOST > 'yoursportspage.zopesites.com' > HTTP_ACCEPT_LANGUAGE > 'en-us' > HTTP_X_FORWARDED_FOR > '65.29.215.226' > REMOTE_ADDR > '216.93.187.184' > SERVER_NAME > 'alpha.zettai.net' > HTTP_USER_AGENT > 'Mozilla/4.0 (compatible; MSIE 6.0; > Windows 98; YComp 5.0.2.6)' > CONNECTION_TYPE > 'close' > channel.creation_time > 1069165336 > SERVER_PROTOCOL > 'HTTP/1.1' > PATH_INFO > '/VirtualHostBase/http/yoursportspage.zopesites.com:80/Control_Panel/Products/CMFPlone/vendo2/Members/admin/.vendo/Order-1069165315.57/view' > HTTP_HOST > '216.93.187.184:9097' > REQUEST_METHOD > 'GET' > SCRIPT_NAME > '' > SERVER_SOFTWARE > 'Zope/(Zope 2.6.2 (source release, > python 2.1, linux2), python 2.1.3, > freebsd4) ZServer/1.1b1' > HTTP_REFERER > 'http://yoursportspage.zopesites.com/Control_Panel/Products/CMFPlone/vendo2/…' > HTTP_X_FORWARDED_SERVER > 'yoursportspage.zopesites.com' -- Christian Theune, gocept gmbh & co. kg http://www.gocept.com - ct(a)gocept.com fon: 03496 3099112 fax: 03496 3099118 mobile: 0179 7808366

2 1

Post Traversal Hook
by Christian Theune 20 Nov '03

20 Nov '03

Hi, i just posted a Draft of a proposal to implement a post traversal hook in Zope 2.8. A preliminary version is implemented in the Zope-2_7-posttraverse branch. I would like to get some feedback on this, Christian -- Christian Theune, gocept gmbh & co. kg http://www.gocept.com - ct(a)gocept.com fon: 03496 3099112 fax: 03496 3099118 mobile: 0179 7808366

1 0

Announce: Zope 2.7.0 beta 3 released
by Brian Lloyd 18 Nov '03

18 Nov '03

Zope 2.7.0 represents a concentration on software configuration and installation improvement over older versions. Note that Zope 2.7 now requires Python 2.3.2. You may download Zope 2.7.0b3 from Zope.org at: http://www.zope.org/Products/Zope/2.7.0b3/2.7.0b3 Particular features of interest in Zope 2.7.0: - DBTab integration (mounted databases for Zope). - New logging module support. - ./configure; make; make install installation from source - configuration-file-driven configuration - integration of ReStructuredText - OrderedFolder support - Many bugxfixes For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.7.0b3/CHANGES.txt - http://www.zope.org/Products/Zope/2.7.0b3/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: - http://www.zope.org/Documentation/Misc/InstallingZope.html Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

1 0

Re: [Zope-Checkins] CVS: Zope/lib/python/App/dtml - undo.dtml:1.5.2.2
by Tres Seaver 18 Nov '03

18 Nov '03

On Tue, 2003-11-18 at 03:10, Andreas Jung wrote: > Update of /cvs-repository/Zope/lib/python/App/dtml > In directory cvs.zope.org:/tmp/cvs-serv3768/lib/python/App/dtml > > Modified Files: > Tag: Zope-2_7-branch > undo.dtml > Log Message: > removed %p Sorry! I jumped the gun; I should've read ahead in my checkins folder. Tres. -- =============================================================== Tres Seaver tseaver(a)zope.com Zope Corporation "Zope Dealers" http://www.zope.com

1 0

Re: [Zope-Checkins] CVS: Zope/lib/python/App/dtml - undo.dtml:1.6
by Tres Seaver 18 Nov '03

18 Nov '03

On Tue, 2003-11-18 at 03:07, Andreas Jung wrote: > Update of /cvs-repository/Zope/lib/python/App/dtml > In directory cvs.zope.org:/tmp/cvs-serv3165/lib/python/App/dtml > > Modified Files: > undo.dtml > Log Message: > fixed hour format > > > === Zope/lib/python/App/dtml/undo.dtml 1.5 => 1.6 === > --- Zope/lib/python/App/dtml/undo.dtml:1.5 Tue Jun 17 13:33:29 2003 > +++ Zope/lib/python/App/dtml/undo.dtml Tue Nov 18 03:07:44 2003 > @@ -73,7 +73,7 @@ > </td> > <td align="right" valign="top" colspan="2" nowrap> > <div class="list-item"> > - <dtml-var time fmt="%Y-%m-%d %I:%M:%S %p"> > + <dtml-var time fmt="%Y-%m-%d %H:%M:%S %p"> > </div> > </td> > </tr> Why the trailing '%p', if the hour is in 24 hour mode? I can see including the zone, perhaps, but the AM / PM indicator? Tres. -- =============================================================== Tres Seaver tseaver(a)zope.com Zope Corporation "Zope Dealers" http://www.zope.com

1 0