March 1999 - Zope - Zope lists

AUTHENTICATED_USER
by JP Glutting 02 Mar '99

02 Mar '99

Does anyone have any more information on AUTHENTICATED_USER? We saw a while back that it has properties (AUTHENTICATED_USER.has_role(['Manager', 'Editor'])). I would like to be able to get the user name, and use that to index simple files for users. Is there something like AUTHENTICATED_USER['UserName']?? This is essentially the information that is returned if you try . However, if you try something like , it does not work. The only way I have been able to use this information so far is to put <INPUT TYPE=hidden name=userID value=""> in a form, and pass it in a REQUEST to another page. But I want to be able to get this information directly. I have even tried REQUEST.set('myUser', AUTHENTICATED_USER) inthe header, but this has the same problem (unsurprisingly) as AUTHENTICATED_USER itself. Any hints? Thanks, JP

3 2

Re: [Crew] Re: [Zope] Re: [Crew] Re: External Methods?
by Aaron Watters 02 Mar '99

02 Mar '99

Suggestion: for python-python data transfer and storage XML-RPC is overkill. Python already has marshal which will be a lot faster and I think do the same thing. Also, if you haven't, please have a look at what I did using gadfly and cgi. I know it's more conventional and hence boring, but nevertheless... http://starship.skyport.net/crew/aaron_watters/kwParsing/chatcgi.cgi (source included). -- Aaron Watters

1 0

RE: [Zope] Re: [Crew] External Methods?
by Brian Lloyd 02 Mar '99

02 Mar '99

> I understand the security problems inherent in > ExternalMethods; unfortunately, > without them, Zope is merely an "also-ran" in the web > applicaton race, from my > perspective. DTML in isolation is not an "ASP-killer." > > I'm CC'ing the Zope list, in hopes that someone there can > either allay or slay > our fears. > > It seems to me that the security problem is that > ExternalMethods can get access > to "sibling objects" of the object on which they are invoked, > right? I mean, if > we could make the siblings inaccessible, and acquired > properties read-only, then > we should be ok, no? Ugh, I don't grok acquisition well > enough to tackle that > myself, I fear. Well, it's actually deeper than that. You are correct in saying that DTML alone is not an ASP-killer. Consider the similarities between Zope and, for example, ASP/COM (though the same holds true for practically any other system as well): ASP lets you use the services provided by (COM) objects, which may be provided by the server or provided independently. I'm sure that MS tries to make the server-provided objects fairly safe, but there is _nothing_ stopping a programmer from writing and installing a COM object with an evil() method that wipes out your C: drive, except the fact that presumably the sysadmin exercises some control over making these independent services available. The same holds true for Zope (and any other app server out there). Like ASP/COM, External Methods give you the ability to provide more powerful services for use by your application. It also gives you exactly the same problems (though I'm sure that evil() method could be developed in a quarter of the time in Python :) Basically, with power comes responsibility, and I can't really imagine any system that could _safely_ allow possibly-untrusted people to write (basically) arbitrary code. It's not even really a matter of what services are or are not available to those people. I'm sure that many, many hours and much brain-power went into the design of Java's security mechanisms. Even so, if I were a web site manager I still couldn't let untrusted users write their own arbitrary java code to run in my web or app server. Even after I had figured out a way to wall off every service I could think of that could possibly be harmful, the user could still probably just do the Java equivalent of: while 1: pass Zope DTML goes to a good deal of trouble to minimize these problems in DTML itself, and we would certainly consider any concrete ideas on how to make External Methods safer. Can you give me some examples of other app servers that you feel deal with safety of external services in a better way? I'd be happy to do some looking into how others are dealing with this. Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

5 5

RE: [Zope] Anyone want to give a talk about Zope at WWW8?
by Paul Everitt 02 Mar '99

02 Mar '99

David wrote: > http://www.utoronto.ca/ian/WWW8/sessions.html > > See session 6, run by our friend Cameron Laird. Actually I emailed a talk proposal for the last one (Brian Behlendorf's Open Source one). --Paul

1 0

FTop level name
by rwolff＠noao.edu 02 Mar '99

02 Mar '99

This feels so dumb but: How do I change the manage page so it says, for example, "Plutonia" next to the top folder, instead of "Zope"?

1 0

ZMySQLDA installation
by Timothy Grant 02 Mar '99

02 Mar '99

Hi all, This is probably more of a newbie Linux question than a newbie Zope question, but I'm going to ask it here anyway: I would like to connect Zope to a database, so I have setup both PostgreSQL and MySQL. My reading tells me that MySQL is probably the better choice as a web backend (Any comments from those of you more knowledgable than I would be appreciated!) So I downloaded the MySQL source, compiled, installed and tested it. It looks like I did it right. I then downloaded the ZMySQLDA from the Zope site. I have followed the directions--I think, but get the following error when trying to do the initial make: [tjg@puddleglum src]$ make -f Makefile.pre.in boot rm -f *.o *~ rm -f *.a tags TAGS config.c Makefile.pre python sedscript rm -f *.so *.sl so_locations VERSION=`python -c "import sys; print sys.version[:3]"`; \ installdir=`python -c "import sys; print sys.prefix"`; \ exec_installdir=`python -c "import sys; print sys.exec_prefix"`; \ make -f ./Makefile.pre.in VPATH=. srcdir=. \ VERSION=$VERSION \ installdir=$installdir \ exec_installdir=$exec_installdir \ Makefile make[1]: Entering directory `/usr/local/zope/Zope-1.10.0pr1-linux2-x86/lib/pytho n/Products/ZMySQLDA/src' make[1]: *** No rule to make target `/usr/lib/python1.5/config/Makefile', needed by `sedscript'. Stop. make[1]: Leaving directory `/usr/local/zope/Zope-1.10.0pr1-linux2-x86/lib/python /Products/ZMySQLDA/src' make: *** [boot] Error 2 Any help would be greatly appreciated. -- Stand Fast, tjg. =================================================== Timothy Grant VP Technology/CTO Avalon Technology Group tjg(a)avalongroup.net www.avalongroup.net (503) 246-3630 voice (503) 246-3124 fax _______________________________________________ Zope maillist - Zope(a)zope.org http://www.zope.org/mailman/listinfo/zope

3 2

ZPublisher or Bobo and stdout
by Dr. Armin Tschammer 02 Mar '99

02 Mar '99

Hi, The followowing problem seems very fundamental to me. I already did a post to this group to this topic and I got the following answer: On Wed, 13 Jan 1999, Dr. Armin Tschammer wrote: > I publish the following Modul with Bobo: > Very simple: > > hello.py: > > import sys, os, time > import DocumentTemplate > > lib=sys.path[0] > sys.path.append(os.path.join(lib,'DT')) > > def hello(): > "Display a greeting" > # print "rrr" > X3 = DocumentTemplate.HTMLFile(lib+'/hello.dtml') > return X3() > Now, when I make the commentated line print "rrr" active, I get > Internal Server Error The "print" goes directly to the webserver, which confused it: it expects HTTP headers like "HTTP/1.0 200 Okay". The "return" sends your data to *Zope*, which then does the header stuff for you. Same with cookies, content-type, etc. Summary: dont use 'print', or redirect stdout to a log file. Now the problem is deeper, what shall I do when I am import C++ Modules in Python ( extending Python), and that modules are writing to the stdout via "cout" or "printf", I have no influence to that. If I change the stdout via "freopen( "file, "wr", stdout )" or stuff like that, I have no chance to switch back to the *real* stdout ( look at the c-faq of comp.lang.c ), and I *have to* switch back because of the cgi-mechnism, which uses ZPublisher. The only the chance to handle stuff like that is to work with two processes in the Zopemechanism. A Zopeserver which tells the Zope Client to start a pythonfunction. Now all stdout happens on the client and the server listen for a string on a socket ( or something similar ). Now when the server gets the string it does all necessary wrapping ( content-type and so on ), and send it to the Xserver via its stdout. Or is there a less complicate solution ? Thanks in advance Armin

2 1

RFQ: Upgd Netscape 2.x auth patch to Netscape 3.5.x
by Rob Page 02 Mar '99

02 Mar '99

Hello everyone: Some of you may know that many moons ago we (Brian) developed a plug-in for Netscape Enterprise Server (ES) 2.x (and FastTrack -- based on the same libraries) that addressed Netscape's nasty habit of removing authenticated_user information from the environment before calling CGI apps. Obviously, this has a deleterious effect on interesting zope applications. Fortunately (?), we are up to our armpits in projects and initiatives. As a result, we need someone to do a bit of work to upgrade the plug-in from ES 2.x to ES 3.5.x. I can provide the following files from our 2.x incarnation: o plug-in source code o obj.conf o magnus.conf The source code is only 153 lines of generously formatted C (w/lots of defs) so I'm hopeful that this isn't a HUGE task. I'm interested in hearing quotes from people in the community that have experience with the NSAPI and would, for a reasonable fee, develop, compile (Solaris 2.6 and NT4) and test an upgraded plug-in. The work would be contributed back under the ZPL. Naturally, I'd also entertain offers from people to do this for free! :^) --Rob P.S. - I KNOW there are some NSAPI wizards out there so don't be shy! -- Rob Page V: 540 371 6909 Digital Creations http://www.digicool.com

1 0

trouble running zope-1.10.2 (freebsd, python 1.5.1)
by Oyvind Moll 02 Mar '99

02 Mar '99

Trying to get started with Zope on a FreeBSD machine. I did the following: * Downloaded source distribution of Zope-1.10.2 * Extracted it * cd into directory and ran 'python wo_pcgi.py' (no error messages) * ./start I then get the following in var/serve.log (slightly edited for slightly more readability): Traceback (innermost last): File "serve.py", line 90, in ? ZopeHTTPServer.main(sys.argv[1:]+[os.path.join(os.getcwd(),'lib','python','Main.py')]) File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/ZopeHTTPServer/ZopeHTTPServer.py", line 498, in main start(module_file,host,port,threading,env) File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/ZopeHTTPServer/ZopeHTTPServer.py", line 436, in start set_published_module(module_file,BoboRequestHandler,env) File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/ZopeHTTPServer/ZopeHTTPServer.py", line 432, in set_published_module __import__(name) # to catch problem modules right away File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/lib/python/Main.py", line 90, in ? from BoboPOS import SimpleDB, TJar, SingleThreadedTransaction File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/lib/python/BoboPOS/__init__.py", line 99, in ? import SingleThreadedTransaction, Persistence, PickleDictionary File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/lib/python/BoboPOS/SingleThreadedTransaction.py", line 110, in ? from PickleDictionary import PickleDictionary File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/lib/python/BoboPOS/PickleDictionary.py", line 91, in ? import marshal,time,Persistence,SimpleDB, PickleJar File "/usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/lib/python/BoboPOS/SimpleDB.py", line 104, in ? from cPickle import Pickler, Unpickler ImportError: /usr/home/taiga/oyvindmo/work/Zope-1.10.2-src/lib/python/cPickle.so: Undefined symbol "PyExc_IOError" I don't have any experience with Zope or even Python, but am I right in guessing that this looks like a problem with the python binary and not with Zope? Any ideas to precisely what the problem might be? python is v1.5.1. C compiler used is gcc 2.7.2.x. -- Øyvind Møll oyvindmo(a)pvv.ntnu.no

1 1

RE: [Zope] Zope and Apache - again
by Paul Everitt 02 Mar '99

02 Mar '99

raver wrote: > I give up! That's unfortunate, but we understand. Getting *anything* to work with Apache's mod_rewrite module is quite a chore. It doesn't help that distributions like RedHat 5.2 ship it in a broken way, then people blame us for it, then we track down a problem that is completely outside Zope. Did you follow the recommendations to start with the built-in webserver before trying integrate with Apache? If so, did that work? --Paul Paul Everitt Digital Creations paul(a)digicool.com 540.371.6909

2 1