December 2000 - Zope

ZopeLDAP 1.1.0 release
by Jeffrey P Shell 18 Dec '00

18 Dec '00

"ZopeLDAP 1.1.0", http://www.zope.org/Members/jshell/ZopeLDAP/ is released, bringing in a bevy of changes, including: o New ability to run in a non-transactional mode (this is critical to avoid a known bug when updating more than one entry object per transaction) o Much improved Entry object API that is Python Scripting\DTML Scripting friendly o Some new documentation (not yet in help system format though) about programming Entry objects. The *manage_* style of programming Entry objects has not changed, but the core API has. Anything using methods like '_set()', '_addSubentry()' will be affected.

1 0

passwords TTW - security hole?
by Bill Welch 18 Dec '00

18 Dec '00

AFAIK, inputs of type password are sent to the server as plain text. In Login Manager, for example, that would mean that passwords are exposed every time someone logs in. In User Folder, the passwords would be exposed whenever they're changed. If my interpretation is correct, then it seems to me to be a call for out-of-the-box ssl support in zope. Bill.

3 2

Re: [Zope] apache/mod_rewrite and user-logging (semi-OT) - workaround
by Oliver Bleutgen 18 Dec '00

18 Dec '00

Whoa, seems like my problem was not very interesting... Anyway, I found a solution and hereby make it public. To get apache to log usernames, one has to invoke the apache's authentification machinery. I found out that one can plug perl-modules into apache for doing auth and that there's even a module which does exactly what one needs here, Apache::AuthAny, which always succeeds. package Apache::AuthAny; # file: Apache/AuthAny.pm use strict; use Apache::Constants qw(:common); sub handler { my $r = shift; my($res, $sent_pw) = $r->get_basic_auth_pw; return $res if $res != OK; my $user = $r->connection->user; unless($user and $sent_pw) { $r->note_basic_auth_failure; $r->log_reason("Both a username and password must be provided", $r->filename); return AUTH_REQUIRED; } return OK; } 1; __END__ The corresponding entry in http.conf is <Directory Proxy:*> PerlAuthenHandler Apache::AuthAny AuthType Basic AuthName "Auth_Realm" require valid-user </Directory> One just has to make sure that the realm is the same as in zope and everything goes fine. So on to the next, has anybody an idea what would be a good/easy way to link zope authentication to apache's? It might be interesting to use mod_python i.e. for extending zope's authentication to files/directories served by apache (one could have done the same as above with mod_python, it's just that I didn't want to install that for a five-liner). cheers, oliver

1 0

adding Mail Host also legacy, broken by Hotfix_2000-12-08
by Bill Welch 18 Dec '00

18 Dec '00

Just for the record. Bill.

2 2

IMPORTANT! Zcatalog path handling changes in 2.3
by Christopher Petrilli 18 Dec '00

18 Dec '00

Gang, In order to resolve untold number of situations where the Catalog does "stupid" things and returns less than useful information, we have heavily modified the information stored in the Catalog (and generated by CatalogAware). You can read about this here: http://dev.zope.org/Wikis/DevSite/Projects/ZCatalogVirtualHostFix/ You can find a tarball that contains everything updated here: http://www.zope.org/Members/petrilli/zcatalog-pathsupdate.tgz If you untar this in the root of your Zope installation you should get a new Zcatalog that has all the new code in it. Please read and test... This is especially important for people who are using Squishdot/etc. We hope to make a full code release with 2.3a2 sometime very soon. PLEASE take a look at this, and provide feedback ASAP. Chris -- | Christopher Petrilli Digital Creations | petrilli(a)digicool.com Where Zope comes from

3 3

Re: [Zope] Creating attributes in ZClass instances
by Dieter Maurer 18 Dec '00

18 Dec '00

David Bustos writes: > I have a ZClass named Event. Event objects need to keep a list of > people signed up for them, so they had a lines property named 'people'. > But lines properties have odd semantics, and I want to store arbitrary > objects rather than strings (i.e. it shouldn't be edited through the web > like a lines property is). So I would like for the 'people' attributes > of Event objects to be regular Python lists. I would make the class folder-like and add the people as people ZInstances. If you dislike only the editing through the web, then you are not obliged to make it available. > It seems that I should create this attribute in the Event_add > constructor in my Product. But how do I do that? It is not forseen, that you add a list attribute to an object. However, in Python, you could do it. Be careful, however! There are several caveats that may make it into a nightmare. One aspect (there may be more): The ZODB stores objects without (acquisition) context. Usually, the acquisition object is inherited from the parent object. However, lists, dictionaries etc. do not have an acquisition context. They can not inherit it to their components. Thus, if you access "list[i]", the resulting object does not have an acquisition context (if the list directly came from the ZODB) and the use of the resulting object is restricted. Dieter

1 0

Re: [Zope] Creating tables from ZSQL methods..?
by Dieter Maurer 18 Dec '00

18 Dec '00

Lee writes: > I have a ZSQL method, createClassTable, where the paramter 'classCode' > is used to name the table: > .... > Is there anyway to execute this in a DTML document 'on the fly'? Sure: <dtml-call "your_method(classCode=yourTableName)"> > I have a DTML method where the classCode argument is passed onto the > ZSQL method via a web form... but when submitted I am met with Zope > interface and asked to enter the query parameter. I do not understand that. Where do you have this DTML method? What do you submit? What Zope interface you get (the description looks like the "test" interface for a Z SQL method)? > .... > How do I execute the query > and go to this view screen in one go? <dtml-call your_create_method>  <dtml-var next_page> Dieter

1 0

Re: [Zope] how can you tell who created an object in Zope?
by Dieter Maurer 18 Dec '00

18 Dec '00

Chalu Kim writes: > What I would like is to be able to tell who created an object? Is there > an easy way to do this? Have a look at "AccessControl.Owned.getOwner". It will give you the object's owner. For most objects, this is initally the creator of the object. This can be changed later with a "takeOwnership". But maybe, that is not a problem for you. Dieter

1 0

Re: [Zope] sql query results -> DTML method problem
by Dieter Maurer 18 Dec '00

18 Dec '00

"Manuel Amador (Rudd-O) writes: > > #8 <dtml-in expr=\"findClassTitle(code=52.139)\"> > > RING: dont do that, dtml wont work in python namespace > instead, remember that in python namespace all vars present in dtml namespace > are inherited. I do not see a reason, why not to use this (except, that " should not be escaped, of cause). > do this: > <dtml-in expr=\"findClassTitle(code=_.(\'class_code\'))\"> > the __.() construct is required since underscore arent allowed in python > variable names. if the var was called classcode, you could do "_" are allowed in Python names. They are treated in the same way as a letter. DTML restricts the use of "_": A name must not *START* with an "_" (unless it is the special name "_"). Inside name, you can use "_" freely. > <dtml-in expr=\"findClassTitle(code=classcode)\"> > dats it. That said, you can also use: <dtml-in expr="findClassTitle(code=class_code)"> > > <dtml-in expr=\"findClassTitle(code=<dtml-var class_code>)\"> *** syntax > > error I agree with Manuel: you cannot nest DTML. And it is this nesting, that triggered his "RING: do not do that!" Use: <dtml-in expr="findClassTitle(code=class_code)"> I.e. you can simply use the name of the variable. Manuel is right, too, that DTML allows much more characters in names than Python does. If you have a name with a character forbidden in Python names, such as e.g. a "-", then you can use "_[name]" or "_.getitem(name)" (as Manuel said). It is only, that "_" (unlike "-") is allowed in Python names. Dieter

1 0

user property sheets
by Timothy Wilson 18 Dec '00

18 Dec '00

Hey everyone, I'd like to make a product so that Zope users' contact info would be available on a "MemberBio" page whenever you click on a hyperlink of their name. The MemberBio page would also contain a form that could be used to send them email. I know there's been some discussion of property sheets for Zope users, but I don't know if this would be the correct approach. Should I create something totally separate, use property sheets, or some combination. The advantage of a separate product is that the person wouldn't have to exist as an official Zope user to have a "MemberBio" page. Any advice? -Tim -- Tim Wilson | Visit Sibley online: | Check out: Henry Sibley HS | http://www.isd197.k12.mn.us/ | http://www.zope.org/ W. St. Paul, MN | | http://slashdot.org/ wilson(a)visi.com | <dtml-var pithy_quote> | http://linux.com/

2 1