February 2000 - Zope

How safe is "view management screens"?
by Lalo Martins 21 Feb '00

21 Feb '00

Since one of my sites doesn't use any password-protected database connection, or anything else that I can't let my users see, and since the site is primarily directed at the Free Software community, I'm considering a way of allowing users to view all my source code. Just adding a ``view source'' method may not cut it, because cross-method calls would obscure a lot of the thing. I was thinking that perhaps the most easy and powerful way would be giving ``View management screens'' to Anonymous. Assuming I don't give them any add/change/delete permissions, that should be safe enought, no? Or am I missing something? (If I can do that, it would be also very cool because I'd be showing off what Zope can do. Of course I'd have to make the Products I use available for download somewhere else, but that's a given anyway.) []s, |alo +---- -- I am Lalo of deB-org. You will be freed. Resistance is futile. http://www.webcom.com/lalo mailto:lalo@webcom.com pgp key in the web page Debian GNU/Linux --- http://www.debian.org Brazil of Darkness -- http://zope.gf.com.br/BroDar

2 1

Re: [Zope] how does dtml-if evaluate REQUEST variables?
by J C Lawrence 21 Feb '00

21 Feb '00

On Wed, 16 Feb 2000 21:32:25 +0100 Ulrich Wisser <u.wisser(a)luna-park.de> wrote: > <dtml-if entryid> > evalutes true when > http://server/dtml.doc?entryid=0 > is called. I thought 0 would evaluate to false. How can I tell > dtml to evalute to false? In case you haven't gotten a reply already (I don't see one on quick scan). My observation is that when variables are passed in the URL they aee typed as strings, and thus you end up with (effectively): entryid="0" which most certainly isn't false. Try this: <dtml-if "_.int(entryid)"> -- J C Lawrence Home: claw(a)kanga.nu ----------(*) Other: coder(a)kanga.nu --=| A man is as sane as he is dangerous to his environment |=--

2 1

Re: data.fs corruption
by alan runyan 21 Feb '00

21 Feb '00

I hope you dont mind, but im cc'ing the list-- ppl need to see this one of the scariest things i can imagine is a customer calling up saying the entire *monolithic* database is corrupt. the entire workday would grind to a halt and someone would have to jump through lots of hoops to just get the database (zope filesystem) back in order :(((( this is unacceptable (period) for some of the uses i had in store for Zope. is zope going to support multiple databases? jim f. said the ZODB is a SPOF -- are there any plans on fixing this? is there anyway to 'block all writes' while backing up the ZODB? w/o taking the entire website down/mostly reads anyways? is there a way you can 'scan' to see if the ZODB is intact? i.e. having a process scan the ZODB and return whether or not it is valid? what was the 'offending' transaction? thanks ~alan ----- Original Message ----- From: "M. Adam Kendall" <mak(a)kha0s.org> To: "alan runyan" <runyaga(a)thisbox.com> Sent: Sunday, February 20, 2000 1:52 AM Subject: RE: data.fs corruption > Of course, you probably aren't going to like this answer, > but I spent about 4.5 hours with the Tranalyzer product, > and a good hex editor hacking away at my Data.fs. The good > news: I recovered all my data. The bad news: I have alot > less hair now.. > > I basically used Tranalyzer to figure out where it blew up, > and then from the comments in FileStorage.py in the Zope source > I was able to figure out the file format for the Data.fs. At > least I knew how many bytes record/field lengths were supposed > to be. Then using the hex editor I manipulated the Data.fs until > I had ripped out the offending transaction record. > > Worked like a charm but was a very long drawn out process.. > I would say that Digital Creations needs to provide a tool > for easy data recover from corrupt Data.fs. > > Adam >

2 1

TextIndex of DTMLDocument
by Sin Hang Kin 21 Feb '00

21 Feb '00

How can I make a TextIndex of the textual content of DTMLDocument? I do not known what name is to place in the Add Index : Box. Rgs, Kent Sin

2 1

Modify an objet
by Francois-Regis CHALAOUX 21 Feb '00

21 Feb '00

Thanks for my previous question on PARENTS. I'm so stupid, python slices are so cool. Another question : <dtml-call "mePerso.manage_changeProperties({ 'company':'world-company', 'name':'Sylvestre', 'surname':'joe', 'e-mail':name+'.'name+'@'+idomain, 'idomain':'world-company' })"> should change my object properties. But nothing append Any suggestion? mePerso is an instance of ZClass I created. FR

2 1

current CVS Catalog code is busted (lexicon support)
by Anthony Baxter 21 Feb '00

21 Feb '00

[also reported to collector, but this breaks textindex Catalogs totally, so I thought it was also worth cc'ing to the list] The current CVS version of ZCatalog has a couple of nasty bugs in it. First off, the standard nonglobbing Lexicon uses a variable 'self.counter', without ever initialising it. Oops. Secondly, Catalog handles the default Lexicon case inconsistently. In the case of a lexicon being provided, it stores the name as self.lexicon, otherwise it stores a Lexicon _object_ as self.lexicon. Later on, it tries to do a getattr with the lexicon object as the second arg. The first bug utterly breaks non-globbing Lexicons. The second bug breaks textindexes that don't provide a lexicon at creation time. A patch for both follows. Note that the patch tries to handle gracefully existing Catalogs and Lexicons that might be broken. The complete fix would also handle the case of the Lexicon being created in a saner way - maybe always store the name... ? If the email system munges this patch, it's also at http://www.zope.org/Members/anthony/patches/zcatalog-lexicon.diff Thanks, Anthony Index: Lexicon.py =================================================================== RCS file: /cvs-repository/Zope2/lib/python/SearchIndex/Lexicon.py,v retrieving revision 1.8 diff -u -r1.8 Lexicon.py --- Lexicon.py 2000/02/01 18:40:20 1.8 +++ Lexicon.py 2000/02/19 08:55:16 @@ -115,6 +115,7 @@ def __init__(self): self._lexicon = OIBTree() + self.counter = 0 def set(self, word): """ return the word id of 'word' """ @@ -123,6 +124,8 @@ return self._lexicon[word] else: + if not hasattr(self, 'counter'): + self.counter = 0 self._lexicon[intern(word)] = self.counter self.counter = self.counter + 1 return self.counter Index: UnTextIndex.py =================================================================== RCS file: /cvs-repository/Zope2/lib/python/SearchIndex/UnTextIndex.py,v retrieving revision 1.19 diff -u -r1.19 UnTextIndex.py --- UnTextIndex.py 2000/01/31 19:25:35 1.19 +++ UnTextIndex.py 2000/02/19 08:55:16 @@ -172,7 +172,10 @@ Zope. I don't think indexes were ever intended to participate in this way, but I don't see too much of a problem with it. """ - vocab = getattr(self, vocab_id) + if type(vocab_id) is not type(""): + vocab = vocab_id + else: + vocab = getattr(self, vocab_id) return vocab.lexicon -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

2 1

Re: BannerSystem
by Bill Anderson 21 Feb '00

21 Feb '00

(Cc'd to the Zope list for archival purposes ;) Alexander Limi wrote: > > > You need the Renderable Product by Lalo: > > http://www.zope.org/Members/lalo > > OK, it will install now. I've created an Ad Manager, and added a banner-ad. > when I want to show it I try <dtml-var hbanner>, but I get the following: > > Error Type: TypeError > Error Value: too many arguments; expected 1, got 3 > > ...plus an ugly traceback. > > The documentation doesn't tell me how to use this object. Can you? :) > > Alexander. The documentation on-line is the most up-todate information. It actaully deals with this issue. It seems that when called <dtml-var hbanner> it will barf like this. If you call it like this: <dtml-var "hbanner.get_banner()"> it works fine. In future versions, I anticipate eliminating the requirement for Renderable, along with a fix for this. -- In flying I have learned that carelessness and overconfidence are usually far more dangerous than deliberately accepted risks. -- Wilbur Wright in a letter to his father, September 1900

1 0

Job opportunities, oh yeh.
by FR Chalaoux 20 Feb '00

20 Feb '00

Hi All, A new Job opportunities issue is born on Zope-France ( http://www.zope-france.org:8080/ressources/offreemploi ). Good Luck, FRC

1 0

using Zope on a third-party web hosting provider
by Matthew Scott 20 Feb '00

20 Feb '00

After I evaluated Zope on my home machine and started using it to develop a web site, I wanted to use it to revamp and improve upon another web site I run. The problem was, I only evaluated and started using Zope on machines that I had full, administrator access to. The web site I wanted to revamp is on a third-party hosting site where I don't have much control. I searched through mailing list archives but couldn't find a suitable solution that would work on the provider I use (csoft.net) I figured out a solution that is only slightly awkward and works fine for my uses, so I am posting it here for others to use. Hopefully this will allow more people to evaluate Zope and more people to use the product on third-party virtual hosts. Some configuration details about csoft.net's servers before I outline the solution. You'll have to take these into account if you adapt this to another provider. * telnet/ssh access is provided * necessary compilers/interpreters (gcc and python) are installed * CGI scripts can run anywhere in the www tree as long as they have the .cgi extension * scripts can be called with or without their extension -- i.e. as long as there are no other files starting with "zope" you can call zope.cgi with either zope or zope.cgi in the URL * htaccess files can be used for authentication * your CGI scripts are run under your UID The solution (adapt to your provider): * unpack zope into your home directory (I named my folder ~/zope) * go into ~/zope and run: python w_pcgi.py This will compile and prepare Zope for use * edit your ~/zope/start script to read as follows (this turns off the web, FTP, and monitor servers as well as turning off debugging) #! /bin/sh reldir=`dirname $0` PYTHONHOME=`cd $reldir; pwd` export PYTHONHOME exec /usr/bin/python \ $PYTHONHOME/z2.py \ -w '' \ -f '' \ -m '' * edit the "access" file (or create it if it doesn't exist yet) and put in one line: superuser: (You can name the user whatever you like. Remember the colon after the username; do not put anything after the colon though) * cd ~ * htpasswd -c zopeusers superuser (This will prompt you for the superuser password. Change superuser to whatever name you want your superuser to be) * cd ~/www (this is the root document folder on csoft.net accounts) * cp ~/zope/Zope.cgi ./zope.cgi (Copy the zope CGI script to your root document folder. I actually called mine domain.cgi so I can go to www.domain.cgi/domain/folder/etc but you can name it whatever you like * mkdir manage; cd manage (This will make a management folder that will authenticate your password. This is where it gets just a tad klugey) * create a .htaccess file in this folder containing this: AuthType Basic AuthName Zope-realm AuthUserFile /path/to/your/home/zopeusers require valid-user * cp ../zope.cgi . (This provies your manage folder with access to Zope) I hope I didn't leave any steps out. Here is how you view and manage your new Zope installation based on the instructions above: * to view your Zope objects as normal, just go to http://www.domain.com/zope/ (or http://www.domain.com/zope.cgi/ if you cannot leave off the trailing .cgi) * to view your Zope management interface, you need to go to http://www.domain.com/manage/zope.cgi/manage and authenticate yourself. You can actually view your Zope web here by leaving off the last /manage but you will still need to authenticate yourself. Some notes: * if you want to add users to the Zope interface, add them there with no passwords. Then, go to your home directory and type "htpasswd zopeusers username" to add/change a user in the password list that apache uses. * if you need to use Zope as your index file, use your index file in your root document folder to redirect. For instance, since csoft.net supports PHP, I can create a small one-line index.php3 file to accomplish this very quickly: <? Header('Redirect: http://www.domain.com/zope/'); ?> Please let me know if there are any improvements you can see in this setup, or any pitfalls I have not yet discovered. Happy Zope smoking! -- ._-+$=%##########%=$+-_. |# Matthew R. Scott #| |# gldnspud(a)lab.net #| `~-+$=%##########%=$+-~'

2 1

New to Zope help needed
by Lee Catlett 20 Feb '00

20 Feb '00

Hi to all those who have been there and done that, First of all, I haven't and would like to ask a few questions to those who are out there in stellar lands if I could. I've basically read the docs and played with the demo somewhat although not exactly clear and have some really basic questions. Like:: 1. Does the first folder you make, represent your main page?? Told you these were simplistic!! 2. If that is the case, then all folders under the main must be subpages of the site, Right? 4. How to you link the different folders(pages) together? Hysterical by now I bet!! 3. How do you get apache to look at zope for it's first index.html page when it gets it's first page from the ../httpd/html directory?? Also new to Linux!! 4. Is there an already put together site somewhere that would show me all this info without having to bug anyone and I could just look and maybe figure this all out for myself?? Wouldn't believe I do this in the NT world with ease would you! This is just such a different twist for me it's a little confusing (really a lot). Anyway if I could get a response from anyone I'd probably be elated after this episode, and thanks Regards, Lee

3 2