March 1999 - Zope - Zope lists

RE: [Zope] AUTHENTICATED_USER
by Brian Lloyd 02 Mar '99

02 Mar '99

> Does anyone have any more information on AUTHENTICATED_USER? > We saw a while > back that it has properties (AUTHENTICATED_USER.has_role(['Manager', > 'Editor'])). I would like to be able to get the user name, > and use that to > index simple files for users. Is there something like > AUTHENTICATED_USER['UserName']?? This is essentially the > information that is > returned if you try . However, > if you try > something like , it does not > work. AUTHENTICATED_USER itself is an object -- the reason  gives you the user name is that it effectively does an str() on the user object. To work with the user name directly, you can use the getUserName() method of the user object:  Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

RE: [Zope] DCOracle free for use for internal purposes ?
by Paul Everitt 02 Mar '99

02 Mar '99

Andreas writes: > we want to use the DCOracle module for Python inside a commercial > production > process in our house. We don't sell a product with DCOracle > nor we redistribute DCOracle in any form. Is the use of DCOracle > for this purposes free ? Yes, DCOracle is free and Open Source. --Paul

1 0

RE: [Zope] terminating DTML parsing...
by Paul Everitt 02 Mar '99

02 Mar '99

Anthony wrote: > from inside DTML, is there a way to say "don't process any > further DTML, > just return this to the user"? Umm,  ?? --Paul

2 1

DCOracle free for use for internal purposes ?
by Andreas Jung 02 Mar '99

02 Mar '99

Reply-To: Hello, we want to use the DCOracle module for Python inside a commercial production process in our house. We don't sell a product with DCOracle nor we redistribute DCOracle in any form. Is the use of DCOracle for this purposes free ? Thanks Andreas

1 0

Re: [Zope] Bobo distribution
by Stefan Franke 02 Mar '99

02 Mar '99

Bobo is now called "ZPublisher". You dan download it separately on http://www.zope.org/Download/ZPublisher Stefan Andrey V Khavryutchenko wote: > Hi! > > I'm looking for Bobo (not Zope) distribution tarball. Looks like it > is > taken from the web away. > > I need to create very simple application. Zope is an overkill for it. > > Anyone? > > -- > SY, Andrey V Khavryutchenko http://www.kbi.kiev.ua/~akhavr > > Shick's Law: > There is no problem a good miracle can't solve. >

1 0

RE: [Zope] DTML #var null= problem/patch
by TFE MMS JARVIS JOHN 02 Mar '99

02 Mar '99

Thank you for pointing out how to fix this. At first, the patch didn't work with ZSQLMethods until I made a small change: 271a272,274 > #richard jone's null patch --- slightly modified by jj > elif have_arg('null') and not val: > val = args['null'] val wasn't set to None and so the null attribute never got used. Since None is false, the above should be OK. (It seems to work for me, anyway :^) John Jarvis Tokyo Electron, FE Ltd. > -----Original Message----- > From: richard.jones(a)fulcrum.com.au [SMTP:richard.jones@fulcrum.com.au] > Sent: Monday, March 01, 1999 8:31 AM > To: Philip Aylesworth > Cc: zope(a)zope.org > Subject: Re: [Zope] DTML #var null= problem/patch > > > [Philip Aylesworth] > > Does your patch mean that I don't need a fmt= atribute? > > Yes. > > > > Are you using 1.9 or 1.10? > > Does 1.10 do the same thing? > > My patch was against 1.10 > > > > Should you send this to the collector? From the documentation I expected > it > > to work without the fmt= atribute, therefore, it could be considered a > bug, > > right? > > Yep, I've submitted a report to the Collector. > > > Richard > > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope

1 0

Re: [Zope] ANNOUNCE: FAQ Tool sample Zope app.
by Gary Stephenson 02 Mar '99

02 Mar '99

Amos Latteier wrote: <bobbit> > > > But the levered faq product .DAT file apparently failed to > >unpickle - as described by others in this thread. > > Can you tell me why you believe this to be the case? > I assumed that the .DAT file contained all the component DTML and PY scripts etc and that these would be expanded into the Product's home directory somehow. Is this not the case? Is the .DAT distribution a way of distributing the objects without the source ? (more Cathedral than Bazaar) > > >My product management screen > >shows the FAQ product as installed, but the actual product directory still > has > >just the three files from the tarball. > > This is normal. That's what's supposed to be there. > > Does the FAQ item show up in the product add list? No - but it does show up in the installed products control panel. > If not, then you have a > problem. If you have this problem, then please send to me, not the zope > list, information about your platform, and the version of Zope you have > installed. As stated before, Zope 1.10.2 running on ZAP-Linux. many tias, gary

2 1

Help with editing Product dtml files
by Piers Lauder 02 Mar '99

02 Mar '99

I'm making a Zope "Product" for managing and creating student surveys (which I hope to contribute via zope.org) but I'm having trouble with a couple of techniques: 1. How does one enable a dtml file that is instantiated as in my_dtml = HTMLFile('my', globals()) available for editing in the products' management screen? There's probably more to this - as at the moment the management screen goes straight to the "index_html" form as with the "Poll" Product. 2. What's the approved way to catch database errors in methods? I'm creating tables on the fly, and need to check if the table exists before trying to create it. (I'd use a "tables" method if all the database interfaces supported it. I'd also use a try/except but the database objects have different names for their exceptions.)

1 0

terminating DTML parsing...
by Anthony Baxter 02 Mar '99

02 Mar '99

from inside DTML, is there a way to say "don't process any further DTML, just return this to the user"? What I'm looking at is a small DTML snippet that gets included at the top of a number of pages, and looks for a particular variable to be set. If it's not set, it should just display a small "please enter a widget name" form which submits back to the same page, and not display the rest of the page at all. will just doing a RESPONSE.redirect() automatically do this? Anthony

1 0

Re: [Crew] External Methods?
by Tres Seaver 02 Mar '99

02 Mar '99

Christopher G. Petrilli wrote: > > On Mon, Mar 01, 1999 at 07:43:04PM -0800, Greg Stein wrote: > > Christopher G. Petrilli wrote: > > > On Mon, Mar 01, 1999 at 09:32:07PM -0600, Tres Seaver wrote: > > > > As one who comes down firmly on the "weenie" side of the great "content manager" > > > > vs. "web weenie" divide, I am naturally inclined to code up Zopoids as > > > > ExternalMethods. The docs say to put them under the $ZOPEROOT/lib/python, but > > > > that seems icky for a "shared" Zope like the one on starship. > > > Well, right now that's the only way it's supported... it's not really > > > inteded for an ISP situation with hundereds of "untrusted" users, which > > > is kinda how we're using it right now. FOr now, unfortunately, I'm > > > makign the executive decision that ExternalMethods are verbotten until > > > we can figure out a way to isolate them from one-anohter. If someone > > > wants to develop a derived ExternalMethod that uses rexec or some such > > > to control it's access to the database, that'd be great. > > > > > > > Whither should such gems be placed? > > > > > > Well, unfortunatly all of them would run wit the permissions of "root" > > > as far as I understand it... someone else correct me, but this is how it > > > was explained to me... basically they'd be able to do anything. > > > > Can't you run Zope as another user? That could eliminate a number of > > issues. > > I'm sorry, I wasn't clear ;-) What I meant was that the method has > unlimited abilities to peruse the object database... it doesn't have any > abilities outside it that aren't avilable to the zope process itself > (which in this case runs as uid 'zope'). > > The concern is taht it would be able to circumvent other user's security > since it wouldn't be enforced against the ExternalMethod. I understand the security problems inherent in ExternalMethods; unfortunately, without them, Zope is merely an "also-ran" in the web applicaton race, from my perspective. DTML in isolation is not an "ASP-killer." I'm CC'ing the Zope list, in hopes that someone there can either allay or slay our fears. It seems to me that the security problem is that ExternalMethods can get access to "sibling objects" of the object on which they are invoked, right? I mean, if we could make the siblings inaccessible, and acquired properties read-only, then we should be ok, no? Ugh, I don't grok acquisition well enough to tackle that myself, I fear. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

1 0