- Zope-Dev - Zope lists

CMF, CMFCore/utils.py, Tuple/List incompatibility
by Christian Theune 19 Nov '02

19 Nov '02

Hi. I get smacked by this: [...long traceback...] * Module Products.CMFCore.CatalogTool, line 58, in allowedRolesAndUsers * Module Products.CMFCore.utils, line 200, in _mergedLocalRoles Exception Value can only concatenate tuple (not "list") to tuple The file tells me nothing special. I once fixed it by using merged[k] = tuple(merged[k]) + tuple(v) instead of merged[k] = merged[k] + v I don't know if i triggered something bad before, but this code seems to be somewhat ... instable ... so maybe forcing it into a tuple maybe a good thing. Cheers Christian -- Christian Theune - ct(a)gocept.com gocept gmbh & co.kg - schalaunische strasse 6 - 06366 koethen/anhalt tel.+49 3641 511586 - fax.+49 3496 3099118 - mob. +49 179 7808366 reduce(lambda x,y:x+y,[chr(ord(x)^42) for x in 'zS^BED\nX_FOY\x0b'])

2 1

Fwd: RE: [Zope] import error - No module named iclass
by Júlio Silva 19 Nov '02

19 Nov '02

>> > >I'm upgrading to zope 2.6.0. >> > >When I try to import a ZClass based Product from zope 2.5.1 >> > i get the >> > >following error. >> > > >> > >Error Type: ImportError >> > >Error Value: No module named iclass >> >> > Yup. This was discussed about a week ago. Search the mailing >> > list archives; but as I remember, only the ZClasses descended >> > from ObjectManager have the problem, and then only if there >> > is a non-empty list on the SubObjects tab. To export from >> > 2.5.x, remove all from that list; then it will import fine >> > into 2.6. Then, I presume that you can recreate the list of >> > allowed subobjects, though I have not tried this. >> >>This worked fine. >>Thanks. > > >Hi, > >I'm having the same problem migrating a zclass from 2.5.1 to 2.6. >I've tryed the collector fix of ZClasses/ObjectManager.py and the >subobjects tab thing, but >that didnt solved my problem. > >My zclass has ZFolder as base class instead of ObjectManager: > >Base Classes: ZObject, ZFolder, CatalogAwareBase > >I'm looking at the ObjectManager.py to see if I can put it to work for my >zclass, but >I think in my case that doesnt make sense because my class dont have a >subobject tab... > >I'm looking into the zen of iclass... > >Any ideias? thanks. > >Regards, >Julio Silva I'm forwarding this mail to zope-dev because since this is related with 2.6.0 development changes against 2.5.1 maybe someone has other solutions, because the that is out there for ObjectManager doesnt solve my problem. Best Regards, Julio Silva --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.416 / Virus Database: 232 - Release Date: 11/6/2002

1 0

Securing login with SSL via RESPONSE?
by Serguei Chabanov 18 Nov '02

18 Nov '02

Hi, I have read all the various documents and howtos regarding setting zope with apache and SSL, and I set it up. I have two virtual servers, http and https, serving the same hierarchy of zope objects. I would llike to secure passwords by using SSL. It is suggested everywhere I read that the protection should be done with RewriteRule or similar, by filtering urls. For example, I use RewriteRule match like ^manage(.*) and another to see if the protocol is insecure to redirect such requests to the same URL, but over https. Else, I can use solutions like SSLAbsoluteURL to adjust behavior of absolute_url() This, however, seems unsatisfactory. RewriteRules or url base manipulation cannot guarantee that the site visitor would not run into a protected object. In this case, the server returns "Unauthorized" response, the browser pops up the basic http authorisation dialog and login/password travel in the open. Looking at the CookieCrumbler product, I realise that before anything gets published it "highjacks" the RESPONSE object and manipulates it, including removing "Unauthorized" and redirecting to a login form. I hope somebody has time to answer two questions: How legitimate would it be to do the same, but to make external redirect via https? I understand that this might mean a lot of nasty things, including being locked out of Zope, but this can be dealt with, for example, _emergency_user. Assume I make a hypothetical SSLRedirect product, modelled on CookieCrumbler. There is no reasonable way to keep them in the same folder and make sure that SSLRedirect gets to the REQUEST/RESPONSE before CookieCrumbler, correct? I.e. such SSLRedirect product would have to be in a subfolder relative to CookieCrumbler so that it gets traversed first. Thanks in advance, Regards, Serguei

2 1

Production System Specs
by Brian R Brinegar 18 Nov '02

18 Nov '02

Hello, Can anyone point me at some recommended setups for a ZEO cluster. I would like some or all of the following information: * Hardware Specs * Load Balancing * Caching Information (Apache / Squid Caches) Any information would be very helpful. Thanks, -Brian Brinegar

2 1

Re: [Zope-CMF] Creator info not properly cataloged
by Ivo van der Wijk 18 Nov '02

18 Nov '02

On Sat, Nov 16, 2002 at 11:52:12PM +0100, Ivo van der Wijk wrote: > On Sat, Nov 16, 2002 at 11:04:22PM +0100, Ivo van der Wijk wrote: > > On Sat, Nov 16, 2002 at 08:42:44PM +0100, Dieter Maurer wrote: > > > Ivo van der Wijk writes: > > > > After putting my locally developed CMF site online, I noticed that > > > > references to here/Creator were replaced with 'Anonymous User', while > > > > the object definately had a proper owner (and still has). > > > "Creator" is defined by means of "getOwner". > > > > > > The Owner of your documents is apparently wrong. > > > Check, what "owner_info" tells you for your objects. > > > > > > > It returns 'Anonymous user'. It does this, because Owned.getOwner() > > attempts to find the userfolder the user is defined in, but fails, > > because the location (relative to the physicalRoot) changed. > > > > this part of getOwner to be more specific: > > > > root=self.getPhysicalRoot() > > udb=root.unrestrictedTraverse(udb, None) > > if udb is None: > > user = SpecialUsers.nobody > > else: > > user = udb.getUserById(oid, None) > > > > > I boiled the issue down to a bug in Zope itself. Here's what happens: - Create a folder 'a' with acl_users, with user 'john' - have user john create an object 'b' in 'a' (/a/b), owned by him. - object b will have the following properties: owner_info(): 'userCanChangeOwnershipType': 1, 'id': 'john', 'explicit': 1, 'path': 'a/acl_users'} getOwner(): 'john' Note the path in owner_info: a/acl_users - this is the path of the userfolder the owner is defined in. - Now create a folder /elsewhere, *cut* (not copy) /a and paste it into /elsewhere. This will result in /elsewhere/a/b etc. - object b, now in /elsewhere/a/b will have the following properties: owner_info(): 'userCanChangeOwnershipType': 1, 'id': 'john', 'explicit': 1, 'path': 'a/acl_users'} getOwner(): 'Anonymous User' getOwner() will result the wrong Owner, unless semi-loss of ownership is expected behaviour in such cases. This is because 'path' hasn't been adjusted to the new location of the acl_users, it's no longer in /a/acl_users (that's why you had to 'cut'), but now in '/elsewhere/a'. And getOwner() (in Owned.py) explicitly resolves the userobject using this path. Does this qualify as a bug? Does anyone know a clean fix? (I've written some hacky code to fix the problem afterwards, but it would be way better to have this info updated directly after the move). Note that this problem especially occurs when exporting/importing a site with local users (such as a CMF site) from one server to another, and the relative location changes (which can be quite common when moving from a development machine to a virtual hosting environment) Cheers Ivo -- Drs. I.R. van der Wijk -=- Brouwersgracht 132 Amaze Internet Services V.O.F. 1013 HA Amsterdam, NL -=- T +31-20-4688336 F +31-20-4688337 Linux/Web/Zope/SQL/MMBase W http://www.amaze.nl E info(a)amaze.nl Network Solutions W http://vanderwijk.info E ivo(a)amaze.nl Consultancy PGP http://vanderwijk.info/pgp -=-

1 0

Suggestion - ZSQL methods should include name in error messages
by Skip Montanaro 16 Nov '02

16 Nov '02

I'm using Zope 2.5.1 (and can't upgrade for the time being). If this has been fixed in a later version, my apologies for the needless request. When a ZSQL method is called without a required input parameter, it generates an error like Missing input variable, group_id Since such methods might be called indirectly, it's not always obvious which ZSQL method was called or who called it. I would find it helpful if the error message included at least the name of the called method. Ideally, traceback information should be available as well. This particular message seems to be generated by something other than the usual error machinery. -- Skip Montanaro - skip(a)pobox.com http://www.mojam.com/ http://www.musi-cal.com/

1 0

Re: online ordering without a prescription
by Martijn Pieters 14 Nov '02

14 Nov '02

Sorry for the spam that snuck through; we had memory problems on the mail server and the spam handling facilities were temporarily off-line. -- Martijn Pieters | Software Engineer mailto:mj@zope.com | Zope Corporation http://www.zope.com/ | Creators of Zope http://www.zope.org/ ---------------------------------------------

1 0

DB.close() needs to be called
by barry＠zope.com 14 Nov '02

14 Nov '02

Looks like Toby's recent change to ApplicationManager.py causes DB.close() to never be called when you hit Shutdown in the Control Panel. This is a bad thing for the Berkeley storages because their .close() must get called or you'll end up with corrupt databases or worse <wink>. ---------------------------- revision 1.83 date: 2002/11/12 17:19:13; author: htrd; state: Exp; lines: +2 -2 dont close the storages mid-transaction. need to check whether we need to close them at the end of z2.py ---------------------------- "Um, yeah!" would be my answer. :) So here's a patch to z2.py to fix this. I won't check this in because it looks a little ugly to me and I'm not sure what the right fix is, but we definitely need to fix this before Zope 2.6.1 is released. -Barry Index: z2.py =================================================================== RCS file: /cvs-repository/Zope/z2.py,v retrieving revision 1.88 diff -u -r1.88 z2.py --- z2.py 4 Nov 2002 13:33:46 -0000 1.88 +++ z2.py 12 Nov 2002 19:15:51 -0000 @@ -909,5 +909,7 @@ import Lifetime Lifetime.loop() code = sys.ZServerExitCode +import Zope +Zope.DB.close() zLOG.LOG("z2", zLOG.INFO, 'Exiting with code %d' % code ) sys.exit(code)

8 17

defining PythonScript custom permission ?
by Andreas Heckel 14 Nov '02

14 Nov '02

Hi, I'd like to be able to define custom permissions throug ZMI that I can query within a number of PythonScript instancse. The permission should express that a set of PythonScripts are executable. The PythonScript do not return a class so the methode described at Zope Book "Class Security Assertions In Non-Product Code (External Methods/Python Scripts)" do not fit. I have a Python Workflow Product in mind that allows me to configure a set of customizable PythonScripts. I want the user to be able to create a custom permission that can be used within a set of instances. Normally Globals.InitializeClass does the job. But I'm looking for a way to define permissions at runtime that are bound to a PythonScript in several but not all product instances. Can Permission.registerPermissions be used to do that and is ther a method to unregister permissions? aeg -- _______________________________________________________________________ Andreas Heckel andreas(a)easyleading.org LINUX is like a wigwam...no gates...no windows and an apache inside ;-)

2 1

Re: [ZODB-Dev] Re: [Zope-dev] Contents of Initial Data.fs in Zope Distribution?
by Casey Duncan 14 Nov '02

14 Nov '02

On Thursday 14 November 2002 04:36 am, Steve Alexander wrote: > Casey Duncan wrote: > > > It is only there due to lack of time to take it out. We had planned to > > take it > > out for 2.6, but time was never made to replace it with code to > > bootstrap an > > empty storage with the proper root level elements still residing in > > Data.fs.in. > > IIRC, the proper root level elements are now created in code. > However, various unit tests of zope and 3rd party products rely on > having a Data.fs.in. Most are, but some still are not (notably the standard_* dtml methods). Good to know that 3rd party products rely on it. I hadn't thought of that. Do you know of one specifically? -Casey

1 0