- Zope-Dev - Zope lists

ZopeSecurityPolicy
by Christian Theune 11 Mar '03

11 Mar '03

Hi, I had some conversation with Tres about the SecurityPolicy implementation. I would like to clean up following problem: The method "validate" is not very clear about when it will raise an exception and when it will return a boolean. This results in code that expects it to return a boolean, and makes conclusions about exceptions that are wrong by catching the anonymously, transforming them all (e.g. AttributeError) into Unauthorized. This shadows the real source of a problem, also the code that calls validate probably shouldn't raise Unauthorized on it's own. But there's where my problem starts: could we get it somewhat clear who should raise Unauthorized, what can be expected from validate and where should only boolean values be returned? I would like to see some discussion, wrap it up in a proposal, and deliver the code on a branch. Thanks for listening, Christian -- Christian Theune, gocept gmbh & co.kg phone: +49-3641-233526 mobile: +49-179-7808366 mail: ct(a)gocept.com

2 1

Re: [Zope-dev] Proposed installation changes for review
by Dario Lopez-Kästen 11 Mar '03

11 Mar '03

----- Original Message ----- From: "Guido van Rossum" <guido(a)python.org> > > > Oops, I stand corrected. But Zope 2.7 does include ZEO! > > > > Very good! But in that case, shouldn't the new Zope 2.7 install and > > startup stuff support it? > > Well, in a typical installation, you won't be running ZEO on the same > machine as Zope, right? hm... I wonder if this wold be a common case if ZEO was included as a integral part of Zope. I may be wrong, bur aren't there benefits of running ZEO even on a single machine (i.e. stability and/or redundancy)? I know I allready now could need the functionality of ZEO on a single machine (and I am about to use ZEO as soon as I fix some non-ZEO-able issues in our app). > ZEO has its own install and config stuff, > which is very similar to that for Zope, but ZEO is not installed as > part of the main Zope install. I thought you had to install ZEO on top/inside of an existing Zope installation. Will this be different in Zope 2.7? Thanks, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen, IT Systems & Services Chalmers University of Tech.

2 1

LOTS of roles?
by Paul Winkler 11 Mar '03

11 Mar '03

has anybody ever set up a site with a large number of roles? we're contemplating a security model for our app that might lead to ~ 100 Roles within a year, possibly thousands within the next 5 years. (Outline of the actual problem is at the end of this message) (The users and roles will be managed in LDAP, by the way; we plan to use LDAPUserFolder for this and not do any user or role administration in Zope.) I seem to recall the Zope Book or some other text advising against large numbers of roles, but IIRC that was only because of the UI. Obviously the ZMI default Security tab will not scale. I think I can replace that without too much trouble: possibly have the main page list only the roles vertically, with each one being a link to manage_roleForm as it is currently. As the number of roles grows very large this main page could be broken into batches if necessary. And of course there'd be a link to another page with a list of permissions to manage, and each of those would link to manage_permissionForm. i'm also thinking to use checkboxes as the current UI is too easy to unselect everything by accident. The question is, if I can solve the interface issues, are there other reasons not to have hundreds or thousands of roles? It seems to me that there should not be performance issues, since I assume that finding the current user's roles is just a dictionary lookup which should scale pretty well... we're not talking millions of roles here, and each user will have only a handful of roles. comments? more about our scenario: * We must anticipate users at hundreds of locations * there might be 10 or so users at each location * permissions can be grouped pretty well into tasks, but are specific to a location - permission to do a task at one location must not mean permission at all locations. To me this suggests several Roles per location, corresponding to the grouped tasks at that location. * each user might work from several different locations * each user might need different permissions when working at different locations * We have multiple applications, not all in zope, so LDAP is looking attractive. -- Paul Winkler http://www.slinkp.com

8 22

product import question
by Eric Roby 11 Mar '03

11 Mar '03

We have developed a zope product that works (as expected) as a standalone - call it prodA. We have another product that simply exposes a number of utility container objects that when created, provide certain functions at different levels. They also restrict meta_types at each level. Call this prodB. A fully developing prodB might look something like this: resourceStore ----resourceFolder --------datasourceFolder ------------dbFolder I attempted to restrict the meta_types in the class that is represented by dbFolder to just prodA. In order to gain access to the prodA add form, I had to import the prodA module into the prodB module and make the assignment in the class that is represented by dbFolder. At this point the single factory method was exposed in the dbFolder as expected. Unfortuantely, the constructor for prodA (action of the prodA add form) could not be found. With numerous tweakings and source searching I settled on duplicating the constructor function for prodA in the class that is represented by dbFolder. Now it works. The question I have... is this the right way to do this?? I attempted to do a 'from prodA-module import prodA-constructor-function' and that didn't help. I tried a number of other incantations to no avail. The interesting thing (for me) was that if I did not restrict meta_types in dbFolder and just used the default factory-method list (of which prodA was one) I could create prodA without importing anything from the prodA module. I know I am being dense here but the obvious alludes me here. Any enlightenment would be much appreciated... TIA Eric

2 1

"Fuzziness" in tracebacks ...
by Joachim Werner 10 Mar '03

10 Mar '03

Hi! I am using Zope 2.6.1 with Python 2.2.2, knowing that this is not officially supported. There are no problems in general, but one thing really is annoying: I start getting tracebacks that only indicate the line in the code where the method that caused the traceback started. I don't get the actual line of the error traced down. This might be completely independent of using Python 2.2.2, so I'd like to know if anybody else has made similar experiences with 2.6.1. Another issue that might or might not be related is that I am getting plain white pages rendered by ZPT if there is an error calling a variable or so. Errors in the ZPT syntax and some runtime errors are raised properly, but others just cause a white page to be rendered, which is very hard to debug without using a debugger. Joachim -- iuveno AG Joachim Werner _________________ Wittelsbacherstr. 23b 90475 Nürnberg joachim.werner(a)iuveno.de www.iuveno.de Tel.: +49 (0) 911/ 9 88 39 84

1 0

Stupid dtml-if comparision
by David Cain 10 Mar '03

10 Mar '03

I'm trying to compare two number, or at least I think they're numbers. If I do: <dtml-var i> <dtml-var j> <dtml-if expr="i == j"> Equal block </dtml-if> I and J print out the same, but do not compare to be equal since "Equal block" string doesn't print. I must be doing something wrong. Please, suggestions before I pull out all my hair. David Cain Senior Web Developer, Information Systems Department Syracuse University Library Syracuse, New York 13244-2010 (315) 443-5923 mailto:dacain@library.syr.edu mailto:dacain@syr.edu

2 1

[Vote] PEP308 voting began
by Dieter Maurer 10 Mar '03

10 Mar '03

Attention: cross post PEP308 is concerned with the introduction of a ternary conditional operator (something like an "if cond: val_true else: val_false") into Zope. In my view, such an operator would make TALES expressions easier because we could get rid of the "and/or" hack to represent conditionals and we could forget about the "test" function, which evaluates too eagerly. Please have a look at PEP308 and consider voting. Details in "comp.lang.python.announce". Dieter

12 16

How to trigger Zope externally (mail)
by Ross Boylan 10 Mar '03

10 Mar '03

I am working on a poll/survey type product and want to handle responses by email as well as the web. If you have any advice about the best architecture, I would appreciate it. I'm currently using Zope 2.5 on Linux, though it would be nice if the solution weren't too platform dependent. Here are some options I have thought of. 1. Incoming mail goes to a pipe, which is a program that processes the message. I think the main drawback of this approach is that I would need to run Zope on top of ZEO so that multiple processes could access the database safely. I'm also not sure how hard it would be to reestablish the context of my product outside of regular Zope. Aside from these concerns, this seems the most natural approach. 2. Incoming mail goes to mbox; via the regular zope web interface I periodically point to the mbox and request that it be processed. Ugly, but relatively simple. Some locking and concurrency issues. Likely to result in much slower response to mail. Also, there could be some problems distinguishing message boundaries; in practice, probably not a problem. 3. Incoming mail goes to temp file or temp named pipe*. The running zope is tickled via http: with the name of the file/pipe, and processes it from there. *By "temp named pipe" I mean each mail would need a unique pipe name. I think if I try to use a single named pipe I may have trouble if multiple emails go down it around the same time. 4. Deliver the email to the running zope via some other protocol, e.g., ftp. I'm not sure how to set this up. ------------------------------ I welcome comments on these approaches, or others that are even better! Also, I would like the approach to be reasonably secure. Thanks.

7 8

Authenticating with acl_users
by Sondre Rønjom 09 Mar '03

09 Mar '03

Ive been looking through AccessControl/User.py to understand the validate() methods paramteres. Im not sure what to put inside the request, and how to do it. I have been testing around, but I can only manage to do authenticate(), but this only tells if the user is valid and has the right password. The thing is, I also want to set AUTHENTICATED_USER, but not sure how to to this, but I have the idea validate() does all this for you, if you pass the right parameters. I have been searching at zope.org and google.com for a long time now, but cant find very much useful. The only parameters I have put in the REQUEST are __ac_user and __ac_password, but I know I also need object value and physical container of the object, but dont know how to find this. /Sondre

3 3

Re: [Zope-dev] Authenticating with acl_users (fwd)
by Sondre Rønjom 09 Mar '03

09 Mar '03

I'm creating a python product - which needs to be authenticated; and I dont want to use any products that does not come with a clean Zope install - so I user Simple User Folder and define two roles admin user and ordinary user. I just want a user to login via login form, check username and password with the acl_users user list and set the user to AUTHENTICATED_USER if username and password is correct. Actually I just want to access the methods which the pop-up authenticator use when one does /manage. To me it looks like validate() from AccessControl/User.py does this for you, but Im not sure how to use the method. /sondre On Sat, 8 Mar 2003, Jens Vagelpohl wrote: > what exactly is it you are trying to achieve? maybe someone can help if > you let us know what the real motivation is. > > jens > > > On Saturday, Mar 8, 2003, at 11:42 US/Eastern, Sondre Rønjom wrote: > > > Ive been looking through AccessControl/User.py to understand the > > validate() methods paramteres. Im not sure what to put inside the > > request, > > and how to do it. I have been testing around, but I can only manage to > > do > > authenticate(), but this only tells if the user is valid and has the > > right > > password. The thing is, I also want to set AUTHENTICATED_USER, but not > > sure how to to this, but I have the idea validate() does all this for > > you, > > if you pass the right parameters. I have been searching at zope.org and > > google.com for a long time now, but cant find very much useful. The > > only > > parameters I have put in the REQUEST are __ac_user and __ac_password, > > but > > I know I also need object value and physical container of the object, > > but > > dont know how to find this. > > > > /Sondre > >

2 1