November 2000 - Zope

Re: [Zope] How to get around non-propogating proxy roles, also security problem with zsql traversal?
by Dieter Maurer 17 Nov '00

17 Nov '00

Brad Clements writes: > 1. Why is it that proxy roles don't propogate and accumulate when > methods are called? I do not know exactly but suppose it is to reduce the danger of trojan horses. It was changed with the new Zope 2.2 security policy. > 2. I'm actually using simple ZSQL traversal, like this: > > mysite.com/MyFolder/MyZSQL/138348343/PublicInfo > > PublicInfo is the DTML Doc with proxy role = PUBLIC. > > MyZSQL is an SQL Method that doesn't appear to be viewable by > anonymous. However when called using simple traversal shown above, > the SQL method IS executed. > > Is this a security bug? It seems that anonyous users can "call" an sql > method using traversal even if security disallows anonymous View. It is not the view permission that is relevant for Z SQL method use, but "Use database methods". Nevertheless, I can imagine that it will nevertheless be possible to use the method, even if the permission is not granted. This is due to the way, the permission checking is implemented. The ZPublisher first locates the object to be accessed by URL traversal without any security checks (as it does not yet have any user information). After the object is located, it determines its protection and then walks back along the objects visited to find the object in order to find a user folder able to authenticate a user with sufficient privileges. Security restriction of these intermediate objects are only relevant if they were inherited by the final object. Thus, indeed, you may have found a security whole. Put it into the collector. Dieter

1 0

Re: [Zope] ZClasse default in the product
by Dieter Maurer 17 Nov '00

17 Nov '00

Jean Rodrigo Ferri writes: > .... preventing (local) ZClasses to be shown in the global "Available Objects" list .... You may define the local ZClasses inside the global one. Then they will only be seen inside that global ZClass. I think, you will find something about this in the Zope book. Dieter

1 0

Re: [Zope] Visualization of inherited attributes
by Dieter Maurer 17 Nov '00

17 Nov '00

Jean Rodrigo Ferri writes: > .... access to properties in ZClass property sheets .... You may be able to access them by simply using their name: <dtml-var property> If you want more control, you may look at the "PropertySheetManager" and "PropertySheet" API's in your Zope online help. Dieter

1 0

PTK good for MyNetscape-style read-only personalised portals?
by Hamish Lawson 17 Nov '00

17 Nov '00

I'm looking to put together a portal site where members can choose from various content sources and personalise the layout but wouldn't be authoring content, similar to sites like MyNetscape and MyYahoo. Is the PTK good for this? Hamish Lawson ____________________________________________________________ Do You Yahoo!? Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk or your free @yahoo.ie address at http://mail.yahoo.ie

1 0

Re: [Zope] Running Mailman CGI under Zope ZServer
by Stephan Richter 17 Nov '00

17 Nov '00

At 09:55 AM 11/17/00 -0500, you wrote: > >Any chance I could take a look at your code? 1. Make a soft link from HOME/OF/MAILMAN/Mailman to HOME/OF/PYTHON/LIBS (usually /usr/lib/python1.5). 2. Now you are able to use all the Mailman Python modules in all of you Python programs including Zope. 3. The methods (External Methods) I used: from Mailman import MailList def addMember(email, passwd): mlist = MailList.MailList('members') mlist.ApprovedAddMember(email, passwd, 0) mlist.Unlock() def delMember(email): mlist = MailList.MailList('members') mlist.DeleteMember(email) mlist.Unlock() Note: If you go and read the Mailman source code, you can figure out many more functions, that are just the 2 I used to add/delete members. 4. As I mention before, you should run Mailman and Zope as the same user to not conflict with the DB permissions. I never fully tested that though. Regards, Stephan -- Stephan Richter CBU - Physics and Chemistry Student Web2k - Web Design/Development & Technical Project Management

1 0

Re: [Zope] SiteAcess (Debian Fix)
by The Doctor What 17 Nov '00

17 Nov '00

The bug (number 76658) is listed on Debian's site: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=76658&repeatmerged=yes The fix (I had forgotten what it was) is stupidly simple: mkdir /usr/lib/zope/lib/python/Products/SiteAccess/help A better fix is to fix ProductContext.py is lib/Python/App. I have an attached patch, but it doesn't seem like it's the right way to fix it. BTW: While you're making empty directories, you should probably make: /usr/lib/zope/lib/python/Products/PlugIns/help Because in the Debian package, it has the same problem. Ciao! -- "Duct tape is like the force. It has a light side, and a dark side, and it holds the universe together ..." -- Carl Zwanzig The Doctor What: Un-Humble http://docwhat.gerf.org/ docwhat(a)gerf.org KF6VNC

1 1

overriding manage_beforeDelete in a CatalogAware Product
by Dennis Nichols 17 Nov '00

17 Nov '00

I think I need help in overriding the manage_beforeDelete method from CatalogAware. Just to be sure I'm asking the right question, here's the background: I have a Product (in Python, not TTW) whose instances get cataloged in a separate ZCatalog called CommentCatalog. My product's class inherits from CatalogAware and other classes and can successfully index itself by calling thusly in the __init__ routine: self.manage_editCataloger('CommentCatalog') self.index_object() Reindex also works just fine. But I'm confused about how to get rid of the index entry upon delete. I think I need to set the catalog name and then call the inherited manage_beforeDelete routine. So I tried this: def manage_beforeDelete(self, item, container): "Be sure we unindex ourselves from our special catalog" self.manage_editCataloger('CommentCatalog') self.CatalogAware.manage_beforeDelete(item, container) Not too surprisingly, the code throws an "AttributeError: CatalogAware" into the Stupid Log File and doesn't remove the object from CommentCatalog. Of course I don't understand what the correct incantation is, so I'm appealing for guidance. Zope 2.2.2, Python 1.5.2, RH 6.2, etc Thanks! -- Dennis Nichols nichols(a)tradingconnections.com

2 2

MySQL Connection String
by Aitor Grajal Crespo 17 Nov '00

17 Nov '00

I have installed ZMySQLDA 1.1.4, anybody knows the format of the database connection string??? I have put database user passw , and doesn't work Thanks

3 2

ANNOUNCE: Zope 2.2.3 released...
by Brian Lloyd 17 Nov '00

17 Nov '00

Hello all - Zope 2.2.3 has been released - you can download it from Zope.org: http://www.zope.org/Products/Zope/2.2.3/ This bug-fix release contains the fixes for all released Hotfixes to date, as well as fixes for a memory leak in the Acquisition module, various ZCatalog fixes and a fix for the infamous "__call__" bug (and there was much rejoicing!). For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: http://www.zope.org/Products/Zope/2.2.3/CHANGES.txt http://www.zope.org/Products/Zope/2.2.3/HISTORY.txt Note that we have also posted "diff" updates as .tgz files that will let you easily upgrade an existing 2.2.x site. These updates are available for those currently using the 2.2.x source release or the 2.2.x binary releases. To apply a differential update to your site: - download the appropriate .tgz file from zope.org - shutdown your Zope process - copy the .tgz to your Zope directory and extract it - run w_pcgi or wo_pcgi *if you are not using a binary release* - restart your process Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

Sending Application to User?
by Gary Perez 17 Nov '00

17 Nov '00

Hello, all. Here's what we're trying to do: User clicks on a link to open a remote interface to Box A on the network. The "remote interface" is really a python script that's run by Python on the client machine (not the Zope Box or "Box A"). We got it to work by specifying the MIME type in a DTML Method followed by the python code itself, again inside the DTML Method. Is there any way to first specify the MIME type in a DTML Method, and then point to either a) a .py file object in Zope, or b) a .py file in the external file system? I really don't want to edit the code in the method every time the module changes... I'd much rather just upload the new .py file. A <dtml-call "RESPONSE.getFile(filename.py)"> would be great... if it existed. ;) Any guidance is greatly appreciated. -Gary

1 0