- Zope-Dev - Zope lists

restrictedTraverse
by Florent Guillaume 19 May '02

19 May '02

With an object path /A/B/C where C has a local role allowing a user to view C but where B disallows acquisition of the View permission, the publisher correctly allows the user to see C. However restrictedTraverse('/A/B/C') fails ("You are not allowed to access B in this context"). This is because restrictedTraverse checks the security (using "validate") at *every* step, and obviously the user is not allowed to see B. Is there a reason for this ? Why not simply validate only at the last step ? I have the need to programatically access object protected in such a way. The workaround I'm going to use in my code for now is to call unrestrictedTraverse and validate() by hand the resulting object. But I'm concerned that there may be a more profound security reason I'm missing. Florent -- Florent Guillaume, Nuxeo (Paris, France) +33 1 40 33 79 87 http://nuxeo.com mailto:fg@nuxeo.com

2 3

Re: [ZPT] Order of attribute execution Feature Request
by Jim Penny 18 May '02

18 May '02

On Thu, May 09, 2002 at 04:07:14PM -0400, Ken Manheimer wrote: > On Thu, 9 May 2002, Dieter Maurer wrote: > > > Chris Withers writes: > > > Jim Penny wrote: > > > > 2) that is introduces some additional, fairly baroque magic in the > > > > "order of execution of element type" definitions. I would have > > > > preferred that they be evaulated/performed in textual order. > > This is a case where i'd say "baroque" is intemperate. The documention > ( http://dev.zope.org/Wikis/DevSite/Projects/ZPT/TAL%20Specification%201.4 ) > not only specifically declares the order of operations operations, but it > goes on to describe the rationale behind them! > > > Now, if you _disagree_ with the choices, and can cite cases which > substantiate your reasoning, then great, file a collector issue! But > calling it baroque implies that it's overelaborate and/or obscure to the > informed user - neither of which seems, to me at least, to be the case. > > > > I'd second that... where do we stick feature requests like this? > > I would assume it's the Zope collector. I suppose you could add comments > in the ZPT wiki, as well. If you see a glaring error, and feel it > warrants stirring up a lot of attention, then post something to zope > coders - but you've both been pretty vague about your complaints, i don't > have the impression you are chafing from some particular error. > Now, Ken, I think you ought to reread the thread. Chris has consistently defended ZPT, except for this one "feature". I am ambivalent towards ZPT, but have stated that I will be, and am in fact, moving towards using them nearly exclusively. I am in this because I felt that someone was being dumped on for daring to suggest that DTML is at least cosmetically better. I have also said that, while ZPT is not as warty as DTML, ZPT looks, on the surface, to be pretty ugly. I have said that there are three specific things I dislike about ZPT -- 0) lots of things have changed spelling again -- request v. REQUEST, here v. context v. container v. this v. ? 1) infix notation that makes program scansion hard, 2) the order of operations, which I think is baroque. Six levels of precendence for eight statements is pretty amazing. And it is certainly harder to explain/remember than "things happen in the order you specify." I will add a fourth nit -- I cannot see why attributes should be plural when every other command is singular. Certainly it feels like attribute ought to be an acceptable spelling of the atttributes command! Now I will turn around and say what I do like about ZPT. Well-formed-ness is indeed nice. The reduction of magic in variable lookup is nice. The "| nothing" convention is very nice when used content or replace statements -- it makes it very easy to use the same form for both input and error processing -- something that is almost by itself worth the price of admission. In fact, this is not really mentioned in the ZopeBook or ZPT Reference, it is shown only (on page 143) in combination with an unnecessary condition command. I also missed the "| default" convention that I can see as very useful. My most-missed DTML feature has not been mentioned at all -- it is not loop batching -- it is the dtml-else option of dtml-in -- which made it much easier to handle the "nothing found" case. I also have not found a convention that I am comfortable with on handling check-boxes and radio buttons in error processing. But I expect to! Jim Penny > > I think the order is irrelevant because the DOM considers > > attributes unordered. Not good to implement things against the standard > > model. > > Attributes are unordered in the traversal, but of course the processing of > the resulting structure (the semantics) is up to the application! And the > documentation is very clear about how the application behaves - with good > motivation. > > > Furthermore, changing this facet in the implementation will break > > lots of exiting templates. > > > > Where do we condemn feature requests like this? > > :-) > > I imagine whoever is responsible for PageTemplates will float a proposal > for changes if they're convinced any are necessary. > > -- > Ken > klm(a)zope.com >

18 64

Re: [Zope-dev] Zope process killed
by Anthony Baxter 18 May '02

18 May '02

> It very nice to hear that I can simply upgrade and my problem will go away :) > And it did! Just thought I'd mention this since I didn't find anything > in the collector about it. maybe not in the zope collector, but there's several copies of it (and variants) in the python bugtracker :) If there was a Zope FAQ, I'd say this one'd get an entry. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0

Re: [Zope-dev] Zope process killed
by Anthony Baxter 18 May '02

18 May '02

>>> =?ISO-8859-1?Q?Roch=E9?= Compaan wrote > When I try to view or delete a particular folder the Zope process (on > Zope 2.4.3) suddenly gets killed with this message in the log: > > python2.1: Python/ceval.c:695: eval_code2: Assertion `(stack_pointer - > f->f_valuestack) <= f->f_stacksize' failed. You should be running 2.4.4 or 2.5.1. This is a known bug in 2.4.3. (It only shows up under python 2.1.3 or later - earlier versions of python silently corrupt memory). Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

3 2

Zope process killed
by Roché Compaan 18 May '02

18 May '02

When I try to view or delete a particular folder the Zope process (on Zope 2.4.3) suddenly gets killed with this message in the log: python2.1: Python/ceval.c:695: eval_code2: Assertion `(stack_pointer - f->f_valuestack) <= f->f_stacksize' failed. I climbed into the python debugger and found the place where this happens. The culprit is a particular python script inside this folder and as soon as the the setstate method is called on this script this happens. The exact place is in the "_newfun" function in PythonScripts.py on line 315: exec code in g, l. here is the ouput of locals() if this might help: {'g': {'_getattr_': <function guarded_getattr at 0x8372b0c>, '_getitem_': <function guarded_getitem at 0x83720ec>, '_write_': <function guard at 0x81d68d4>, '_print_': <class RestrictedPython.PrintCollector.PrintCollector at 0x81d0994>, '__builtins__': {'cmp': <built-in function cmp>, 'round': <built-in function round>, 'AttributeError': <class exceptions.AttributeError at 0x80ce214>, 'random': <module 'random' from '/usr/lib/python2.1/random.pyc'>, 'str': <built-in function str>, 'range': <built-in function range>, 'ArithmeticError': <class exceptions.ArithmeticError at 0x80cf10c>, 'whrandom': <module 'whrandom' from '/usr/lib/python2.1/whrandom.pyc'>, 'unichr': <built-in function unichr>, 'list': <built-in function list>, 'FloatingPointError': <class exceptions.FloatingPointError at 0x80c8c9c>, 'getattr': <function guarded_getattr at 0x8372b0c>, 'hasattr': <function guarded_hasattr at 0x837414c>, 'setattr': <function guarded_setattr at 0x81d6ae4>, 'IndexError': <class exceptions.IndexError at 0x80cd9f4>, 'TypeError': <class exceptions.TypeError at 0x80cce24>, 'delattr': <function guarded_delattr at 0x81d6b1c>, 'AssertionError': <class exceptions.AssertionError at 0x80ce9cc>, 'divmod': <built-in function divmod>, 'ord': <built-in function ord>, 'ZeroDivisionError': <class exceptions.ZeroDivisionError at 0x80cf42c>, '__import__': <function guarded_import at 0x8372cd4>, 'callable': <built-in function callable>, 'len': <built-in function len>, 'repr': <built-in function repr>, 'max': <built-in function max>, 'tuple': <built-in function tuple>, 'StandardError': <class exceptions.StandardError at 0x80cccc4>, 'string': <module 'string' from '/usr/lib/python2.1/string.pyc'>, 'hash': <built-in function hash>, 'isinstance': <built-in function isinstance>, 'Exception': <class exceptions.Exception at 0x80cc914>, 'map': <function guarded_map at 0x8373314>, 'math': <module 'math' from '/usr/lib/python2.1/lib-dynload/math.so'>, 'oct': <built-in function oct>, 'OverflowError': <class exceptions.OverflowError at 0x80cf28c>, 'IOError': <class exceptions.IOError at 0x80cd724>, 'test': <function test at 0x834e384>, 'filter': <function guarded_filter at 0x8372294>, 'abs': <built-in function abs>, 'chr': <built-in function chr>, 'NameError': <class exceptions.NameError at 0x80cdf1c>, 'long': <built-in function long>, 'hex': <built-in function hex>, 'complex': <built-in function complex>, 'EOFError': <class exceptions.EOFError at 0x80cdab4>, 'min': <built-in function min>, 'reorder': <function reorder at 0x83170b4>, 'OSError': <class exceptions.OSError at 0x80cd88c>, 'same_type': <function same_type at 0x834e5fc>, 'RuntimeError': <class exceptions.RuntimeError at 0x80cdc1c>, 'LookupError': <class exceptions.LookupError at 0x80ceb44>, 'apply': <built-in function apply>, 'EnvironmentError': <class exceptions.EnvironmentError at 0x80cd50c>, 'unicode': <built-in function unicode>, 'ValueError': <class exceptions.ValueError at 0x80c8e24>, 'issubclass': <built-in function issubclass>, 'ImportError': <class exceptions.ImportError at 0x80cd394>, 'None': None, 'KeyError': <class exceptions.KeyError at 0x80cef94>, 'float': <built-in function float>, 'SyntaxError': <class exceptions.SyntaxError at 0x80ce37c>, 'pow': <built-in function pow>, 'int': <built-in function int>, 'sequence': <module 'DocumentTemplate.sequence' from '/home/roche/Zope/lib/python/DocumentTemplate/sequence/__init__.pyc'>, 'DateTime': <class DateTime.DateTime.DateTime at 0x832e104>}, '__debug__': 1}, 'l': {}, 'code': <code object <module> at 0x8a465c0, file "Script (Python)", line 1>, 'self': <PythonScript instance at 89beb20>} (Pdb) c python2.1: Python/ceval.c:695: eval_code2: Assertion `(stack_pointer - f->f_valuestack) <= f->f_stacksize' failed. Any help will be much appreciated. -- Roché Compaan Upfront Systems http://www.upfrontsystems.co.za

3 2

getitem in python script
by Eddie Moench 14 May '02

14 May '02

is there a possibility to use the getitem method in python scripts? My concrete problem is as follows: I have a parameter - say folder - as input and just want to jump into that folder: the script: return container.getitem('folder').id does not work! Has anyone a solution? Thanks, Eddie.

2 1

AW: Zope-Dev -- confirmation of subscription -- request 652066
by Eddie Moench 14 May '02

14 May '02

confirm 652066

1 0

Permission Question
by Andre Schubert 14 May '02

14 May '02

Hi all, i have i question on the permission-system of zope. Lets say i have a product which contains a zclass "foo" and i have created a role "foo_role" where every user belonges to this role is able to add "foo" instances. This works fine. But how do i define my permissions so, that all users which belong to "foo_role" are able to delete "foo"-instances. I created a zope-permission "Delete Foo objects", then i mapped this permission to "Delete objects" in the zclass "foo" like the mapping from "Add Foos" to "Create class instances". But this doesnt work. Can anyone help me... Thanks in advance

2 2

Can I get rid of standard_template.pt?
by Lennart Regebro 13 May '02

13 May '02

I'm not using it, and will never use it, so why does Zope 2.5.1 always create one for me? Grrr. Highly annoying. >:-[

7 8

Zope Backup/Recovery
by Richard McKinley 13 May '02

13 May '02

I recently managed to lock myself out of zope. Is there a way to recover/copy the database containing the DTML documents/ZSQL methods etc. to a new installation? I have had no success in logging into zope with the new superuser I created.. Thanks, Richard _________________________________________________________________ Join the worlds largest e-mail service with MSN Hotmail. http://www.hotmail.com

2 1