October 2000 - Zope - Zope lists

RE: [Zope] Access Control vs Publishing Protoco
by Seb Bacon 17 Oct '00

17 Oct '00

oops, I forgot to foward my last mail on this subject to the list. My response here to Dieter's response captures contains the main points though... > > > I think, the implementation would be easy. > > > Management, however, would be more difficult, as there are no > > > good defaults for the "URL Traversable" permission. > > > It is not easy, to determine (e.g.) for a DTML method/document > > > whether it is only used as a component (such as > > > "standard_html_header") or is a full grown presentation method. > > > > Um, I don't think I understand. [ snip ] > Currently, Zope tries to have very few explicit, object specific > permissions. The ideal is that permissions are specified high above in > the hierarchy and acquired by lower objects. > This is quite possible with the current scheme. > Implementing an "URL accessible" permission would require > much more tweaking of single object permissions. > > There are other ways to solve your problem by organization > (putting things that should not be seen somewhere else) > that do not require an additional permission. Now I understand... I would disagree, however: I think there is a sensible default value. The default would be that anonymous does not have 'traverable' permission, but the manager / owner does. The cases where an authenticated user is able to traverse some objects but not others would, as you point out, be rare, because you could instead manage these by organisation. You would still use organisation to avoid having to set too many additional permissions. However, this solution would solve the 'security' issue of the anonymous user being able to list objectIds in any folder TTW. It would also allow the developer more flexibilty in how they designed their application, which can only be a Good Thing? seb.

5 7

Re: [Zope] cookies don't obey me
by Dieter Maurer 17 Oct '00

17 Oct '00

Roland Reumerman writes: > 1) When I set a cookie with the path set to the root > <dtml-call "RESPONSE.setCookie('account',AUTHENTICATED_USER,path='/')"> Be careful with "cookies"! The value of a cookie it quite severely restricted (must not contain many characters; you read the cookie specification?). In your case, the value is not a string at all but a Zope object. "RESPONSE.setCookie" will probably convert the object to a string for you. This will give you "AUTHENTICATED_USER.getUsername()". However, I would feel better, if this would be in your "setCookie" call. Note, that probably Zope user names may contain characters not allowed in Cookie values. > I'm still not able to click through to another hyperlink once I'm logged in, > i.e., I've used www.ddi.nl/support to go the password protected Zope site, > logged in as a customer, and from there I can choose other parts of the site > (below .../support/). However, www.ddi.nl is an alias of > www.datadistilleries.com (the actual name): as a result it asks me for the > password again. I thought setting the path to '/' would convince Zope I'm > authorized, but apparently it's not the case. The path is a "local" path on your server. Setting "path='/'" tells the browser to add the cookie to any request going to your server. "path='/XXXX'" would tell the browser to send it only for requests with paths beginning with "/XXXX". You cannot control with "path" to what server the cookie is sent. There is the "domain" specification that gives you some control over the servers that get the cookie. I doubt, however, that this mechanism will allow you to send cookies defined by "www.ddi.nl" also to "www.datadistilleries.com". > 2) This might be related to 1. I've created a logout link on the > ..../support/index_html page, which looks as follows: > <dtml-call "RESPONSE.expireCookie('account',path='/')"> > <dtml-call > "RESPONSE.redirect('http://www.datadistilleries.com/support.html?section=m6&envelope=6')"> > However, once I've been redirected I can still access the password protected > ..../support/ site without Zope asking me for a login name. There must be some magic, you did not yet tell us about. Usually, setting a cookie has nothing to do with password protection or authentication. There must be something like a "login manager" that ties Zope's security subsystem, login/logout and cookies together. Usually, this "login manager" would do the cookie handling transparently. That you are concerned with the cookie seems to indicate that you implement your own "login manager"? The built in Zope authentication does not use cookies at all but "basic authentication" as defined by HTTP. Dieter

3 6

(no subject)
by Dieter Maurer 17 Oct '00

17 Oct '00

Chris Withers writes: > Toby Dickenson wrote: > > Those people were concerned that too many things were exposed via > > ZPublisher also.... My interpretation was that the issue is one of > > access control, not publishing protocol. > > I think the issue is that you can't limit the visibility of objects > right now. > .... but there doesn't appear to be any easy way to say "right, > I want this object exposed for reading and writing via FTP and reading > via HTTP, while this one shouldn't be URL traversable but I'd like to > edit it via WebDAV and this method is for use via XML-RPC but really > shouldn't be visible anywhere else.) I agree with Toby: Unless there are drastic differences in capabilities for protocols, we should focus on access/visibility independent of protocol. To get a feeling what I mean with drastic differences: When SOAP access would allow me to "attack" (hack, espionage, steal, or whatever) a Zope site in some minutes when the same attack would take years via HTTP, then we should be concerned with protocol specific forms of restrictions. However, as Toby pointed out, up to now I can do as bad things via HTTP as I can do with any other protocols. > .... This is because the thing which makes > the problem hard is that something like standard_html_header wants to be > editable by Managers TTW, which means it also has to be visible TTW. > However, it's probably not something you want exposed to anonymous > users, especially as a TTW enitity in its own right. objectIds is my > other favourite example ;-) I think, this could be easily achieved: * provide a "version" of "objectIds" that filters according to authorization. It would return the list of id's for objects I am allowed to see. * This would not yet cover the case of "standard_html_header" and other presentation "components" (that should not generally be seen as independent entities). To handle this case, a different permission would be necessary to distinguish between TTW use and use from inside the presentation machinery (DTML, Templates, whatever). An "URL traversable" permission, as suggested by Chris, seems to fit the bill. Dieter

3 4

Question about Managed Meeting and ZopePTK
by Marc DANAI 17 Oct '00

17 Oct '00

Hi, Do you have any idea about integration of Managed Meeting product in ZopePTK? Is it possible to have some dedicated part in main page (like News) for meeting? My idea is to allow registred user to announce a meeting and after approval by manager, the meeting goes to main portal site. Any suggestion? Thank's __________________________________________________ Do You Yahoo!? Yahoo! Messenger - Talk while you surf! It's FREE. http://im.yahoo.com/

1 0

Name lookup emulation with a Product
by Pierre-Julien Grizel 17 Oct '00

17 Oct '00

Hi, I'd like to perform a name lookup inside a product, relying on acquisition, property and REQUEST lookups. In fact, I want to use the DTML Reference / Table 7 schema to look-up variables. I know how to perform REQUEST lookups. I know how to perform object properties lookups. I know how to perform acquisition lookups. I could write a method of my own to try to imitate the Zope process, but is there an already existing method (that would be used by the dtml-var source code, for example), that already does the job for me ? I found the BaseRequest / traverse method that seems to do it, but is there a convinient way to call it ? Many thanks, Pierre-Julien -- If the only tool you have is a hammer, you tend to see every problem as a nail. Si le seul outil dont vous disposez est un marteau, vous avez tendance à voir chaque problème comme un clou. --Abraham Maslow

2 5

Re: [Zope] DUMB NEWBIE QUESTION
by Ronald L. Chichester 17 Oct '00

17 Oct '00

I had this problem myself. I'm using Mandrake 7.1. There are some things to do, depending on which distribution you are using. What I did was use KPackage to uninstall Zope. Then you get http://www.zope.org/Members/nemeth/howtos/zopeandapacherh61 and follow the instuctions. This works for RedHat and Mandrake. Should also work for Turbo Linux and may work for others. That should get you started. Hope that helps. Ron ./. CURTIS David wrote: > Friends of Zope, > > I am trying to get MySQL database connection installed. I was told that I need to use source Zope instead of RPM's ! Fine with me but how do I install Zope source over RPM. I tried unpacking Zope Source and installing but it creates a new directory tar -xvf Zope-2.1 instead of creating a /var/zope. Also zope starts automatically. Are there techniques to work around this??? > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Force DTML evaluation?
by Stefan H. Holek 17 Oct '00

17 Oct '00

I created a Renderable derived ZClass to act as a "content box". I am basically providing title and content attributes, and when called like <dtml-var myBox> it nicely renders into an HTML table. Then I realised I could not use DTML in the content (type: text). duh! Is there a function I could use like like <dtml-var "do_the_dtml_magic_with(content)">? My second try was to derive from DTMLDocument but I could for the heck of it not figure out how to call the baseclass' methods. In python I would use baseclassname.method() but this seems impossible in ZClasses... Any insights appreciated, Stefan

1 0

Roles as members of other roles?
by Hamish Lawson 17 Oct '00

17 Oct '00

I've not kept up with all the different mechanisms for users and groups that are currently under development in the Portal Tookit and other activities. Do any of them support the idea of a role or group collectively being a member of some other role? For example, if there was a MarketingStaff role consisting of a number of users, then various other roles throughout a company website could be allocated to the MarketingStaff group collectively rather than having to be allocated individually to each member of this group. Hamish Lawson ____________________________________________________________ Do You Yahoo!? Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk or your free @yahoo.ie address at http://mail.yahoo.ie

1 0

Re: [Zope] Medusa Monitor
by Karl Anderson 17 Oct '00

17 Oct '00

Terry Kerr <terry(a)adroit.net> writes: > I don't think the monitor gives you any advantage? I have never used a ptyhon prompt before...I will have to give it a go. > > terry Actually, the advantage of the monitor is that it runs in the same process as your server, so you can track resource issues. Mounting the database separately avoids this. -- Karl Anderson karl(a)digicool.com

2 1

Re: Zope digest, Vol 1 #1019 - 28 msgs (I will be out of the office Monday, October 16th) office Monday, October 16th)
by Darin Lee 17 Oct '00

17 Oct '00

I will be out of the office on Monday, October 16. If you require assistance, please contact the DEQ helpdesk at 241-7495.

2 1