- Zope-Dev - Zope lists

Unsubscribing Problem
by Deb B. 18 Jan '03

18 Jan '03

I am subscribed, apparently, to this list. I keep receiving every email sent to the list. I attempted to modify my subscription to stop mail from coming to the list but I get the following error: ErrorZope-Dev has no subscribed addr intranetdeb(a)yahoo.comCan someone on the list offer assistance? Thanks. --------------------------------- Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now

1 0

question: forcing https for authentication
by Oliver Bleutgen 17 Jan '03

17 Jan '03

One thing that bothers me is that I cannot reliably (as in "in a generic way which always works") prevent users from sending their authentication unencrypted. The only ideas I have to tackle this without modifying zope itself are - customize all pages which need authentication to check for "https://" in one of the relevant REQUEST attributes and do a redirect if not. - use apache with some magic to trigger redirection if it encounters authentication headers in the request. - use apache with some rewrite magic trigger redirection when a substring like "manage" is found in the request. These alternatives are neither elegant, nor really secure. So I have skimmed through zope's (2.5.1) source and wonder if modifying HTTPResponse could work: Change def _unauthorized(self): realm=self.realm if realm: self.setHeader('WWW-Authenticate', 'basic realm="%s"' % realm, 1) to def _unauthorized(self): if spam[0:5] == 'https': # I wish I would know what to put here realm=self.realm if realm: self.setHeader('WWW-Authenticate', 'basic realm="%s"' % realm, 1) else: self.redirect('https:' + spam[4:],lock=1) # or should we use setHeader? My questions: Is _unauthorized always called when authorization is needed, or are there more points which might set that header? Can I get at the information I need to know if the request was via https at this point (i.e. the spam thing) or is there a better place in zope to do something I described? Will redirection work here or might something overwrite the headers later on? Is it possible to implement this via a monkey patch (or whatever this is called)? Thanks, oliver

3 6

Effect of DB Writes on Performance
by Brian R Brinegar 16 Jan '03

16 Jan '03

Hello, What effect do ZODB Writes have on Performance? We use Zope in an environment where users are constantly updating and maintaining content within the ZODB. Do these writes to the Database slow down overall performance? -Brian

3 2

RE: [Zope-dev] Rendering of objects in DTML
by Bjorn Stabell 16 Jan '03

16 Jan '03

Thanks Leo, this is very helpful. It should probably be in a HOWTO somewhere. :) > -----Original Message----- > From: Leonardo Rochael Almeida [mailto:leo@hiper.com.br] > > On Tue, 2003-01-14 at 01:01, Bjorn Stabell wrote: > > > Bjorn Stabell wrote: > > > > I would like > > > > <dtml-var content> > > <dtml-with content>... > > <dtml-if content> > > > > to call different functions. The first renders the object, > the second > > returns a mapping of the content's attributes/properties, the third > > checks for "trueness" of the content. Rendering a content > could be an > > expensive operation and I don't want to do it when doing > dtml-with and > > dtml-if. > > > you can do that by having your object be non-callable (or > returning self on __call__) and implementing __str__ where > you can have access to the REQUEST thru self.REQUEST. > <dtml-with content> works as expected because you're getting > the object itself. To make <dtml-if content> work you should > implement __len__ (if your object implements sequence or > mapping, which it probably doesn't) or __nonzero__. Read the > python docs for details on the implementation of these methods. > > Cheers, Leo > > -- > Ideas don't stay in some minds very long because they don't > like solitary confinement.

2 1

Can't return / publish object of a dictionary?
by Lars Heber 16 Jan '03

16 Jan '03

Hi zopers, my class has a list with several objects in it. When calling my self written _getOb() method, I want to return one of these objects. But I get an Unauthorized... When I put an object of the same type into a normal class attribute (self.dummyObject), return of that object from _getOb() works perfectly. What am I doing wrong? Thanks a lot! -- Lars Heber T-Systems GEI GmbH Hausanschrift: Clausstrasse 3, 09126 Chemnitz Postanschrift: Clausstrasse 3, 09126 Chemnitz Telefon : (+49 371) 5359-271 Fax : (+49 371) 5359-133 E-Mail : Lars.Heber(a)t-systems.com Internet: http://www.t-systems.de

3 2

Re: [Zope-dev] AdaptableStorage
by THoffman＠indtech.wa.gov.au 16 Jan '03

16 Jan '03

Solaris 9 also has extended Fileattributes >From whats new in Solaris 9 "The UFS, NFS, and TMPFS file systems have been enhanced to include extended file attributes, which enable application developers to associate specific attributes to a file. For example, a developer of a file management application for a windowing system might choose to associate a display icon with a file." man (5) on fsattr http://docs.sun.com/db/doc/816-0220/6m6nkorp9?a=view See ya Tim On Thu, 2003-01-16 at 03:47, Shane Hathaway wrote: > Paul Winkler wrote: > > On Wed, Jan 15, 2003 at 05:30:58PM +0000, seb bacon wrote: > > > >>Shane, AdaptableStorage is insane and beautiful - congratulations :-) > > > > > > It seems to inspire insanity :) kosh and i got into a discussion on #zope > > about using AdaptableStorage with reiserfs4, mapping zope properties > > to reiserfs4 properties... finally, a fully really transparent > > unix filesystem <-> ZODB solution that isn't a half-assed version of either! > > didn't get into detail but it seems like it should be doable. > > That's not insanity, it's just discovering that what was nasty and > difficult before is now doable. :-) I really didn't appreciate the > elegance of Mac resource forks until I created the ".properties" files. > I understand NTFS has multiple named forks and other filesystems like > ReiserFS are developing similar capabilities. Neat. Let's use them! > > Shane > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://lists.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope ) DISCLAIMER: This email, including any attachments, is intended only for use by the addressee(s) and may contain confidential and/or personal information and may also be the subject of legal privilege. Any personal information contained in this email is not to be used or disclosed for any purpose other than the purpose for which you have received it. If you are not the intended recipient, you must not disclose or use the information contained in it. In this case, please let me know by return email, delete the message permanently from your system and destroy any copies. Emails and their attachments may be interfered with, may contain computer viruses or other defects and may not be successfully replicated on other systems. All attachments are opened at the recipient's risk.

1 0

attaching images and wav file to email
by Mark Hendricks 15 Jan '03

15 Jan '03

I am trying to attach images and other binary data to an email. The text attachment works fine. (I would like to hide the following label(s) if possible... Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="my.ip.501.473.1042563430.436.4336") Following the dtml documents is the mail I get using these pages... I would greatly appreciate any help on this. I have two Zope dtml documents: --- Number 1 ------------------------------------------------------------------------ ----------------------------------------------------------- <dtml-var standard_html_header> <p>Please send me info.</p> <form action="infoAction" method="post" enctype="multipart/form-data"> <table> <tr><td align=right>name:</td><td><input type="text" name="user_name" size="40"></td></tr> <tr><td align=right>email:</td><td><input type="text" name="email" size="40"></td></tr> <tr><td align=right>text:</td><td><input type="text" name="some_text" size="40"></td></tr> <tr><td align=right>image:</td><td><input type="file" name=some_jpeg filename="some_jpeg"></td></tr> <tr><td colspan=2 align=center><input type="submit"></td></tr> </table> </form> <dtml-var standard_html_footer> --- End Number 1 ------------------------------------------------------------------------ ---------------------------------------------------- --- Number 2 ------------------------------------------------------------------------ ----------------------------------------------------------- <dtml-var standard_html_header> <h1>Thanks <dtml-var user_name></h1> <p>Received the info and will send you a mail at <dtml-var email> when I get this working.</p> <dtml-sendmail smtphost="my.smtp.host"> To: me(a)myhost.com From: <dtml-var email> Subject: test3-w-image <dtml-comment><dtml-var subject></dtml-comment> <dtml-comment><dtml-var body></dtml-comment> <dtml-mime type=text/plain encode=7bit> <dtml-var some_text> <dtml-boundary type="application/octet-stream" disposition="attachment" filename="some_jpeg.getId()" encode="base64"> <dtml-var expr="some_jpeg.read()"> <dtml-var some_jpeg> </dtml-mime> </dtml-sendmail> <dtml-var standard_html_footer> --- End Number 2 ------------------------------------------------------------------------ ----------------------------------------------------------- This is what I get back... From: me(a)myhost.com Date: Tue Jan 14, 2003 10:57:08 AM America/Chicago To: me(a)myhost.com Subject: test3-w-image Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="my.ip.501.473.1042563430.436.4336" --my.ip.501.473.1042563430.436.4336 Content-Type: text/plain Content-Transfer-Encoding: 7bit 123 --my ip.501.473.1042563430.436.4336 Content-Type: application/octet-stream Content-Disposition: attachment; filename="some_jpeg.getId()" Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAgAAZABkAAD/7AARRHVja3kAAQAEAAAAHgAA/ +4AIUFkb2JlAGTAAAAAAQMA EAMCAwYAAAJGAAADFAAABe3/ 2wCEABALCwsMCxAMDBAXDw0PFxsUEBAUGx8XFxcXFx8eFxoaGhoX Hh4jJSclIx4vLzMzLy9AQEBAQEBAQEBAQEBAQEABEQ8PERMRFRISFRQRFBEUGhQWFhQaJhoa HBoa JjAjHh4eHiMwKy4nJycuKzU1MDA1NUBAP0BAQEBAQEBAQEBAQP/ CABEIAGQAZAMBIgACEQEDEQH/ xACsAAEAAgMBAQAAAAAAAAAAAAAABQYBAgQDBwEBAAMBAAAAAAAAAAAAAAAAAAIDBAEQAAEE AQMD BAMAAAAAAAAAAAMBAgQFBiAwEhARE0AhFBUAIjIRAAIBAgQDBgQEBwAAAAAAAAECAxEEACEx EjAi BUFRYXEyEyCBoRQQwVKykUJicoKSwhIAAQIBCwUAAAAAAAAAAAAAARECABAgMEAhMUFRcRID kdEi MhP/ 2gAMAwEAAhEDEQAAAPoAAAOSm3WiZ5XXuply0RyADBkAAxSrtUyPvPl7GwAAMQ0vUC09NEsx K1n2iKZXTfz9LogAAYipbBU97RRMtk1AQ1yh2f6tdttQAAAGKxaK6Rlsr0+dYAAAAFbskGc8 zU58 mGMgAAADQOXnCUyAAH//2gAIAQIAAQUA6yVKjE991JAVfpmR3GHHgtG/1H// 2gAIAQMAAQUA6t7d 93g7tpE9GueZXJ6j/ 9oACAEBAAEFANVpN+vrius3LU2gLSHtTo7JUSpsvrZ2Dk8AdpfdDwmTbipp 5FNbjdyZtARzcoWMMiNajU1T8hDEFDnBmi6ORjMoH/GoiK4c+1SvPUZNLhSy5PjwR/ dW838RtlX3 AFRRa7WqHNSwxrzVdIaLIrhS0LIm2jbWwr+Xx9h7Uc25DOx8vK1IShomDaxqNbs5uAZhTYYQ nhIi B2svReF2FHwYCqotrNH8Q2zkSrgr+m1ldOy4gzoc0FTj8w8mJtE4cT/G8Vf4Oen/ 2gAIAQICBj8A lD+JfC0tCWwtKOMPaXnAd5wDCjmlRkcxH0cVI9QLtdaz/9oACAEDAgY/ AJUONNuQpOUhRG3rWf/a AAgBAQEGPwD4rm92e4beJ5Amm4qKgVxJf23WWn6zbyyA2ILLbO0ChprWK3NGegPqFa5aHmEV 3CeS VQwFQSK6qaVzGh4c1vIN0cyMjrUiqsNpFRnpg2PU1V7WynaGyvXoz2yttpG7sKqjKwG7s0PL Ta9g XVmtJHicoaoSGJ3ITqrVqDxOr2zAFVliNDSnPBHX9uPet6C1mXbNEa1DD0smRr25VGvywD38 PqwI oG+2ceNY2X/nCsRnTFB8c/vUt5rWaISI/NutpJo4/ fQChKlH17GqM6ZmWKoCySRUalawyNExyrkS uX43a15pLe3c5fpaZNf4YHl8bKrFCQQHWlVJ7RuBGXiMTCW4uZiVkgW9ltkUWW4bWkV/ Zi3jcBkp 5sqVyqkXW3VraclY78DYA9SaTLote/T6kGRuo27AfyxyLIxr3JHuY/IYVrO0FhARnJfAmY/ 228TC n+TjyxHdX9397FfAW5l9pYTHIm6SNdqsciN+ffrhSO7gIXQOY23pUV2uAQGHiK4uIBTe6HZU kDeO ZCSP6gMQXVrDHBvXnSJBGEl9Mi0Ay5hi5iC0jtdqvMWG0uV3stOzYpWp8fDEMVpz2lo5cSZb ZZqF KrUV2oCaHtJ8MLu1pwSvfi66hYSqsEre7NbTLuiMhoNy7SCrN9TiGzupt8NzLLLNEqhVaVqy Vcih fPsOWWFkZQAKUHdgAaDhdLR1DK1/CGUioK7ZCQR446bMR6rkp/vDN+YwAOH0thot/ FXyKyL+eLKT Rob22dfNpBEfo54nS86V6hbj92uIu0m6tQPP7iM8SKB5GjEUqzVSlTtDLTPT1YtLbplv7i2t zFKY S+2qRsZDzyH9VMB7qD7aYk1iLB6AHLMd44fPpg93hg+3X4v/ 2Qo8WlB1Ymxpc2hlci5IVFRQUmVx dWVzdC5GaWxlVXBsb2FkIGluc3RhbmNlIGF0IDB4ZTNmOWJjPgoKCg== --my ip.139.501.473.1042563430.436.4336--

2 1

Zope and Python compatibility
by Lennart Regebro 15 Jan '03

15 Jan '03

What would the arguments be for sticking with Zope 2.1.3 for Zope 2.7? I feel most people want to use the latest and greatest versions, usually... Or? Of course, if the requirement could be 2.1.3 *or* 2.2.2, that would be nice, but is that realistic?

6 9

ACL patch for zope 2.6
by Erik Dahl 14 Jan '03

14 Jan '03

I wanted to add a little more security to a zope site that has no firewall in front of it but is mostly for internal users. To do this I put a check in the accept callback of http_server. Not sure how much security increase this really gives but I wonder if anyone would find it useful (or if anyone has a better solution)? Here is the patch. I only added the acl to the http server, it would be easy to do for the others as well (but I have these turned off). -EAD diff -C3 -r ./z2.py /home/edahl/zope/z2.py *** ./z2.py 2002-10-08 17:18:20.000000000 -0400 --- /home/edahl/zope/z2.py 2003-01-14 10:48:40.000000000 -0500 *************** *** 222,227 **** --- 222,234 ---- - The start of response output, and - The end of the request. + -A acl + Add an access control list to the HTTP server. List should be comma + delimited and can contain any part of the begining of an ip address. + For instnace 1.2.,3.4. would allow two class b networks 1.2.0.0/16 + and 3.4.0.0/16. + + Environment settings are of the form: NAME=VALUE. Note: you *must* use Python 2.1 or later! *************** *** 332,337 **** --- 339,350 ---- # Use a daemon process USE_DAEMON = 1 + # Access control list by IP + # each ip should be the begining of an ip + # ie 1.2. would allow the class b 1.2.0.0 + # mulitple ips should be comma delimited + ACL_LIST=() + # ######################################################################## *************** *** 386,392 **** opts, args = getopt.getopt(sys.argv[1:], ! 'hz:Z:t:i:a:d:u:w:W:f:p:m:Sl:2DP:rF:L:XM:C', ['icp=', 'force-http-connection-close' ]) --- 399,405 ---- opts, args = getopt.getopt(sys.argv[1:], ! 'hz:Z:t:i:a:d:u:w:W:f:p:m:Sl:2DP:rF:L:XM:CA:', ['icp=', 'force-http-connection-close' ]) *************** *** 470,475 **** --- 483,490 ---- if v=='-': v='' FCGI_PORT=v elif o=='-M': DETAILED_LOG_FILE=v + elif o=='-A': + ACL_LIST = v.split(',') except SystemExit: sys.exit(0) except: *************** *** 646,652 **** ip=address, port=port, resolver=rs, ! logger_object=lg) except socket.error, why: if why[0] == 98: # address in use raise port_err % {'port':port, --- 661,669 ---- ip=address, port=port, resolver=rs, ! logger_object=lg, ! acl_list=ACL_LIST) ! except socket.error, why: if why[0] == 98: # address in use raise port_err % {'port':port, diff -C3 -r ./ZServer/HTTPServer.py /home/edahl/zope/ZServer/HTTPServer.py *** ./ZServer/HTTPServer.py 2002-10-03 22:29:49.000000000 -0400 --- /home/edahl/zope/ZServer/HTTPServer.py 2003-01-14 09:28:44.000000000 -0500 *************** *** 357,365 **** channel_class = zhttp_channel shutup=0 ! def __init__ (self, ip, port, resolver=None, logger_object=None): self.shutup=1 ! http_server.__init__(self, ip, port, resolver, logger_object) self.shutup=0 self.log_info('HTTP server started at %s\n' '\tHostname: %s\n\tPort: %d' % ( --- 357,366 ---- channel_class = zhttp_channel shutup=0 ! def __init__ (self, ip, port, resolver=None, logger_object=None, ! acl_list=None): self.shutup=1 ! http_server.__init__(self, ip, port, resolver, logger_object, acl_list) self.shutup=0 self.log_info('HTTP server started at %s\n' '\tHostname: %s\n\tPort: %d' % ( diff -C3 -r ./ZServer/medusa/http_server.py /home/edahl/zope/ZServer/medusa/http_server.py *** ./ZServer/medusa/http_server.py 2002-06-20 10:39:34.000000000 -0400 --- /home/edahl/zope/ZServer/medusa/http_server.py 2003-01-14 10:31:21.000000000 -0500 *************** *** 558,569 **** channel_class = http_channel ! def __init__ (self, ip, port, resolver=None, logger_object=None): self.ip = ip self.port = port asyncore.dispatcher.__init__ (self) self.create_socket (socket.AF_INET, socket.SOCK_STREAM) ! self.handlers = [] if not logger_object: --- 558,571 ---- channel_class = http_channel ! def __init__ (self, ip, port, resolver=None, logger_object=None, ! acl_list=None): self.ip = ip self.port = port asyncore.dispatcher.__init__ (self) self.create_socket (socket.AF_INET, socket.SOCK_STREAM) ! self.acl_list = acl_list ! self.handlers = [] if not logger_object: *************** *** 652,657 **** --- 654,673 ---- self.total_clients.decrement() return + # check acl to see if we accept this connection + if self.acl_list: + ip = addr[0] + message = 'connection from client ' + ip + self.log_info(message) + for acl in self.acl_list: + if ip.find(acl) == 0: + break + else: + message += " blocked" + self.log_info(message, 'warning') + self.total_clients.decrement() + return + self.channel_class (self, conn, addr) def install_handler (self, handler, back=0):

1 0

RE: [Zope-dev] Rendering of objects in DTML
by Bjorn Stabell 14 Jan '03

14 Jan '03

> Bjorn Stabell wrote: > > Hello, > > > > When a content is rendered by the Zpublisher, its index_html() is > > called. When it is rendered in DTML, e.g., as <dtml-var > content>, its > > __call__ method is called. The __call__ method is also > called if the > > object appears in <dtml-if content> or <dtml-with content>. Is it > > possible to render these two cases differently from <dtml-var > > content>? > > Which two cases? > What do you mean by 'differently'? > > cheers, > > Chris I would like <dtml-var content> <dtml-with content>... <dtml-if content> to call different functions. The first renders the object, the second returns a mapping of the content's attributes/properties, the third checks for "trueness" of the content. Rendering a content could be an expensive operation and I don't want to do it when doing dtml-with and dtml-if.

3 2