- Zope-Dev - Zope lists

putting the 'two' back in tpc
by Leonardo Rochael Almeida 04 Jun '02

04 Jun '02

In a chat with Kapil at #zope we came to the conclusion that most Zope database adaptors don't really implement two phase commit, because they make no effort, during the 'vote' phase (the first phase of the tpc) to make sure that the commit will go thru without errors. For example, if you have the following schema in postgresql: CREATE TABLE "passwd" ( "username" character varying(64) UNIQUE, "password" character varying(64) NOT NULL, "roles" character varying(255), Constraint "passwd_pkey" Primary Key ("username") ); CREATE TABLE "userproperties" ( "username" character varying(64) NOT NULL references "passwd" (username) DEFERABLE INITIALLY DEFERRED, "propname" character varying(128) NOT NULL, "value" text NOT NULL, ); This schema allows an entry in the 'userproperties' table to exist without an equivalent user in the 'passwd' table before the end of the transaction. If, on commit, there still isn't a user with the same 'username' on the 'passwd' column, postgres will raise an error and won't let the commit go thru. Now all the current DA implementations that I know of call the database commit only in the second (or finish) phase of the tpc, which will result in a locked down Zope, as Zope is not very much fond of people bailing on him on the second phase. Now the correct solution for this, as far as postgres is concerned, is to execute the query, 'SET CONSTRAINTS ALL IMMEDIATE' in the 'vote' phase, since no other query will be executed between this query and the commit. Postgresql will raise an error while trying to execute this query if any coinstraint is yet to be satisfied, so Zope will be able to cancel the transaction to all those registered in the transaction machinery. And if the postgresql documentation is correct, 'SET CONSTRAINTS...' is an SQL92 and SQL99 standard, so other db's might be able to benefit from this. The problem is that lib/python/Shared/DC/ZRDB/TM.py doesn't provide a _vote() slot which should be called by tpc_vote(). TM documentation should mention that this slot should be overriden, just like _finish() and _abort(). It should also mention why this slot should be overriden ("consistency this, consistency that, yadda yadda.."). The nazi bastard in me wants the default implementation of this slot to raise an error to remind people to override it. If your DA doesn't need, or can't, implement a _vote() for some reason, you should explicitly override it to do nothing. However I know that breaking other people's DA is not nice :-) The not so nazi bastard in me says that the default _vote() implementation should zLOG a warning about '_vote()' not being implemented, but I know that even this might be too much to ask, since logfiles everywhere would go crazy. Anyway, this may be a little late, but I believe that implementing a do-nothing _vote() that is called by TM.tpc_vote() is a small and unintrusive change but a change that is important enough to deserve to be included in 2.6, so that DA authors take notice and implement it where possible. I'd volunteer to make this change myself if my commiter's agreement had been commited (I'm looking at you Paul Everitt). I know that I'll bug the Psycopg guys once this change is thru. Leo -- Ideas don't stay in some minds very long because they don't like solitary confinement.

2 1

[Zope] PDF generation from products methods
by Thierry Florac 04 Jun '02

04 Jun '02

Hi... I've found, in http://www.zope.org/Members/mjablonski/howtoPDF, a way to produce PDF documents from Zope basic HTML outputs. But what I'd like to do is to be able to produce PDF documents from any HTML output, including : - output generated by forms requests, - output generated by any product method Any idea ?? Thanks, Thierry

2 1

ZCatalog and not registered clasees
by Vincenzo Di Somma 04 Jun '02

04 Jun '02

Hi all, I have a product with a main class (registeredin the __init__.py) and some utility classes I don`t want to register, does the ZCatalog have problem finding istances of not registered classes ? I`m not able to index them. -- Vincenzo Di Somma - Responsabile Ricerca e Sviluppo - Icube S.r.l. Sede: Via Ridolfi 15 - 56124 Pisa (PI), Italia E-mail: e.disomma(a)icube.it WWW: www.icube.it Tel: (+39) 050 97 02 07 Fax: (+39) 050 31 36 588

1 1

login method problem
by Aseem Mohanty 04 Jun '02

04 Jun '02

Hi All, I wrote a simple UserFolder application that did not use any cookies or the session management stuff. The UserSource was a MySQL db. ( Tried mysqlUserFolder but it was too restrictive interms of database structure for my purposes ). I then used ZSession to handle session and cookie management and it works great. When I have a Authenticated-View only folder the browser pops up a box and I need to login. It authenticated from the db and I go on my merry way. What I am trying to do is to is to have a logon form that allows the user to logon, verifies the user and redirects it to a members page. However it doesnt seem to do that. The login and the logout functions are given below. 'validate' is the method that is called everytime Zope decides on the roles and whther the role by the user has access to the resource. user_login__roles__ = None def user_login (Self, REQUEST, RESPONSE, username, password, create_global = 1, login_goto_path = "../../members/"): # Create authorization variable ac = encodestring('%s:%s' % (username, password)) auth = 'Basic %s' % ac Self.validate(REQUEST, auth) return RESPONSE.redirect (login_goto_path) user_logout__roles__ = ['MySQLUserRole'] def user_logout (Self, REQUEST,RESPONSE): """ Terminates user session """ user = Self.check_valid_mysql_user (REQUEST) Self.__terminate_session(REQUEST) realm=RESPONSE.realm RESPONSE.expireCookie('__ac',path='/') RESPONSE.expireCookie('_ZSession',path='/') RESPONSE.setStatus(401) RESPONSE.setHeader('WWW-Authenticate', 'basic realm="%s"' % realm, 1) RESPONSE.setBody("""<html> <meta http-equiv="refresh" content="0; URL=http://kandinsky:8080/test_folder/logged_out"> <head><title>Logout</title></head> <body> <p> You have been logged out. </p> </body> </html>""") return The problem is that even when I login and 'validate' accepts the credentials, the browser still pops up a box. What am I doing wrong?? . The logout works fine but there is a minor problem in that too which I had posted earlier. TIA. Aseem -- ================================================================== Aseem Mohanty Neurobehavioral Systems Inc, 828 San Pablo Ave, Albany, CA 94706 (R) 510 7696011 (M) 510 3014871 (O) 510 5279231 ================================================================== "I saw `cout' being shifted "Hello world" times to the left and stopped right there!!" -- Steve Gonedes ==================================================================

1 0

fsrecovery in Zope 2.4 ?
by Julián Muñoz 03 Jun '02

03 Jun '02

In Zope 2.5 CHANGES.txt is said "Provided a much more robust tool for recovering data from damaged FileStorage files" I would like to know what tool it is. Is it lib/python/ZODB/fsrecovery.py ?? As I can't upgrade to Zope 2.5 now, I would like to know if it is possible to install and use this tool on Zope 2.4, because the gain in case of a catastrophe seem very interesting. Thank you very much for you atention, -- Saludos de Julián EA4ACL -.-

2 2

Dynamically add an external method at startup
by Emile van Sebille 03 Jun '02

03 Jun '02

I'm trying to exploit a product's initialize method and have it add external methods to a zope installation. What I've cobbled together so far is: import Zope import ZODB from Products.ExternalMethod.ExternalMethod import ExternalMethod import OFS def addExternalMethod(self, id, title, module, function, REQUEST=None): """Add an external method to a folder""" id=str(id) title=str(title) module=str(module) function=str(function) i=ExternalMethod(id,title,module,function) #self._setObject(id,i) def initialize(context): """Initialize the product""" addExternalMethod(None, "MethID", "MethTitle", "Module", "Function") I don't get errors at start up, and of course my "product" isn't registered, but can anyone tell me what self wants to be in addExternalMethod and how I could get there from initialize(context)? Thanks, -- Emile van Sebille emile(a)fenx.com ---------

2 3

[Zope] Security and external methods
by Thierry Florac 03 Jun '02

03 Jun '02

Hi... I have a question with a security related problem. I've written a script to produce PDF output from any HTML output, as described in http://www.zope.org/Members/mjablonski/howtoPDF My problem is that with this simple script, I can get access to protected pages without giving any authentication... Is it normal, and how could I avoid this ?? Thanks for any help or advise... Thierry P.S. : I didn't subscribe to this list, but send this message to it because I thought it was the best one for this. So please reply to me as well as to the list...

1 0

Zope 3 Installation
by Eddie Moench 03 Jun '02

03 Jun '02

Can someone tell me, how to get the Zope 3 (from the CVS) up and running? After correcting the verify-import (there was a case-problem), I get the error message "cannot import name Interface" by the command "from Interface import Interface" - which is called by many scripts. Does anyone had the same problem and knows a solution? Thanks, Eddie. Eddie Mönch Pre-Sales Consulting & Software Development moench(a)ontoprise.de ontoprise GmbH phone: +49 721 - 665 79 - 13, fax: +49 721 - 665 79 - 11 Haid-und-Neu-Str. 7, D-76131 Karlsruhe, Germany

3 2

logout and IE6 problems
by Aseem Mohanty 03 Jun '02

03 Jun '02

Hi All, Pardon the cross post, since I dont know where exactly my problems lie... I am running Zope 2.5.0 (binary release, python 2.1, win32-x86), python 2.1.2, win32 on a Win2k machine with a MySQL server. I just wrote my first UserFolder based on the mysqlUserFolder product, but with some customized stuff to suit my needs. I basically did not use mysqlUserFolder's session and cookie management and instead, am using ZSession for session management. Finally after several days work I have everything running, barring two problems, one doesnt matter much, the other is a gift of the evil empire which I havent figured out as yet. The first problem: For logout purposes I used the function that handles the logout in ZMI and call it from a form; the function is as follows: def user_logout (Self, REQUEST,RESPONSE): """ Terminates user session """ user = Self.check_valid_mysql_user (REQUEST) Self.__terminate_session(REQUEST) realm=RESPONSE.realm RESPONSE.expireCookie('__ac',path='/') RESPONSE.expireCookie('_ZSession',path='/') RESPONSE.setStatus(401) RESPONSE.setHeader('WWW-Authenticate', 'basic realm="%s"' % realm, 1) RESPONSE.setBody("""<html> <meta http-equiv="refresh" content="0; URL=http://xxxx:8080/test_folder/logged_out"> <head><title>Logout</title></head> <body><p>You have been logged out.</p> </body></html>""") return It basically does the job beutifully and I have no problems. What I would like to do however is to be able log back in when prompted for a login and password as a result of this call. I tested the ZMI interface and it does the same too : once you log-out you have to cancel the prompt box and then try and access a protected resource to get logged back in. I tested the control flow and as a matter of fact when I enter the right username/password combo it goes through 'validate' and authenticates it all right but just doesn't accept it and sends another 401. Any ideas as to hwo to get around that would be great....!! The second problem: All of the above works nicely with all versions of Netscape. On IE versions 5.01 and above however, it behaves exceptionally badly. In that I can login and a nice little session variable is created, and the cookies are set up, and when I log out, the sessions are cleared and cookies thrown out and I get prompted to log in which if I cancel, I get booted to the logged out page. All nice and clean. However if I press the back button or type in the URL of a protected resource it sends the authentication information back and I am not prompted to log back in. On looking at the session and cookie info, I found that a new one had been created with the same auth information. "It just ignored the HTTP 401 !!!" Now I dont know if that is a bug in IE ( I am inclined to believe it is!! ), but I have tested my package pretty exhaustively and it works without fail in all NS and upto IE 5.0. If anybody has encountered the problem before and has figured out how to deal with it 'without' closing all IE windows, I would be immensely grateful if s/he could pass on the information. Thanks for you collective patience. Aseem ================================================================== Aseem Mohanty ================================================================== "I saw `cout' being shifted "Hello world" times to the left and stopped right there!!" -- Steve Gonedes ==================================================================

1 0

Weird permission happenings: Is Manager magic?
by Lennart Regebro 01 Jun '02

01 Jun '02

This is the situation: Zope 2.5.1/Python 2.1.3 I'm calling index_html on an object. Index_html in turn finds a template and calls "template.view(self)" on it. The template.view pushes itself on the context inbetween the object and the objects parent, thusly: object.aq_parent thetemplateobjects object It then calls "DTMLMethod.__call__( context, REQUEST, RESPONSE)" to render the DTMLMethod that contains the template itself, and thereby render the object. This works very well, for all purposes except when it comes to security. In the DTMLMethod that contains the HTML I can for example do this: <dtml-var "AUTHENTICATED_USER.has_permission('View', this)"> And here comes the weird part: If I am logged in as a user who has the Manager role, the result will be "1" of the above dtml-var, as expected. However, if I log in as a user who is not Manager, the result will be "None", no matter if the user has the permission or not! I have create a role that has all permission in the root. All permissions are aqcuired over the whole site (which is a very small development site), and still the above returns "None"! So, is there something magic about the Manager role? Best Regards Lennart Regebro Torped Strategi och Kommunikation AB

1 1