January 2000 - Zope - Zope lists

Security
by Gregor 09 Jan '00

09 Jan '00

After over a week, I'm obviously still not understanding something about Zope security. Every time I think I've got it, something fails to work as I expect. What I am trying to do (currently) is this: Create a really simple member folder thingy (Place) that lets a person log in and create generic DTML documents, as well as custom documents (Thing), in their space. As I understand it, the basic steps to do this are: 1. Create a new product (PlaceProduct). Inside that, create a Z Class (PlaceClass) with a meta-type "Place". The Z Class has a base class of "Object Manager", since I want it to hold stuff. Set up a "Security" == "manage_access" view inside PlaceClass so I can assign my role later. 2. Back to the Product list, create another new product (ThingProduct). Inside that, create a Z class (ThingClass) with a meta-type "Thing". This has some properties on it, but that is not important for the problem at hand. 3. Inside PlaceClass, set the subobjects to include "DTML Documents", "DTML Methods", and "Thing". 4. At the top-level of Zope, create a new role called "Contrib". Give it these permissions (let me know if any are unnecessary): Access Contents Information Add Documents, Images, and Files **Add Things** Change DTML Documents Change DTML Methods Delete Objects Manage Properties View View Management Screens ** emphasized 5. Set up a user at the top level, but assign it no roles there 6. Elsewhere in the hierarchy, create a "Place". Inside this, I'll have to give the user a local role of "Contrib". Now, as I understand it, the user should be able to enter his username/password to use the management interface for that Place, and should be able to add DTML Documents, DTML Methods, and Things there, delete them, edit their properties, etc. Unfortunately, what actually happens is that the user can create and manipulate DTML Documents and Methods just fine. When the user tries to create a Thing, a new password dialog pops up and refuses to accept the user's name/password. Have I missed a step somewhere, am I just completely off-base about the whole idea, or is something broken? On a completely unrelated topic, does ZServer seem to intermittently vapor lock for anyone besides me? I use the binary installation on Win98, and both 2.1.1 and 2.1.2 have done this. I can't identify anything in particular that causes it. Sometimes I'll just come back to the browser that I was tinkering in (after working on something else for an extended period), try to do something in the management interface, and get no response. Sometimes it'll happen when clicking a link (any link) on the site itself. When this happens I have to kill the DOS window that is running the server, then restart Zope. (I'm not running under Apache or anything like that; just running the start.bat file and using localhost while I learn the program.) - Gregor

1 1

XML_RPC client for internet explorer
by Johan Carlsson 09 Jan '00

09 Jan '00

I've "compiled" an XMLRPC client (from David Carter-Tod's XML-RPC Client and Server for ASP) that seems to be working with Zope, but it has not been tested (patches and bug rapports are welcome). http://www.zope.org/Members/johanc/ZIE/xmlrpc_client David Carter-Tod's XML-RPC Client and Server for ASP (the client has a bug for working with Zope, simply add [objXML.setRequestHeader "content-type", "text/xml"] before the [objXML.send(requestText)] in [xmlRPC] you be alright.) http://www.wc.cc.va.us/dtod/XMLRPC/ Regards, Johan Carlsson

1 0

RE: converting SQL select list into unique values
by Nemeth Miklos 08 Jan '00

08 Jan '00

> Darcy Clark wrote: > > > > I have a non-unique column in a MySQL table - I have looked hard for a > > way in SQL to convert the results of a SELECT into a list of unique > > values. I know how to define a table at CREATE to have UNIQUE columns > > but this is not what I want to do. > > > > For example : > > > > If the result of the SELECT is : > > 1, 3, 3, 4, 2, 6, 8, 9, 4, 2, 3, 6 > > > > I would like to return: > > 1, 2, 3, 4, 6, 8, 9 > > > > i.e. only the unique values of the list. > > > > any pointers ? if SQL can't do this, can Zope ? (I'm sure Zope can do > > it, it can do everything :) > > > > Darcy > > If I remember right... > > select not_unique > from table > GROUP BY not_unique; > > The group by aggregate will do the thing you ask for. > The standard way is: select distinct col1 from T NM

1 0

RE: [Zope] Cut-Copy-Paste bug in Zope2.1.2 ?
by Martijn Pieters 08 Jan '00

08 Jan '00

> -----Original Message----- > From: Shalabh Chaturvedi [mailto:shalabh@pspl.co.in] > > The copy/cut/paste functionality doesn't seem to work here. > I'm on Zope > 2.1.2. > > When I check any item and click copy, the paste button appears. When I > change the folder, the paste button's gone! If in the same folder I > click paste, I get "No clipboard data found". Sound like a cookie problem. Are you sure you have cookies switched on? On the current major browsers, you can switch on confirmation on cookies. You'll be show the exact cookie contents of a cookie and will be asked whether or not you want to accept it. Switch this on and try a copy. Check the contents of the cookie, and let us know if you see any problems. -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

2 1

RE: [Zope] Accessing built in Icons
by Martijn Pieters 08 Jan '00

08 Jan '00

> -----Original Message----- > From: Gregor [mailto:vorlon@iglou.com] > > Does anybody know how to access the icons that Zope uses for > its objects > (folders, DTML Documents, etc.) for a Z Class I created, or > where that info > might be found? > > I know I could just load the icon image from the > "lib/python/Products/OFSP/images" directory, but I'm trying > to figure out how > to do it without using up extra space in the database for > that image (assuming > that I'm not misunderstanding that bit...) On the Basic tab of your ZClass, the italic icon field is the URL of the image, relative to the root URL of your Zope installation. If you replace this with the relative URL of another icon, say misc_/OFSP/Folder_icon.gif for the Folder icon, your ZClass will be displayed with that URL for its icon. Make sure you create the ZClass without an initial image, otherwise this initial image will still take up space in the ZODB until the ZClass is removed, even though you do not use it. -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

1 0

WebDAV security
by Joachim Werner 08 Jan '00

08 Jan '00

I have got a local configuration with a Linux server currently running Zope 2.1.1 for evaluation and some other machines, including a Win98 Notebook, connected to the server via Ethernet. The good thing is that I can use WebDAV to see and modify the Zope folders/objects from Internet Explorer 5.0 on the Win98 machine. The bad thing: There seems to be NO AUTHENTICATION needed to do this! I tried first on the Win98 itself with a local Zope. My guess was that it automatically accepts local connections as allowed. But when I "WebDAVed" into the Zope on the Linux machine, it was accessible, too. O.K., my Win98 uses a valid user/password on the Linux machine needed for Samba, so I tried with a different logon and Zope still was very open for WebDAV connections! Same with Win98 running in a VMWare box on another Linux machine! Is this a "feature" or a bug? If WebDAV was totally "open" by default, this would be a major security issue! The Linux server machine is also running SQUID as a proxy server for the other machines. Could that be part of the problem? If it is a security issue (tI think so), Is that problem still there in Zope 2.1.2? Joachim Werner

2 2

Re: [Zope] Zope and Apache: root of ZODB reference problem?
by menezes＠curiango.ipen.br 08 Jan '00

08 Jan '00

Quoting Darran Edmundson <dee124(a)rsphy1.anu.edu.au>: > > Hi Zopesters, > > We have a problem with our Zope under Apache installation. > Namely, the rename|cut|copy|delete|export buttons do not work > for checkbox selections in the root of the ZODB. > > [check any item in the root, ie. "standard_html_header"] > [hit any of the above-named buttons, ie. "rename"] > > Not Found > The requested URL /optics was not found on this server. > > The problem seems to be a missing terminal slash in the > URL generated by the management interface web pages. That > is, on our system Apache requires URLs of the form > http://our.ip.address/optics/ to find the Zope cgi script. > The rewrite rule for our installation is: > > RewriteRule ^/optics/(.*) /usr/local/apache/cgi-bin/Zope.cgi/$1 > [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] > Hi, I had this same problem here. I solved it with an additional rule before the above. In my case is something like: RewriteRule ^/Zope$ /Zope/ <--- fix missing ending slash RewriteRule ^/zope$ /Zope/ [R] <-- fix lower case url (rewriting it) RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule ^/Zope/(.*) /usr/lib/cgi-bin/Zope/$1 \ [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] BTW, I'm using Zope and Apache from Debian/GNU Linux, potato version. HTH. []s, Mario ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

2 1

Re: [Zope] Debugging and DTML
by Hung Jung Lu 08 Jan '00

08 Jan '00

administrato-(a)consotec.de wrote: original article:http://www.egroups.com/group/zope/?start=20553 >I'm developing a product for ZOPE. Because changes in >the python and dtml files are not detected I need to >restart the ZOPE server all the time. Is there a way get around this? (1) For the python external methods, you have click on the method in the management screen, and then click on the "Edit" button. You have to do this every time you make a change to the external python file. I know, the button shouldn't be named "Edit": "Update" would be more a more appropriate name. (2) DTML changes are detected. Just make sure you click on the "Change" button. >How can I list a dictionary (e.g the REQUEST) with dtml. >In python I would do the following: >for i in REQUEST.keys(): > print "%s=%s"%(i,REQUEST[i]) (3) <dtml-var REQUEST> prints out all the items. No need to iterate. But if you really want to iterate, you can do: <dtml-in "REQUEST.keys()"> <dtml-var sequence-item> <dtml-var "REQUEST[_['sequence-item']]"> </dtml-in> >And with DTML? Here is the peace of dtml I came up with. >But it doesn't work! I look in documenation but ... >What is wrong? (4) "piece", not "peace". :) ><dtml-in "REQUEST.keys()"> > <dtml-var sequence-item>=<dtml-var "REQUEST[sequence-item]" > ></dtml-in> (5) Arghh... see, Zope designers wrote in Python, but deep down they were still thinking in Perl. Which explains the many bizarre behavior of the DTML syntax. Anyway, the short answer is: sequence-item is not a valid name after you put it in between quotes. That is, "... sequence-item ..." is equivalent to "... sequence - item ..." So you were performing a subtraction operation, without knowing it. :) The way out is to access the sequence-item with the namespace variable "_". In your case: <dtml-in "REQUEST.keys()"> <dtml-var sequence-item> = <dtml-var "REQUEST[_['sequence-item']]" </dtml-in> The "_" behaves like a dictionary. But you cannot always treat it as an ordinary dictionary. For instance, the expressions <dtml-var _> <dtml-var "_"> <dtml-in "_.keys()"> will not work. DTML is pretty messy the way it is today. It smells like Perl, quacks like Perl, waddles like Perl. But... then... it is also free. I just wish it were free and as good as Python. :) Is that too much to ask? :) (No need to answer, it is.) :) regards, Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

userdb: popup widow when auth fail [Q]
by Bruno Mattarollo 08 Jan '00

08 Jan '00

Hello... I am a site where I use UserDB (with cookie-authentication) to validate users. I have a folder where I placed an index_html file that contains something like this: <dtml-if "AUTHENTICATED_USER.getUserName()=='Anonymous User'"> <dtml-call "RESPONSE.setBase('http://izote.infosys.com.ar/Zope/research/acl_users')"> <dtml-with acl_users> <dtml-var docLogin> </dtml-with> <dtml-else> ... [ the document goes here ] ... I have tryied setting up the permissions on the "research" folder and unchecked the "Acquire permissions" from the "security tab" for the "Access content", "FTP Access" and "View". I have two local roles "Member" and "Client", I checked the combos for this two roles. I also selected the "Manager" role in the "proxy" tab of the docLogin DTML from the UserDB acl_users folder. When I try to access the URL http://izote.infosys.com.ar/Zope/research/ I get the following traceback:  What I am doing wrong? If I don't uncheck all the "Acquire permissions" from the security tab of the folder I can use the login, because I am doing the "dtml-if" statement on the DTML-document, but I presume that's not the way it's suposed to work. My docLogin file uses the <dtml-var standar_html_header> tags, that's why I put the "proxy" role. The problem that's annoying me, and that's why I am asking this question, is that with my method (the dtml-if in the index_html) whenever a user put's a wrong user/password, he/she gets the pop-up window prompting for user/password. I do not want that to happen. Can someone give me a hint on what I am doing wrong? TIA /B Bruno Mattarollo <brunomadv(a)ciudad.com.ar>

1 0

Debugging and DTML
by administrator＠consotec.de 08 Jan '00

08 Jan '00

Hello, I'm developing a product for ZOPE. Because changes in the python and dtml files are not detected I need to restart the ZOPE server all the time. Is there a way get around this? How can I list a dictionary (e.g the REQUEST) with dtml. In python I would do the following: for i in REQUEST.keys(): print "%s=%s"%(i,REQUEST[i]) And with DTML? Here is the peace of dtml I came up with. But it doesn't work! I look in documenation but ... What is wrong? <dtml-in "REQUEST.keys()"> <dtml-var sequence-item>=<dtml-var "REQUEST[sequence-item]" > </dtml-in> Thanks Alfons

3 3