November 2000 - Zope

IIS and Zope share same problem :-S
by Chris Withers 06 Nov '00

06 Nov '00

> MICROSOFT WEBSERVERS LAID OPEN FOR ALL TO SEE > by Dave Murphy, member(a)itrain.org > > Microsoft is scrambling to repair damage caused by a > security hole in its IIS 4 & 5 webserver that runs on > Windows NT/2000. Microsoft claims over four million > IIS websites, and each one of them is at risk of > releasing sensitive data through the security hole. > Called the "Web Server Folder Traversal" error, the > flaw allows users to execute files on an IIS website by > requesting a specific web address. http://www.zope.org/standard_html_header for example ;-) http://www.zope.org/objectIds as another... > The bug allows access to any file on the webserver via > a specified URL. Like all webservers, IIS is supposed > to prevent access to files that aren't intended to be > part of the website. Maybe Zope should too.... > This article is posted to http://itrain.org/itinfo/2000/it001017.html > > Live well, do good, > > --Dave Murphy cheers, Chris

6 7

how to retrieve variables & values from the URL
by jacintha menezes 06 Nov '00

06 Nov '00

Hi, In lookup query when i give the input as Emp_no & submit it , following url comes in the browser address space. http://192.168.222.217:8080/project/Admin/looktool_report?Emp_no=4&SUBMIT=Su bmit+Query how can i retrieve the variables & values from the URL using dtml tags Thanks, bye, jacinth

2 1

Combining products
by Anders Eriksson 06 Nov '00

06 Nov '00

Hello Zopistas, As a newbee I have some difficulties understanding everything about Zope (.but I'm getting there.) What if I want to combine two of the larger products, The Portal ToolKit and the Squishdot. How would one go about to do this? I would like to have the membership and the other parts from PTK added to the Squishdot (or the other way around - which ever is easiest). I also wonder: Is there someway I can install the PTK or the Squishdot in the Zope root folder? This so that I can use the domain URL without any subfolders. e.g. www.mydomain.org instead of www.mydomain.org/ptk -- Best regards, Anders mailto:ame@swipnet.se Science is everything we understand well enough to explain to a computer. Art is everything else. - David Knuth

2 1

RE: [Zope] Help wanted on Zope ZClasses/DTML please.
by Bowyer, Alex 06 Nov '00

06 Nov '00

Thanks to everyone who gave me tips in answer to my questions, I have one further question. I have worked out thanks to Seb's comments that the problem I have with the use of manage_delObjects is (I think) that I am passing in the title or id of the object to be deleted rather than the object itself. I want to put the object into the REQUEST so I can still access it from a different namespace - at the point I want to do the deletion, my target object is out of scope. How do you get a reference or pointer to the current object and put it into the REQUEST for later use? Thanks again, Alex ================================== Alex Bowyer IT Contractor, Logica Australasia Tel : +61 2 9202 8130 Fax : +61 2 9922 7466 E-mail : bowyera(a)logica.com WWW : http://www.logica.com.au/ ================================== > -----Original Message----- > From: Seb Bacon [mailto:seb@jamkit.com] > Sent: Friday, November 03, 2000 8:08 PM > To: Bowyer, Alex; zope(a)zope.org > Subject: RE: [Zope] Help wanted on Zope ZClasses/DTML please. > > > Hi, just some quick pointers (I'm in a hurry...) > > refer to http://zdp.zope.org/projects/zqr/ZopeQR for more details > > >  > > <dtml-call "manage_delObjects('the_id')"> > > What is the correct way to use manage_delObjects? > > <dtml-call "manage_delObjects(the_id)"> > > should work. What you wrote looks for an object with id > "the_id". In fact > you want the value of the_id, which is evaluated for you when > it's in quotes > (think of everything in quotes as python). > > > Is there a way to get the > > name of an object's parent (or its own name for that > matter) and use it to > > construct a URL? > > <dtml-var "PARENTS[0]"> gives you the parent > > > 3) When redirecting or linking to a page I have already > visited, how can I > > force a refresh? I tried the JavaScript > window.location.reload(true) but I > > think that is only supported by Netscape. It didn't work in > IE5 for me > > anyway. > > window.location.reload() works for me... > > > 4) What is the best way to handle security with ZClasses. > In my example I > > want the index_html pages to be public but everything else > to require a > > password. I managed to require a password for a particular > instance of the > > UAPage, but that affects both the index_html and the edit pages. > > you can attach permissions to specific methods in a ZClass by > mapping them > to existing permissions in the 'define permissions' management tab. > > cheers, > > seb. >

2 1

RE: [Zope] Combining products
by Max Møller Rasmussen 06 Nov '00

06 Nov '00

From: Anders Eriksson [mailto:ame@swipnet.se] >I would like to have the membership and the other parts from PTK added >to the Squishdot (or the other way around - which ever is easiest). I am afraid that there is no easy way of doing that. It would be like combining any other 2 applications. Regards Max M

1 0

More updates on documentation documentation
by Michel Pelletier 06 Nov '00

06 Nov '00

I've added more updates on documentation and worked in the comments recieved from Shane. To help you help us, I added some text on where we need the most attention, check the CurrentIssues for more info. http://dev.zope.org/Wikis/DevSite/Projects/DocumentationProcess/FrontPage This process will define how we create documentation at Digital Creations, and will have far-reaching effects on how each of us contributes, maintains, and understands documentation. So far, Amos and I have proposed a prototype documentation process for synthesis, authoring, editing, reviewing, delivering, and maintaining documentation based on our experiences writing the Zope Book. We have tried hard to be as realistic as possibly in defining a very workable process, but our experience is obviously limited to one artifact, and the pain of living with no real process to date. We would really like to hear what you all have to say about our proposal and our prototype. If you think our prototype has holes in it, please leave your comments in the wiki and we will take them very seriously. We would like to hear comments from: The PythonLabs folks, since they have lots of experience authoring, maintaining and delivering extremely useful documentation. The ZDP folks, who represent the segment of the community most interested in documenting Zope. The DC geeks, since this process will effect, fundamentally, how we all do our jobs. The community developers, since they represent an audience for whom we have little documentation, and where we will focusing much of our upcomming efforts. The community users, since they represent the need for the highest clarity, best documentation, and because they represent the majority audience. In other words, we want to hear from you all! Our goal is to make documentation one of Zope's best features, so let us know how you think we can do that! Thanks, -Michel

1 0

insert but updates don't work
by Bowyer, Alex 06 Nov '00

06 Nov '00

> but get an authentication challenge that I can not pass. > Is there something special about sql updates? I haven't used SQL in Zope but I experienced the same thing, an authentication request that cannot be satisfied even by the superuser account. For me I found that it happened when I was in a particular dtml-with block and I referred to the id property of the current object. I changed my <dtml-var id> to <dtml-var title_or_id> and the problem went away. I think there may be a bug in Zope regarding accessing the id properties of certain objects. I hope this is some use to you, it may be that you have a completely different problem though. I would be interested to hear the outcome once you get it working and work out what the problem was. Good luck Alex ================================== Alex Bowyer IT Contractor, Logica Australasia Tel : +61 2 9202 8130 Fax : +61 2 9922 7466 E-mail : bowyera(a)logica.com WWW : http://www.logica.com.au/ ==================================

3 3

Question about dtml-in
by Sean McGrath 06 Nov '00

06 Nov '00

Hello all, I have a question about the dtml-in tag. When it is iterating over a sequence, and the items in the sequence happen to be tuples containing exactly two items, then dtml-in places the first item from the sequence in sequence-key, and the second item goes in sequence-item. If the items in the sequence are not tuples of two items, then sequence-item contains the whole item. For example, if I have: <dtml-in "[(1,2),(3,4),(5,6)]"> <dtml-var sequence-item> </dtml-in> then I get 2,4,6 when I view this. The 1, 3 and 5 have been assigned to sequence-key. Now, if I change the dtml to be this: <dtml-in "[(1,2,3),(3,4,5),(5,6,7)]"> <dtml-var sequence-item> </dtml-in> then I get (1,2,3)(3,4,5)(5,6,7) which is what I would expect. I think the reason for this behaviour is to do with iterating over dictionaries, but I'm not sure. The problem I have is this: I have code which retrieves data from a database, and the result is a list of tuples, with each tuple corresponding to a record, and each item in the tuple corresponding to a field. I don't know in advance how many fields will be in the record. I want to iterate over the records and fields, wrapping them in a html table. If the database I'm talking to happens to return a list of records with two fields, ie a tuple of two items, I have to handle this differently than any other case, which makes for some ugly code. I haven't been able to find any way to avoid this, unless I'm missing something. Any information would be greatly appreciated. Regards,

3 2

sending query output as an attachment
by jacintha menezes 06 Nov '00

06 Nov '00

Hi, I am developing a product in which a output report (tabular form with data) is produced in result of a query. I have to send that report to different people through the mail facility available in zope as an attachment. So kindly guide me how can i send the output report as an attachment.If it can be through dtml tags or python module etc kindly write those methods for me. Waiting for your reply Thanks, Bye, jacintha

2 2

Re: [Zope] Where is the code?
by Red Pineseed 06 Nov '00

06 Nov '00

Thanks Rik, You answered my question perfectly. This was my guess and found the Data.fs. This makes me wonder though how the implementation of the three tier separation, ie data/logic/presentation is achieved. Do you have any idea? What is the advantage of putting everything in a db? Apparently if the db down, we will lose everything and recovering from a db is pain as you may already know. Even though it is great performance improvement to load the db in RAM at run time, do you know of an other benefits? Philip Rik Hoekstra wrote: > > > DTML and Zope (code) objects are kept in the object database. It is in > <zopehome>/var/data.fs on your filesystem. > If you create a new object, Zope creates a new instance of a class that is > in Zope. They are defined in Products. The products are visible in your zope > site at http://your.site/Control_Panel/Products > Zope products/classes may be defined in Python modules. In that case the > modules live in the <zopehome>/lib/python/Products directory. They may also > be defined in ZClasses, which are defined completely through the web. They > are not visible on the filesystem, only in Zope itself. > > I don't know whether that was your question, but DTML is interpreted at > runtime by the Zope system. It takes the dtml bits from your template and > returns the filled in template. > > hth > > Rik

1 0