February 2000 - Zope

RE: [Zope] cookie problem
by Hung Jung Lu 02 Feb '00

02 Feb '00

>From: Martijn Pieters <mj(a)digicool.com> >Erm.. .you guys realizing that you are opening a gaping security hole >here? You are right. An astronomical worm-hole. :) Personally, I do the following things: (1) I only use cookies that are encrypted. (2) I avoid using serialization (pickle). On point (1): why would anyone want to expose the recipe of their cookies? If you don't do that with real cookies, why would you do it with internet cookies? :) On point (2): If it is pure data, don't pickle it. Don't be lazy. Write a output format for it. You'll be glad, because you will be able to handle the data from something else than Python. If it is really necessary to keep track of large objects, it's better to store and retrieve them on the server side. I remember someone wrote a How-to on this: http://www.zope.org/Members/gaaros/localcookies Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

RE: [Zope] Re: Zope Sites and Info Needed to Convince Boss
by Chris McDonough 02 Feb '00

02 Feb '00

We are keeping stats and we do have reports... I dunno about making them open to the public right now, but maybe... Note also that to be honest and as I'm thinking about it this isn't quite a fair test for Zope either. DC has 20 people who know Zope inside and out because they wrote it. The zope.org story is probably not indicative of a normal situation and probably wouldn't hold much weight with a potential evaluator. Chris McDonough mailto:chrism@digicool.com Digital Creations http://www.digicool.com Publishers of Zope http://www.zope.org > -----Original Message----- > From: LEE, Kwan Soo [mailto:kslee@plaza1.snu.ac.kr] > Sent: Wednesday, February 02, 2000 11:03 AM > To: zope(a)zope.org > Subject: [Zope] Re: Zope Sites and Info Needed to Convince Boss > > > > on #2. This is a strawman argument. How many hits does > your site get > > in a peak hour? If it's fewer than 13000, and your site is about as > > dynamic as zope.org you can run it on a sub-$1200 P450. we > are serving > > about 2 million hits a month on that box and gaining. > > This will be handy info to persuade others to convert to ZOPE. > How about put some more info about www.zope.org box configuration and > statistics? > Yes, I know, some are at http://www.zope.org/AboutZopeOrg. > But more info of ZOPE setup of www.zope.org and statistics > will sure help. > By statistics, I mean something like provided by > webalizer(www.webalizer.org). > > Forgive me, if I missed what already there. > > LEE, Kwan Soo. > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

Python & Zope? Gurus
by Tom Deprez 02 Feb '00

02 Feb '00

Hi, Instead of giving a fixed list of news, like you can with dtml, I would like to let the news scroll vertical in a frame/applet. ie. The first news classes are shown. Then the scrolling stops for a certain time. After that time, the next 5 news classes are shown, etc... Later on if possible, mouse-interaction (a user can click on the frame/applet and then move the mouse up/down to move the news classes. I know this can be done with Java applets, but can this also be done through Python? So that it can be loaded into Zope as a project? Is there someone who knows if this is possible? And can give me somewhere a link from where I can start creating it? Thanks in advance. Tom.

3 2

Advice needed: converting a PHP3 project to Zope.
by Tony McDonald 02 Feb '00

02 Feb '00

Hi all, (this is longish, so feel free to 'd') I need the lists' wisdom here. I'm considering changing a PHP3 based multiple choice question (MCQ) engine to be zope based. At the moment, I have urls to the PHP server within my Zope system that load the MCQs into a separate frame for display, but would really like the MCQs to be 'inline' along with all my other Zopish content. My MCQs are read from MySQL and displayed on the page, and this means that there may be more than one on a page. I also have up to five responses (stems) where the student can answer true/false/don't know. This means that there are fifteen radio buttons for each MCQ question. Currently, to identify each group of radio buttons uniquely I do this; I name each radio button with a name of the form 'q_n_stem_m', where; n = number of the MCQ on the page (starting from zero, so if there's 10 questions on a page, the last variable will be q_9_stem_m). m = the stem counter, again based from 0, so that if there are 5 stems to a question, the counter goes from 0..4. All the radio buttons for a group need to be named the same so that the browser can automatically turn them on and off. eg...for one MCQ. <INPUT TYPE=RADIO NAME=q_0_stem_0 VALUE="1"> == True selection <INPUT TYPE=RADIO NAME=q_0_stem_0 VALUE="0"> == False selection <INPUT TYPE=RADIO NAME=q_0_stem_0 VALUE="DK"> == Don't Know selection <INPUT TYPE=RADIO NAME=q_0_stem_1 VALUE="1"> <INPUT TYPE=RADIO NAME=q_0_stem_1 VALUE="0"> <INPUT TYPE=RADIO NAME=q_0_stem_1 VALUE="DK"> <INPUT TYPE=RADIO NAME=q_0_stem_2 VALUE="1"> <INPUT TYPE=RADIO NAME=q_0_stem_2 VALUE="0"> <INPUT TYPE=RADIO NAME=q_0_stem_2 VALUE="DK"> (repeated for q_0_stem_3 and q_0_stem_4). Essentially a radio button group has to be uniquely named on the page, and as we allow students to see the full 142 MCQs at once, that means 710 unique variable names... (ie q_0_stem_0 ... q_141_stem_4). When it comes to marking the questions, I create a variable name in PHP through concatenation and use that as a lookup to get the value of the stem as entered by the student. It's then a relatively simple matter to check whether the student has a stem correct and then add the attempt to a database table. So, having described the problem, what do people think? Is my method of naming stems too complex and unwieldy? Should I stick with PHP (for the time being...) Storing the MCQs in the ZODB isn't really on, as the SQL method has proved very useful and is very heavily used. I can see that I'm in for a forest of DTML here (I've already tried a demo, but doing the 'concatenated' lookup got too complex!), a Python External method looks best (a PythonMethod looks better but I'm not up to speed on that yet!) Any thoughts would be appreciated. Tone. ------ Dr Tony McDonald, FMCC, Networked Learning Environments Project http://nle.ncl.ac.uk/ The Medical School, Newcastle University Tel: +44 191 222 5888 Fingerprint: 3450 876D FA41 B926 D3DD F8C3 F2D0 C3B9 8B38 18A2

1 0

Re: Zope Sites and Info Needed to Convince Boss
by LEE, Kwan Soo 02 Feb '00

02 Feb '00

> on #2. This is a strawman argument. How many hits does your site get > in a peak hour? If it's fewer than 13000, and your site is about as > dynamic as zope.org you can run it on a sub-$1200 P450. we are serving > about 2 million hits a month on that box and gaining. This will be handy info to persuade others to convert to ZOPE. How about put some more info about www.zope.org box configuration and statistics? Yes, I know, some are at http://www.zope.org/AboutZopeOrg. But more info of ZOPE setup of www.zope.org and statistics will sure help. By statistics, I mean something like provided by webalizer(www.webalizer.org). Forgive me, if I missed what already there. LEE, Kwan Soo.

1 0

dtml images and property sheets
by Thomas 02 Feb '00

02 Feb '00

I have a text field in my property sheet where some text is inputted. I want to be write in that text field something like this: <dtml-var myimage> and thus call an image within that Zclass instance's namespace. Seems like dtml won't work here. I am missing something? Any tips or hints appreciated. Thanks, Thomas

1 0

RE: [Zope] Usage of AUTHENTICATED_USER
by Michel Pelletier 02 Feb '00

02 Feb '00

> -----Original Message----- > From: Shane Hathaway [mailto:zope@pi.slcc.edu] > Sent: Tuesday, February 01, 2000 7:49 PM > To: zope(a)zope.org > Subject: [Zope] Usage of AUTHENTICATED_USER > > > Zopistas, > > This is unlikely to be a major issue so I'll just say what's > involved in > exploiting the hole. The manage_addFolder method, used to > create a new > folder, takes the current REQUEST as an argument. All one > needs to do is > call manage_addFolder without a REQUEST argument, and the > extra security > checks are disabled. Thus anyone who can create folders can > also create > default user folders. Can you report this bug to the collector? > The issue is that there is no apparent way for a method such as > manage_addFolder to get the current User object to perform a proper > security check. Getting it using REQUEST['AUTHENTICATED_USER'] isn't > reliable. In fact, it is possible to call > <dtml-call "REQUEST.set('AUTHENTICATED_USER', bogusSuperUser)"> > which works but fortunately doesn't have much effect at present. > (bogusSuperUser would be a folder with DTML methods has_permission, > has_role, validate, etc. and would masquerade as a SuperUser object.) Hmmm... this might be considered a problem, can you submit this to the collector also? -Michel

1 0

where's the Distribution tab ?
by Jerome ALET 02 Feb '00

02 Feb '00

Hi, At work I'm designing a Zclass which subclasses ObjectManager and which have some subclasses. because I wanted to continue my work at home, I've created a Distribution with the Distribution tab and I've installed it at home to work offline (telephone is not a cheap thing here). At home I've continued my work, no problem, all works fine. However when I wanted to create a new distribution for my Zclass to bring it back to my office then I noticed that the Distribution tab was nowhere on the screen although it is present for some other Zclasses. I've tried to access directly to the manage_distributionView method for my product and it said to me: "this product is not redistributable" where does the problem come from ? Does Zope refuse to "redistribute" something which was written on another Zope server ? I hope (read: I'm sure) it's not the case. thanks. Jerome ALET - alet(a)unice.fr - http://cortex.unice.fr/~jerome Faculte de Medecine de Nice - http://noe.unice.fr - Tel: 04 93 37 76 30 28 Avenue de Valombrose - 06107 NICE Cedex 2 - FRANCE

1 0

RE: [Zope] combining Zope sites
by Michel Pelletier 02 Feb '00

02 Feb '00

Export your content from one, and import it into the other. -Michel > -----Original Message----- > From: Timothy Wilson [mailto:wilson@visi.com] > Sent: Wednesday, February 02, 2000 9:55 AM > To: Zope listserv > Subject: [Zope] combining Zope sites > > > Hi everyone, > > What's the best way to merge a couple Zope sites into one? I > assume that I > can't cut-and-paste between two different Zope sites. Do I have to > recreate all of the DTML documents, methods, etc? > > -Tim > > -- > Tim Wilson | Visit Sibley online: | Check out: > Henry Sibley H.S. | http://www.isd197.k12.mn.us/ | > http://www.zope.org/ > W. St. Paul, MN | | > http://slashdot.org/ > wilson(a)visi.com | <dtml-var pithy_quote> | http://linux.com/ > > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

combining Zope sites
by Timothy Wilson 02 Feb '00

02 Feb '00

Hi everyone, What's the best way to merge a couple Zope sites into one? I assume that I can't cut-and-paste between two different Zope sites. Do I have to recreate all of the DTML documents, methods, etc? -Tim -- Tim Wilson | Visit Sibley online: | Check out: Henry Sibley H.S. | http://www.isd197.k12.mn.us/ | http://www.zope.org/ W. St. Paul, MN | | http://slashdot.org/ wilson(a)visi.com | <dtml-var pithy_quote> | http://linux.com/

2 1