February 2000 - Zope

Re: [Zope] dtml-var question
by Tres Seaver 24 Feb '00

24 Feb '00

Evan Simpson <evan(a)4-am.com> wrote: > > ----- Original Message ----- > From: James W. Howe <jwh(a)allencreek.com> > > I have a DTMLMethod named foo. I can access this method by using the > > following statement: > > > > <dtml-var foo> > > > > If I wanted to use the "quoted" syntax to access this method (perhaps > > because it resides in some other folder) which of the following is exactly > > equivalent to the statement above: > [snip] > > <dtml-var "foo(_.None, _)"> > > The above is definitely closer, and seems to behave the same in every place > I've used it. I can't say for sure that it is *exactly* equivalent, though. Hmm, maybe <dtml-var expr="foo(_.None, _, REQUEST)"> is closer? -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

4 3

RE: [Zope] Private Product Objects (was: object icons)
by Martijn Pieters 24 Feb '00

24 Feb '00

From: Loren Stafford [mailto:lstaffor@dynalogic.com] > > > Now that I've had breakfast and thought about this a > little more, I see > > > there is broader issue: how to handle the special needs > of objects that > are > > > private to a product. My product is an event scheduler. > (Terry, who > started > > > the "object icons" thread, may have a different > situation. Jump in and > tell > > > us about your product, Terry.) The Scheduler product registers an > > > catalog-aware Event class so user's can define scheduled > events. The > product > > > keeps track of all Events in a ZCatalog "Schedule". Now, > Schedule is a > > > persistent object and has a class definition, but the one and only > instance > > > is created by the product and load time, if an instance > doesn't already > > > exist. The Schedule has some special usage requirements: > > > > > > 1. There should be only one instance. That's why its class is not > > > registered. > > > > Hmm, I guess I don't see the necessity of making it a > Singleton here. > Suppose > > you need to segregate events into separate priority > classes, or guarantee > that, > > when executed, the run with the permissions of different > users? Splitting > up > > the schedule _might_ not be a terrible thing to do. Your > default case > could > > then just require dropping a single instance of the > Schedule class at the > root > > of your Zope hierarchy, and leaving it there. > > I'm beginning to think that way too. I haven't really dealt > with priority or > permissions yet (and I probably won't until Phase II), but trying to > enforce a singleton is more trouble than it's worth. What are your problems? Doesn't my code work anymore? The reasons I chose to make ZScheduler a singleton are: 1. Extra threads in Zope affect the performance of Zope. Only one ZScheduler object needs only one extra thread. 2. Event objects should be able to find the ZScheduler at all times, just like the Add list can count on the id Control_Panel existing. 3. The ZScheduler object can act as a management interface into the underlying Events, like show what events are about to be executed, show reports on the number of Events executed, etc. Priority could simply be a property on a Event object, something that can then be sorted on from the catalog. No multiple Schedulers needed here. > > > > > > 2. It probably shouldn't show up on users' navigation > bars and folder > lists. > > > This probably is not a problem, because Schedule has a > unique meta-type. > But > > > that's not a watertight solution. A standard method for marking it > invisible > > > would be better. > > > > If Schedule derives from ZCatalog, as it seems, and the > Event class uses > the > > well-known schedule ID as its default_catalog_id, then it isn't even > necessary > > to "contain" the events within the schedule object -- they > will find it > anywhere > > above them in the tree by acquisition (think "uncle > Schedule" instead of > "papa > > Schedule"). > > I guess I envisioned a single Schedule, because I imagined > only a single > Dispatcher thread. If there are more Schedules, either the > Dispatcher will > need a catalog to find all of the Schedules, or each Schedule > will need it's > own dispatcher. Let me hold that last thought for awhile... Again, there is no need to have more than one Scheduler, you solve no problems with that, you only create more. You don't need to hide the ZScheduler from view, just like you don't need to hide the Catalog. It can be used as a organising container for everything related to Events as well. Stock Catalog objects are containers for the same reasons. > > > > > > > > 3. If and when it does show up (as on the manage_main > menu) it should be > > > identified with the product (to avoid the "Whaz dis?" > confusion). That's > why > > > I want it to have an icon that shows it is part Scheduler product. > > > > Solved if Schedule is an "ordinary" ZClass. > Check. > Solved if you cannot manually add new Scheduler objects. KISS, keep it simple, stupid. > > > > > > > > 4. No one, not even a manager, should be able to delete > it accidently. > You > > > can make an object undeletable by putting its ID in the > list of reserved > > > names, but I have found, during development of Scheduler, > that this hack > > > causes more problems than it's worth. I might settle for > letting be > deleted > > > by a manager. > > > > Again, solved for "ordinary" ZClass instances -- just set > the permissions > so. > > I sort of agree. One problem with deleting a Schedule is if > it has events > cataloged in it -- currently that breaks the event objects. A > manage_beforeDelete method could just block a delete in that > case. Also the > Dispatcher task has to be terminated. There must be a way to > do that in a > manage_beforeDelete method. > > Martijn what do you think? You clearly went to a lot of > trouble to put the > Product in control of deleting the Schedule catalog. What are the problems you are experiencing? Especially for the development and alpha/beta stages of the ZScheduler product, I put a hook onto the ZScheduler Product folder to release the protection on the root ZScheduler object when you delete the Products folder. Yes, it is a hack, but it worked for me. I planned on removing it when releasing a stable version. For the reasons I went through all the trouble (which wasn't all that much of a trouble, really. Zope provided the framework), I named earlier in this email. > > > > > > 5. When the product is deleted (I mean really deleted, > because you don't > > > want to use it anymore), the Schedule should be deleted > too. Failing > this, > > > it should at least be deletable (an iffy situation, if you use the > > > reserved_names hack). On the other hand, if you are just > updating the > > > product code, you probably don't want to delete the > Schedule object. It > may > > > contain scheduled events. This is complicated by the fact > that when you > load > > > a product, Zope first deletes the old product. So a > manage_beforeDelete > > > method can't distinguish between a "real" delete and a > code update. I've > > > also discovered that any error in a product's > manage_beforeDelete method > > > makes the product not only undeletable, but (because of > the implicit > delete) > > > unupdatable (un-update-able)! > > > > > > (Hmmm. There's an idea. You could make any object, including the > Schedule, > > > undeletable by giving it a manage_beforeDelete method > that raises an > error.) > > > Indeed, don't delete the ZScheduler automatically. Just state in the documentation that this is unstable, development-grade software, and document the procedure. A product update then will cause the lock to be removed, and then reinstated. If you run into problems with the code, you can use the Monitor to release the lock manually. > > > 6. The Schedule need to have a "well known" ID (I think). > This is for > use in > > > the default_catalog property of the events. I wouldn't > want someone to > > > change the ID of the Schedule arbitrarily. This may be > the same problem > as > > > accidental deletion. > > > > You can override the setId() method to prefent changing the id; > BasicUserFolder > > does this:: > > > > > > def _setId(self, id): > > if id != self.id: > > raise Globals.MessageDialog( > > title='Invalid Id', > > message='Cannot change the id of a UserFolder', > > action ='./manage_main',) > > > > Thanks. I'll use that. > Doesn't using the proetction I implemented also protect you from changing the id? It should! You can't change the id of the standard_html_header/_footer and Control_Panel either, can you? Anyway, since I sort of dumped the code on you, please feel free to ask more questions =) -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

2 1

Re: Zope My/SQL Adapter LD_LIBRARY_PATH
by CURTIS David 24 Feb '00

24 Feb '00

Thanks for the tech tip but it did not solve the problem. When I compile "python build.py" I get this error Traceback(innermost last) File ("build.py" l ine 14, in ? import MySQLdb File "MySQLdb.py:, line 19 in ? from _mysql import * Import Error: libmysqlclient.so.6 cannot open shared object file: no such file or directory. If I type the commnd :: # ls -l /usr/local/zope/lib/python/Products/MySQLdb-0.1.2/mysqlclient.so.6 I get mysqlclient.so.6 -> /usr/local/lib/mysql/mysqlclient.so.7 I think this means that I have a proper link to the file! >>> jfarr(a)real.com 02/22/00 06:16PM >>> > Uh, the path. I'm a newbie so I still don't quite get it. If I type $ set I do not see the LD_LIBRARY_PATH or # "set ". > If I use the command > #/usr/local/lib/mysql=LD_LIBRARY , I get the same result. What should I do to correct this problem? LD_LIBRARY_PATH usually isn't set unless you set it. The easiest fix is to create a symbolic link in /usr/local/lib pointing to the libmysqlclient.so.6 file. You'll probably need root access to do this. cd /usr/local/lib ln -s /usr/local/lib/mysql/libmysqlclient.so.6 libmysqlclient.so.6 This assumes the file is in /usr/local/lib/mysql. If you don't have root access: bash: export LD_LIBRARY_PATH=/usr/local/lib/mysql csh: setenv LD_LIBRARY_PATH /usr/local/lib/mysql should work. -jfarr ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Hi! I'm a signature virus. Copy me into your .sig to join the fun! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _______________________________________________ Zope maillist - Zope(a)zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )

1 0

Re: [Zope] export Z_DEBUG_MODE=no -- broken?
by Tres Seaver 24 Feb '00

24 Feb '00

Michael Hamilton <michael(a)actrix.gen.nz> asked: > To: zope(a)zope.org > Subject: > > Inside lib/python/ZPublisher/HTTPResponse.py there is the following code: > > def _traceback(self,t,v,tb): > tb=self.format_exception(t,v,tb,200) > tb=join(tb,'\n') > tb=self.quoteHTML(tb) > if self.debug_mode: _tbopen, _tbclose = '<PRE>', '</PRE>' > else: _tbopen, _tbclose = '' > return "\n%s\n%s\n%s" % (_tbopen, tb, _tbclose) > > which seems to be a way of switching off traceback dumps in the browser > window and have them wind up in an html comment instead. > > How do I enable this feature. I tried setting Z_DEBUG_MODE to something > other that 1 or yes, but it doesn't seem to do anything. > > If I manually hack the above code to force debug_mode off, then it does > what I want. Martijn Pieters <mj(a)digicool.com> replied: > > Start Zope up with the -D switch. It'll take care of this. Actually, I think what Michael wants is to *remove* the "-D" from the start script (to force the traceback into the comment, instead of being displayed). Tres. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

1 0

changes not "sticking"
by John Deighan 24 Feb '00

24 Feb '00

I installed Zope on an NT Server machine - everything seemed to work OK. Then, from another computer running Internet Explorer, I logged on to the management interface to try to set up a new web site. It asked for a name and password (there's just the one original one right now), which I entered and it accepted. So far, so good. I created a new folder under the root, and proceeded to edit the index_html file. When I click the "Change" button, the screen refreshes with the new DTML code. However, after going through several cycles of this, I used the tree view in the left frame to navigate elsewhere, then to navigate back to the site I created, but the index_html file had its original, default contents! I've tried this several times, each time with the same results. It seems to me that I had not encountered this problem when I went through the Zope tutorial initially; however, that was while sitting at the machine Zope was installed on, and using the "localhost" style URL. When I get home this evening (the Zope machine is there), I will check to see if everything still works that way, but I thought I'd see if either I'm doing something wrong, or anyone has encountered this problem before.

2 2

Re: [Zope] Running Management Interface on Separate HTTP Port
by Hung Jung Lu 24 Feb '00

24 Feb '00

"roland reumerman" <zope_dd-(a)hotmail.com> wrote: >the issue of SECURITY. The Zope web app server and accompanying Oracle >database will be run off the same machine on the extranet, so there's no >security issue with our itnranet there. However, the consultant from the >firewall company recommended that we use different HTTP ports for the >customer interface/application and the management interface. If you are serious about security, you should install two copies of the Zope server. One development copy, and one production copy. Development copy lives inside the firewall, production copy lives outside. You update the production copy only once a while (say, once a month or once a week.) The best strategy is to make the production copy READ-ONLY. Since you are using Oracle database, this shouldn't be a problem. ---------------- And now a question from me to zopists: is there a way to disable all management commands on a Zope site? Or do I have to use Apache re-write rules to block all URLs ending in things like .../manage, .../REQUEST, .../manage_workspace, etc? Seems a lot of work to me. regards, Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Access control & Acquisition...
by Jon Prettyman 24 Feb '00

24 Feb '00

Given a layout such as this: /Control_Panel/Products/UserProperties/UserPropertyClass/ /nmn/premium/acl_users(GenericUserFolder)/userA(role subscriber) /nmn/premium/user_profiles |role subscriber has permission to add UserProperties[s] |role subscriber has permission to View Management Screens |role subscriber has permission to Access contents Scenario: anonymous user access /nmn/premium causes GUF user login logs in as jjp(has role subscriber) sees /nmn/premium/index_html jjp access /nmn/premium/user_profiles/manage sees manage screen with [ADD]UserProperties jjp selects [ADD]UserProperties causes GUF user login screen the log shows that jjp tried to access /nmn/Premium/Users/manage_addProduct/UserProperties/UserPropertiesClass_factory and failed with a 500 Looking at GUF debug messages, it looks like the authentication ``crawls'' up and fails at the root. After perusing the Acquisition Algebra paper Jim Fulton wrote, I see: Acquisition and Security Based on aq_inner Can't access a protected object unless the user database is a common ancestor. Without these rules, it would be possible to "steal" access through acquisition. Is this second item what is causing me to fail? If so, any insights ino how I can work around it? TIA -Jon

2 1

startup at boot - what user to run zope as
by Andy Heath 24 Feb '00

24 Feb '00

Hi, bit of a zope newbie. running on a unix box. I'd like a zope server to startup automatically at boot (so auto-reboot after power failure works ok). Question is - what user should I run zope as - is it safe to run as root? If not, then how can I start it as some other user without giving write permission the the zope/var directory for the pid. Should it be owned by and running as nobody:nogroup? I have complete control of the box so any workable solution possible. Andy -- ------------------------------------------------- Andy Heath a.k.heath(a)shu.ac.uk The Open University +44 (0) 114 2885738

3 2

RE: [Zope] sequence-key usage
by Martijn Pieters 24 Feb '00

24 Feb '00

From: Jim Sanford [mailto:snafford@bellsouth.net] > Thank You. > > I was trying to use sequence-key to get the column names for > ZSQL method query. > > I get an "unscriptable object" error when doing so. > > Is there someway to access the column names of a ZSQL method > query from DTML? Please keep mailing to the list, I don't have all the answers (whatever everyone may say). I believe you can access the metadata only from External Methods. See this How-To for some hints: http://www.zope.org/Members/jpenny/Accessing_a_ZSQL_Method_from_an_Exter nal_Method -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

1 0

Re: [Zope] Object ids in the select
by Hung Jung Lu 24 Feb '00

24 Feb '00

"sin hang kin" <iekentsi-(a)infoez.com.mo> wrote: > ><form action="setmember" method="post"> ><select name="members" size="10" multiple> ><dtml-in catalog> > <option value="<dtml-var catalog.getobject(data_record_id_)>"> > <dtml-var title> > </option> ></dtml-in> ></select> ><input type="submit" value="addmembers"> ></form> > >How I can retrieve the object-ids in setmember. If setmember is a python >method, what is passed to it? (1) First of all, change the name of your selection variable from "members" to "members:list". Whenever you are doing a multiple selection, you SHOULD append the ":list" qualifier, otherwise you get into trouble with the particular case of single item selected. You may also want to get into the habit of using the ":method" tag for the submit button names. This helps when you have multiple submit buttons. <form action="myFolderURL" method="post"> .... <input type="submit" name="myDTMLMethodName:method" value="addmembers"> .... If you can't find documentation on the ":list" and ":method" tag, don't worry, you are not alone. :) (2) The returned ids are in REQUEST.Form.members, or directly accessble also as REQUEST.members or simply members. It's a Python list. So you can do things like <dtml-in members> ... do things with <dtml-var sequence-item>, or _['sequence-item'] </dtml-in> (3) I wouldn't recommend an external method to handle form requests. If you really want to handle things using external methods, then your declaration should not have any argument except self. def setmember(self): .... Then you access the rest through self.REQUEST or self.aq_acquire('attributeName'). Most people use DTML methods/documents to handle form requests. >I have the which collect objects in its attribute as a list. I don't understand what you mean here. English problem? regards, Hung Jung ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0