February 2000 - Zope

Zope crashing with Z SQL Methods
by Richard Dougherty 14 Feb '00

14 Feb '00

Hi When I execute SQL (using a Z SQLMethod) which causes an error, Zope crashes. Errors include malformed SQL (if I make a typo, for instance), and inserting a duplicate primary key. This happens with more than one flavour of database (PygreSQL through ZPyGreSQLDA-rjr 0.3, and Gadfly). We're running Zope 2.1.2, but my sysadmin tells me this error has been happening with previous versions too. Our version is installed from RPMs, using PCGI+Apache. We also seemed to have this problem when we were using ZServer. Thanks for any help. Richard

1 0

GenericUserFolder Exception
by James W. Howe 14 Feb '00

14 Feb '00

In trying to figure out why I'm having trouble with GenericUserFolder, I finally got some useful information. When I try and display the userList, I'm actually getting an exception inside of GUF. The exception occurs on this line (137) of code from genericUserFolder.py: data = self.userList.im_func(self,self.REQUEST) The exception is an attribute error on im_func. Since I assume that this code must work in some environments I'm wondering if I just don't have something configured correctly. I'm still poking around trying to figure this stuff out and if I gain any more insight I will pass it along. In the meantime, if anyone has run into this problem before and knows how to correct the situation, I would appreciate hearing about it. Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

2 1

GenericUserFolder - Working now
by James W. Howe 14 Feb '00

14 Feb '00

I just got the GenericUserFolder to work under Zope 2.1.3. To make things work, I edited the code in GenericUserFolder.py and User.py and removed any reference to the im_func attribute. For example, in GenericUserFolder there was this line of code: data = self.userList.im_func(self,self.REQUEST) which always caused an exception. I changed it to this: data = self.userList(self,self.REQUEST) I also fixed places in User.py which referenced im_func. I simply removed the reference, restarted Zope and now GUF seems to be doing what I expect. Is there something about this version of Zope such that the im_func attribute doesn't need to be called? Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

1 0

RE: [Zope-PTK] PROPOSAL: A Confidence Mechanism in User Role Management
by Chip Vanek 14 Feb '00

14 Feb '00

I love this Confidence Rheostat! Along with an integrated content tagging framework you can really tailor security to need. Your POST via SSL & volatile cookie/tokens make it work. I just have couple of concerns and one addition. I am just seeing this thread so forgive me if this has been asked and answered. Would this mechanism allow for chaining of access requests? Something analogues to "Oh, you want to see THAT file, well I don't know but, I know you does, hang on.." So specific resources or capabilities would delegate access authorization to other systems. Can this dynamic security mechanism store different confidence levels for different conditions? Multiple user logon in one 6 hour period from client location in time zone 10 hours apart could trigger higher required confidence. With these type of fundamental security model changes it would be great to enable a very fine grained distributed security model. This would enable any system user to create, manage, and use system security capabilities. A user could then share one file from their Member Folder with other select system users. They could also allow only a subset of these users to "vouch" for access by other not originally on the list. This could be a very lightweight list of "locks" associated with each resource and list of "keys" associated with any consumer of a resource. Your SSL enabled creation of a cookie token would be just a special case of one of these "keys". Each "Key" would have a TTL and a set of resource locks it might be able to open. I am sure that all of this is way more then you had in mind to solve. At the least I would hope that this mechanism would allow any two portals to share the client cookies confidence level. I understand that there needs to be distinct cookies for each site and each client machine. The target would be to simplify the life of an honest users you is the member of multiple portal communities and uses multiple machines. A ring of cooperating portals could automagically generate a new cookie if a valid cookie from a brother portal was found. Actually this last idea seems totally undoable but, the need still exists. Sorry for the long message. In any case, if your proposal could be quickly implemented it would be so much better then the way things work now. Best, Chip Vanek chip(a)upcast.com >-----Original Message----- >From: zope-ptk-admin(a)zope.org [mailto:zope-ptk-admin@zope.org]On Behalf >Of Christopher Petrilli >Sent: Thursday, February 10, 2000 6:08 AM >To: Rob Page; Mike Pelletier >Cc: zope-ptk(a)zope.org >Subject: Re: [Zope-PTK] PROPOSAL: A Confidence Mechanism in User Role >Management > > >On 2/9/00 11:47 PM, Rob Page at rob.page(a)digicool.com wrote: > >>> So, if cleartext is less trustworthy because it's sniffable, it >>> follows that using cleartext once compromises the secure >>> channels as well, and so they should be no more trusted >than cleartext >> UNTIL >>> the password's been changed. Oh. But, if you are now >> less-than-confident >>> of the remote user, you can't let them change the password so as to >> become trusted >>> again! D'oh. Seems like a Catch 22, I must not be getting >something. >> >> This is a valid point. This is why many sites have you >login over SSL. >> Perhaps they assign you an expiring cookie which you can carry around >> and over unsecure channels. Ideally, password specification and >> password presentation are all done over secure comm - then you don't >> have to discount the confidence in the password as an accurate >> authentication mechanism. > >This is what I was mentioning at the bottom of another email, >which is that >you have the following chain of events: > > * User is presented a login form over HTTP > * Form is POSTED via SSL, which sets a cookie in the browser > * Cookie is volatile and used for auth during session > >The cookie must be something non-guessable, so I proposed the >following: > > base64(sha1(username + ip_address + random_int)) > >This gives you a token that should not be "guessable" and in >addition, as >long as you keep the random integer chosen around, you can >validate that the >cookie is valid using 2 options: > > * Recompute auth information and compare (the correct way, >long story) > * Store IP address and precalced cookie, and compare those. > >Chris >-- >| Christopher Petrilli Python Powered Digital >Creations, Inc. >| petrilli(a)digicool.com http://www.digicool.com _______________________________________________ Zope-PTK maillist - Zope-PTK(a)zope.org http://lists.zope.org/mailman/listinfo/zope-ptk

2 1

Re: [Zope] why use eGroups for the list archives?
by Willem Broekema 14 Feb '00

14 Feb '00

Hi Darren, The list is archived at more places, for example at http://marc.theaimsgroup.com/ (well, http://marc.theaimsgroup.com/?l=zope&r=1&w=2 to be exact :-) They have a bunch of archives of other lists, like Linux, PHP, Apache, KDE, SQL, PHP... You can even search in all, or in a section of some lists, which is very useful if you want info about, say, Zope vs. Midgard, as you will get results from both Zope as Midgard lists. (By the way, Google.com does a surprisingly well, too, returning many relevant mailing list posts) - Willem __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com

1 0

RE: [Zope] ZLogger under Windows NT?
by James W. Howe 14 Feb '00

14 Feb '00

At 01:01 PM 2/14/00 -0500, Martijn Pieters wrote: >From: James W. Howe [mailto:jwh@allencreek.com] > > > > I'm trying to track down why things aren't working in my Zope/Python > > code. [...] Can someone give me some more detailed information on > > how to get ZLogger to work under Windows NT? > >STUPID_FILE_LOGGER is a typo. It should be STUPID_LOG_FILE. >[...] I figured that out about the time I received your message. :-) I've now got logging working but I've run into a new problem and I don't know whether it represents a bug in ZLogger, the code I'm trying to test, or not a bug at all. The problem I have is that one of the LOG statements that I'm using is causing a "call of non-function (type file)" error in Zope. The code is failing on line 99 of stupidFileLogger.py. My LOG code looks like this: LOG('GUF',ERROR, 'An exception was raised by %s' \ % self.userList.absolute_url(),'',exc_info()) The code causing the traceback from stupidFileLogger.py is: _stupid_dest("%s: %s\n" % error[:2]) I'm not a Python expert, but what I assume is happening is that this statement is failing, and since it wasn't in a try block, the standard ZPublisher error handler gets invoked which yields my "Zope Error" page. Is this correct? If so, why does this line fail and is this a general bug with ZLogger? Thanks. James W. Howe mailto:jwh@allencreek.com Allen Creek Software, Inc. pgpkey: http://ic.net/~jwh/pgpkey.html Ann Arbor, MI 48103

1 0

RE: [Zope] ZLogger under Windows NT?
by Martijn Pieters 14 Feb '00

14 Feb '00

From: James W. Howe [mailto:jwh@allencreek.com] > > I'm trying to track down why things aren't working in my Zope/Python > code. The code I'm working with uses the ZLogger capability > and has LOG > commands sprinkled throughout. However, I can't seem to > figure out where > this information actually gets sent. I've read the > LOGGING.TXT file (and > the HowTo) and I still don't quite understand what I need to do for a > Windows environment. For example, if I just want to log > information to a > file what do I need to do? I tried adding > STUPID_FILE_LOGGER="var\Zope.log" and ZSYSLOG_SERVER="...:514" to my > startup but I still get no log information and the Zope.log > file does not > exist on my system. Can someone give me some more detailed > information on > how to get ZLogger to work under Windows NT? STUPID_FILE_LOGGER is a typo. It should be STUPID_LOG_FILE. The CHANGES.txt file is correct. Try using a UNIX style forward slash as well, Python knows how to handle that. ZSYSLOG_SERVER is not supported on WinNT I believe, unless you have a syslog server runinng a UNIX box somewhere. -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

1 0

RE: [Zope] https and ZClient
by Martijn Pieters 14 Feb '00

14 Feb '00

From: Petru Paler <ppetru(a)coltronix.com> > On Mon, Feb 14, 2000 at 08:43:02AM -0600, Jim Sanford wrote: > > Would it be correct to assume that ZClient cannot access URLs via https (SSL)? > > No. From: Jim Sanford [mailto:jsanford@atinucleus.com] > So are you saying that although Zope cannot serve SSL it can > be a SSL client? > > I have a situation where I am using zclient to try and > retrieve a Word Document fromr corporate extranet via https. > I get an error. I think Petru meant that you cannot use ZClient as a SSL client. Indeed, you can't. I believe that libraries like OpenSSL do include command line clients though. You can also have a look at M2Crypto, a Python SSL library build on OpenSSL, which includes SSL extensions to the standard Python HTTP client libraries. You can download it from: http://mars.post1.com/home/ngps/m2/ -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

2 1

RE: [Zope] AUTHENTICATED_USER?
by Martijn Pieters 14 Feb '00

14 Feb '00

From: Guy Davis [mailto:davis@arc.ab.ca] > Martijn Pieters wrote: > > > > Yes. You can make a new Role, let's call it DomainUser. You > give this > > Role all privileges that the Anonymous Role has, and you revoke all > > rights from the Anonymous Role. > > > > Now you create a new user, and call this > AnonymousDomainUser. This user > > you give _no_ password, just leave the password fields blank. You do > > specify the domains however; it is a space separated list of domain > > specs, where each domain spec can be either a domain name, or an IP > > address, where wildcards can be used anywhere between the dots. For > > example: *.zope.org *.digicool.com 192.8.*.* is a valid > domain spec. And > > you also give the user the DomainUser Role. > > > > Now, as soon as a visitor comes to your site from a domain > that matches > > the domain spec, Zope will, without asking for a password, match him > > against the AnonymousDomainUser User, give him the > DomainUser Role, and > > grant that visitor access. > > > > Anyone from any other domain will be prompted for a username and > > password. > > Thanks for this response. I saved it for a while but recently got > around to following your suggestions. I set this up so that > AnonymousDomainUser is available at the top level folder. Then in > /Projects/TestProject, I have a whole set of other users as > there is no > anonymous access to TestProject. When some from the right > domain brings > up the root folder, they match to AnonymousDomainUser but > when they try > to bring up TestProject, their username and password are consistently > rejected. > > If I then go back to the security panel of the root folder > and give the > Anonymous role just the capability to view, they can then > login properly > and access TestProject, but then I have lost the domain filtering on > anonymous viewers. > > Is there some way to have both anonymous domain-restricted access and > also certain directories with only authorized-user access? Thanks. You should be able too.. Hmmm. Where is the Role that has access to TestProject defined? And do the users that should have access to the TestProject Folder have that Role? Try defining the Role on the Root object, if it is not defined there. If this helps, there might be a bug here somewhere, although I am not that versed in the security system yet to be sure. -- Martijn Pieters, Software Engineer | Digital Creations http://www.digicool.com | Creators of Zope http://www.zope.org | mailto:mj@digicool.com ICQ: 4532236 | PGP: http://wwwkeys.nl.pgp.net:11371/pks/lookup?op=get&search=0xA8A32149 -------------------------------------------

1 0

Re: [Zope] Arrggh, more namespace confusion ...
by Tres Seaver 14 Feb '00

14 Feb '00

Darran Edmundsen <Darran.Edmundson%40anu.edu.au> wrote: >I'm on the tail-end of another 48-hour Zoping marathon but >just when I can see the proverbial light - click(). Arggh. >I've pared my current problem down to: > >root > spam (DTML method) > folder1 > folder2 > >where spam contains: > ><dtml-var "REQUEST.set('mylist', ['folder1','folder2'])"> OK, mylist is now a list of strings. ><dtml-in mylist> > <dtml-with sequence-item><dtml-var id></dtml-with> ></dtml-in> That shouldn't work -- sequence-item is a string, while dtml-with expects an object. Try this instead:: <dtml-in mylist> <dtml-let refID=sequence-item>  <dtml-with "_[ refID ]">  <dtml-var id>  </dtml-with> </dtml-let> </dtml-in> > >My aim is to loop over mylist pushing sequence-item onto >the namespace stack, ie, > > <dtml-with folder1><dtml-var id></dtml-with> > <dtml-with folder2><dtml-var id></dtml-with> > >I've toyed with every version of the <dtml-with> tag I >can imagine but to no avail. Can someone please explain >the source of my confusion. -- ========================================================= Tres Seaver tseaver(a)palladion.com 713-523-6582 Palladion Software http://www.palladion.com

1 0